4.4 Explain the Creation and Configuration Process for Cloud Detection and Response (CDR) and Threat Management CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of a correlation rule in Cloud Detection and Response (CDR)?

   • ATo match events against a list of known malicious file hashes
   • BTo detect threats based on behavioral patterns rather than static indicators
   • CTo aggregate and analyze multiple events to detect a threat that may not be visible in a single event
   • DTo use machine learning models to identify anomalous behavior
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team wants to detect anomalous behavior in their cloud environment, such as a workload suddenly communicating with a new external IP or a user accessing data at unusual times. They have a large volume of data and want to reduce false positives while still catching true anomalies. They decide to use an analytic rule. What is the best way to configure the analytic rule to achieve this?

   • AUse a machine learning model that learns normal behavior over time and set a sensitivity threshold
   • BCreate a separate analytic rule for each metric
   • CUse a static threshold for all metrics
   • DUse an IOC rule with known malicious IPs
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security engineer is creating an automation playbook in CDR that should run when a specific detection rule fires. The playbook needs to send a notification to a Slack channel and create a ticket in ServiceNow. What must the engineer configure in the playbook?

   • AAn action that updates the detection rule's settings
   • BA trigger and steps with integrations to Slack and ServiceNow
   • CA condition that matches the detection rule's severity
   • DA schedule that runs the playbook every hour
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A cloud security team notices that a single failed login is common, but multiple failed logins across different accounts from the same source IP within a short time window indicate a brute-force attack. They want to create a rule that triggers only when the pattern of multiple failures is observed. Which type of rule should they configure?

   • ABIOC rule
   • BAnalytic rule
   • CCorrelation rule
   • DIOC rule
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of a behavioral pattern that a BIOC rule might detect?

   • AA file hash that matches a known malware sample
   • BA connection to a known malicious domain
   • CAn IP address that has been reported in threat intelligence feeds
   • DA process spawning a command shell and then downloading a file
   Reveal Solution Discussion Select an answer first