4.4 Explain the Creation and Configuration Process for Cloud Detection and Response (CDR) and Threat Management CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security engineer is creating an automation playbook that should run when a detection rule fires. The playbook needs to perform a series of steps, including gathering additional context from a threat intelligence platform and then blocking the affected user. What must the engineer configure in the playbook?

   • AA condition that matches the detection rule's severity
   • BA schedule that runs the playbook every hour
   • CA trigger and multiple steps with integrations to the threat intelligence platform and identity provider
   • DAn action that updates the detection rule's settings
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What are the key components of an automation playbook in CDR?

   • AIndicators, patterns, and models
   • BConditions, actions, and alerts
   • CLog sources, filters, and thresholds
   • DTriggers, steps, and integrations
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is creating a BIOC rule to detect a new malware that exhibits a specific behavior: it creates a scheduled task and then modifies a registry key. The analyst wants to ensure the rule only triggers when both behaviors occur in sequence within a short time. What should the analyst configure in the BIOC rule?

   • ADefine both behaviors as conditions and set a time window for the sequence
   • BUse an IOC rule with the scheduled task name and registry key
   • CCreate two separate BIOC rules, one for each behavior
   • DUse an analytic rule to detect the behavior pattern
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst wants to detect a user who is creating multiple admin accounts in a short period, which is a common precursor to privilege escalation. The analyst wants to alert on this behavior pattern, not on a specific account name or IP. Which type of rule should they create?

   • ABIOC rule
   • BCorrelation rule
   • CIOC rule
   • DAnalytic rule
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst wants to detect a new ransomware strain that has no known file hashes or C2 domains, but it exhibits a distinct behavior: it encrypts files in rapid succession and then attempts to delete shadow copies. The analyst needs to create a rule that alerts on this behavior pattern. Which type of rule should they create?

   • ABehavioral IOC (BIOC) rule
   • BAnalytic rule
   • CCorrelation rule
   • DIOC rule
   Reveal Solution Discussion Select an answer first