4.4 Explain the Creation and Configuration Process for Cloud Detection and Response (CDR) and Threat Management CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security analyst is reviewing the types of detection rules available in Cloud Detection and Response (CDR). Which rule type is specifically designed to identify a threat by combining multiple individual events into a single alert based on a defined sequence or relationship?

   • AAnalytic rule
   • BBIOC rule
   • CIOC rule
   • DCorrelation rule
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary function of an Indicator of Compromise (IOC) rule in CDR?

   • ATo aggregate multiple events to identify a coordinated attack
   • BTo use machine learning to identify anomalies in network traffic
   • CTo detect threats based on behavioral patterns of users and processes
   • DTo match events against known malicious indicators such as IPs, domains, or file hashes
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team has identified a known malicious IP address that is used by a threat actor. They want to create a rule that alerts whenever any workload in their cloud environment communicates with this IP. Which type of rule should they create?

   • AAnalytic rule
   • BBIOC rule
   • CIOC rule
   • DCorrelation rule
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How are automation playbooks linked to detection rules in CDR?

   • ABy manually running the playbook after reviewing an alert
   • BBy setting the playbook as an action in the detection rule
   • CBy configuring the playbook to run on a schedule
   • DBy using the playbook to define the conditions of the detection rule
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When creating an automation playbook in CDR, what is the purpose of an integration?

   • ATo connect the playbook to external systems or services
   • BTo define the conditions that trigger the playbook
   • CTo specify the order of steps in the playbook
   • DTo set the severity level of alerts generated by the playbook
   Reveal Solution Discussion Select an answer first