4.4 Explain the Creation and Configuration Process for Cloud Detection and Response (CDR) and Threat Management CLOUD-SECURITY-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of an indicator that an IOC rule would match?

   • AA known malicious file hash
   • BAn unusual sequence of commands executed by a user
   • CA user logging in from a new geographic location
   • DA process creating multiple files in a short time
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst has created a detection rule that identifies suspicious PowerShell activity. They want an automation playbook to run automatically whenever this rule fires. What is the correct way to link the playbook to the detection rule?

   • AManually run the playbook when the alert appears
   • BSet the playbook to run on all alerts
   • CConfigure the playbook as an action in the detection rule
   • DCreate a separate schedule that triggers the playbook
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When configuring a detection rule in CDR, what does the 'action' define?

   • AThe data sources that the rule will analyze
   • BThe conditions that must be met for the rule to trigger
   • CThe rule type to use
   • DWhat happens when the rule conditions are met
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary characteristic of an analytic rule in CDR?

   • AIt detects threats based on behavioral patterns rather than static indicators
   • BIt aggregates multiple events to detect a coordinated attack
   • CIt matches events against a list of known malicious IP addresses
   • DIt uses statistical or machine learning models to identify anomalies
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security operations team wants to automatically isolate a compromised virtual machine as soon as a detection rule fires, without requiring manual intervention. What should they configure to achieve this?

   • AA higher severity level on the detection rule
   • BAn automation playbook linked to the detection rule
   • CA correlation rule that aggregates multiple alerts
   • DAn analytic rule with a machine learning model
   Reveal Solution Discussion Select an answer first