Pearson CCSK New Attempt

Cloud Detection and Response (CDR) is an emerging capability that focuses specifically on detecting and responding to threats in cloud environments. While not deeply detailed in the core CSA Security Guidance v4.0, CDR is an evolution of traditional SIEM and endpoint detection strategies applied to cloud-native infrastructures.

In CSA Security Guidance v4.0 – Domain 9: Incident Response, it’s made clear that:

“Security monitoring and detection capabilities in the cloud must be able to identify suspicious behavior, policy violations, and misconfigurations — often across multiple layers such as infrastructure, applications, and identity.”

— CSA Security Guidance v4.0, Domain 9: Incident Response

CDR platforms typically include:

Threat detection across cloud workloads (e.g., compute, storage, IAM misuse)

Real-time alerts

Automated or manual response mechanisms

Integration with cloud-native logging services like AWS CloudTrail, Azure Monitor, or GCP Audit Logs

Incorrect options:

B is about application management, not threat detection.

C relates to cloud cost optimization tools.

D refers to cloud storage tuning, unrelated to threat detection.

Endpoint Detection and Response (EDR)is acritical security tool for cloud environmentsthatmonitors, detects, and responds to endpoint threats.

Why EDR is Essential for Cloud Security?

Real-Time Threat Detection & Response

EDRcontinuously monitors endpoint activity(e.g., cloud VMs, servers, containers).

Detectsanomalous behavior, malware, and unauthorized access attempts.

Automated Remediation & Forensics

UsesMachine Learning (ML) & AItoanalyze cloud endpoint telemetry.

Supportsautomated response actions (isolating infected endpoints, rolling back malicious changes).

Cloud-Native Security Integration

Works withCloud Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR).

Enables proactive threat hunting in hybrid and multi-cloud environments.

Complements Other Cloud Security Tools

WAF (Web Application Firewall)protects againstweb-based attacks (OWASP Top 10)but doesnot provide endpoint security.

UTM (Unified Threat Management)is more suited fortraditional perimeter security (firewalls, IPS/IDS).

IDS (Intrusion Detection System)only detects threats, whereasEDR actively responds to them.

This aligns with:

CCSK v5 - Security Guidance v4.0, Domain 7 (Infrastructure Security)

Cloud Controls Matrix (CCM) - Endpoint Security Controls​.

Multiple independent deployments help isolate workloads, reducing the potential impact of a breach by confining it to a single deployment environment. Reference: [Security Guidance v5, Domain 7 - Infrastructure & Networking]