Which of the following best describes the primary function of Cloud Detection and Response (CDR) in cybersecurity?

Cloud Detection and Response (CDR) is an emerging capability that focuses specifically on detecting

and responding to threats in cloud environments. While not deeply detailed in the core CSA Security

Guidance v4.0, CDR is an evolution of traditional SIEM and endpoint detection strategies applied to

cloud-native infrastructures.

In CSA Security Guidance v4.0 – Domain 9: Incident Response, it’s made clear that:

“Security monitoring and detection capabilities in the cloud must be able to identify suspicious

behavior, policy violations, and misconfigurations — often across multiple layers such as

infrastructure, applications, and identity.”

— CSA Security Guidance v4.0, Domain 9: Incident Response

CDR platforms typically include:

Threat detection across cloud workloads (e.g., compute, storage, IAM misuse)

Real-time alerts

Automated or manual response mechanisms

Integration with cloud-native logging services like AWS CloudTrail, Azure Monitor, or GCP Audit Logs

Incorrect options:

B is about application management, not threat detection.

C relates to cloud cost optimization tools.

D refers to cloud storage tuning, unrelated to threat detection.

Reference:

CSA Security Guidance v4.0 – Domain 9: Incident Response

Industry context: CDR builds upon the principles of SIEM/EDR adapted for cloud