Font size
WorksheetsIdentifying Suspicious Network Activity
Total questions: 30
Worksheet time: 15mins
You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?
Detect on events where network.ApplicationProtocol is HTTP.
Detect on events where target.port is 5555.
Detect on events where principal.port is 5555.
Detect on events where network.ip_protocol is TCP.
You are an incident responder at your organization using Google Security Operations (SecOps) for monitoring and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?
Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.
Deploy emergency patches and reboot the server to remove malicious persistence.
Use the EDR integration to quarantine the compromised asset.
Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
Your organization uses Google Security Operations (SecOps). You discover frequent file downloads from a shared workspace within a short time window. You need to configure a rule in Google SecOps that identifies these suspicious events and assigns higher risk scores to repeated anomalies. What should you do?
Configure a rule that flags file download events with the highest risk score, regardless of time frame.
Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.
Configure a single-event YARA-L detection rule that assigns a risk outcome score and is triggered when a user downloads a large number of files in 24 hours.
Enable default curated detections and use automatic alerting for single file download events.
You are implementing Google Security Operations (SecOps) at your organization. You discover that the current detection rules are too noisy. Due to the high volume of alerts, some true positives might be missed. You want to ingest additional context sources to reduce false positives in your security detections and to improve the overall positive ratio of the alerts. What should you do?
Ingest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules.
Ingest dark web forum handlers from your threat intelligence system to match dark web principals within the detection rules.
Ingest IOCs from your threat intelligence system to validate the IP addresses, domains and hashes with the detection rules.
Ingest tactics, techniques, and procedures (TTPs) from your threat intelligence system to validate the processes and tools with the detection rules.
You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes. What should you do?
Develop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.
Use Gemini in Google SecOps to develop the rule by providing a description of the parameters and conditions, and transfer the rule into the Rules Editor.
Develop the rule in the Rules Editor, define the sections the rule logic, and test the rule using the test rule feature.
Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by setting it to live but not alerting. Run a YARA-L retrohunt from the rules dashboard.
Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company A's security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts do not have access to any case data originating from outside of Company A and are able to re-purpose playbooks previously developed by your organization's employees. You need to minimize effort to implement your solution. What is the first step you should take?
Acquire a second Google SecOps SOAR tenant for Company A.
Provision a new service account for Company A.
Define a new SOC role for Company A.
Create a Google SecOps SOAR environment for Company A.
You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group. What should you do?
Search for the threat group in Google Threat Intelligence.
Upload the malware to Google Threat Intelligence by using VirusTotal.
Upload the malware to Google Threat Intelligence by using Private Scanning.
Calculate the file checksum for the malware, and search for the checksum in Google Threat Intelligence by using VirusTotal.
Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer. You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?
Create a Google Group and add the required users. Grant the roles/chronicle.viewer IAM role to the group on the project associated with your Google SecOps Instance.
Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
Create a workforce identity pool at the organization level. Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours. What should you do?
Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence. Run the rule in a retrohunt against the full tenant.
Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)
Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
Review the finding, investigate the pod and related resources, and research the related attack and response methods.
Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
You are reviewing the security analyst team's playbook action process. Currently, security analysts navigate to the Playbooks tab in Google Security Operations (SecOps) for each alert and manually run steps assigned to a user. You need to present all actions from alerts awaiting user input in one location for the analyst to execute. What should you do?
Enable approval links in the manual action and display them as clickable links to the user in a HTML widget in the Default Case View tab.
Add a general insight in your playbook to display manual action details to the user.
Use the Pending Actions widget in the Default Case View in settings.
Create an Alert View with the playbook that incorporates the Pending Actions widget.
You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?
Modify the default parser and include a default time zone.
Create a parser extension to correct the time zone.
Create a custom parser to correct the time zone.
Modify the UI settings to correct the time zone.
Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?
Use the UDM lookup feature to identify relevant process-related UDM fields and values.
Run a UDM search, and review aggregations for relevant process-related UDM fields.
Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?
Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?
Generate a YARA-L rule in Google SecOps that detects when a service account key is created. Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.
Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.
Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName: "google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?
Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic. Configure a trigger to send an email alert when new events are sent to this feed.
Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.
Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag. What should you do?
Ask Cloud Customer Care to add a custom filter to the dashboard.
Add a custom filter to the dashboard.
Copy an existing dashboard and add a custom filter.
Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps.
A business unit in your organization plans to use Vertex AI to develop models within Google Cloud. The security team needs to implement detective and preventative guardrails to ensure that the environment meets internal security control requirements. How should you secure this environment?
Implement Assured Workloads by creating a folder for the business unit and assigning the relevant control package.
Implement preconfigured and custom organization policies to meet the control requirements. Apply these policies to the business unit folder.
Create a policy bundle representing the control requirements using Rego. Implement these policies using Workload Manager. Scope this scan to the business unit folder.
Create a posture consisting of predefined and custom organization policies and predefined and Security Health Analytics (SHA) custom modules. Scope this posture to the business unit folder.
You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?
Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.
Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.
Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.
A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts due to a legitimate backup automation tool using the same API as suspicious activity. How should you modify the rule to improve its accuracy while still detecting potentially malicious usage?
Add principal.user.email != "backup-bot@foobaa.com" to the rule condition to exclude the automation account.
Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
Adjust the rule severity to LOW to deprioritize alerts from automation tools.
Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts by detecting when a user account downloads an unusually large volume of data compared to the user's established baseline activity. You want to detect this anomalous data access behavior using the least amount of effort. What should you do?
Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.
Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.
Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.
Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.
Your organization uses Security Command Center (SCC) and relies on Compute Engine instances to run business-critical workloads. SCC has flagged a particular instance for exhibiting a high volume of outbound network connections to geographically diverse and unknown IP addresses. You need to determine whether the instance has been compromised by malware. What should you do?
Examine the IAM roles assigned to the service account that are associated with the instance. Revoke any permissions that could have facilitated malware installation.
Review the Google Cloud Service Health dashboard to identify any ongoing Google Cloud platform incidents that could be causing unusual network traffic from the instance.
Disable and re-enable the instances' network interface and determine whether the unusual network behavior is resolved.
Analyze Event Threat Detection findings. Review the events and the outbound network connections associated with the instance.
Your company wants to enhance its detection capabilities to prevent insider threat incidents. You need to be alerted when a privileged Google Group is modified to allow access to the general public. You need to identify and enable the optimal log source, and configure the alert. What should you do?
Enable Google Drive log events. Create a reporting rule that triggers when a file sharing event occurs with the visibility set to anyone with the link.
Enable VPC Flow Logs for the default VPC network. Configure a log-based alert in Cloud Logging to detect anomalous traffic patterns associated with Google Groups API endpoints.
Enable IAM Admin Activity audit logs, and export the logs to Google Security Operations (SecOps). Write a YARA-L rule in Google SecOps to capture any changes to relevant IAM policies.
Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.
You are using Google Security Operations (SecOps) to investigate suspicious activity linked to a specific user. You want to identify all assets the user has interacted with over the past seven days to assess potential impact. Your need is to understand the user's relationships to endpoints, service accounts, and cloud resources. How should you identify user-to-asset relationships in Google SecOps?
Use the Raw Log Scan view to group events by asset ID.
Query for hostnames in UDM Search and filter the results by user.
Generate an ingestion report to identify sources where the user appeared in the last seven days.
Run a retrohunt to find rule matches triggered by the user.
Your organization recently acquired a Google Security Operations (SecOps) Enterprise Plus license. Your organization is already ingesting Cloud Audit Logs, firewall logs, proxy logs, and endpoint logs, but there are no threat intelligence feeds being ingested into your Google SecOps environment. You need to design and deploy a solution that alerts your team quickly if an IOC of an active breach is observed in your environment. What should you do?
Write, enable, and configure alerting on a custom multi-event rule.
Write, enable, and configure alerting on a custom single-event rule.
Enable and configure alerting for relevant curated detection rule sets.
Create and schedule a dashboard to send periodic summaries of the active breach IOCs and their associated events.
Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?
Pull the firewall logs by using a Google SecOps feed integration.
Set the Google SecOps URL instance as the Syslog destination.
Deploy a third-party agent (e.g., Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
You are a platform engineer at an organization migrating from a third-party SIEM product to Google Security Operations (SecOps). Previously, you manually exported context data from Active Directory (AD) and imported it into your previous SIEM as a watchlist when there were changes in AD's user/asset context data. You want to improve this process using Google SecOps. What should you do?
Configure a Google SecOps SOAR integration for AD to enrich user/asset information in your security alerts.
Create a reference list that contains the AD context data. Use the reference list in your YARA-L rule to find user/asset information for each security event.
Create a data table that contains AD context data. Use the data table in your YARA-L rule to find user/asset data that can be correlated within each security event.
Ingest AD organizational context data as user/asset context to enrich user/asset information in your security events.
You manage a large fleet of Compute Engine instances. Security Health Analytics (SHA) has generated a CONFIDENTIAL_COMPUTING_DISABLED finding within Security Command Center (SCC). You need to quickly remediate this finding. What should you do?
Delete the offending VM instance, and mute the finding.
Delete the offending VM instance, and disable the SHA detector.
Delete the offending VM instance, and manually mark the finding as inactive.
Delete the offending VM instance, and allow the finding to be automatically marked as inactive.
Your company's SOC recently responded to a ransomware incident that began with the execution of a malicious document. EDR tools contained the initial infection, but multiple privileged service accounts continued to exhibit anomalous behavior. You need to design an automated playbook in Google Security Operations (SecOps) SOAR to minimize dwell time and accelerate containment for future similar attacks. Which action should you take in your Google SecOps SOAR playbook to support containment and escalation?
Configure a step that revokes OAuth tokens and suspends sessions for high-privilege accounts based on entity risk.
Add an approval step that requires an analyst to validate the alert before executing a containment action.
Create an external API call to VirusTotal to submit hashes from forensic artifacts.
Add a YARA-L rule that sends an alert when a document is executed using a scripting engine such as wscript.exe.
Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?
Customize the Close Case dialog and add the five DLP event types as root cause options.
Customize the Case Name format to include the DLP event type.
Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
