Font size
WorksheetsContent Section
Total questions: 76
Worksheet time: 38mins
You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?
Detect on events where network.ApplicationProtocol is HTTP.
Detect on events where target.port is 5555.
Detect on events where principal.port is 5555.
Detect on events where network.ip_protocol is TCP.
You are an incident responder at your organization using Google Security Operations (SecOps) for monitoring and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?
Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.
Deploy emergency patches, and reboot the server to remove malicious persistence.
Use the EDR integration to quarantine the compromised asset.
Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
Your organization uses Google Security Operations (SecOps). You discover frequent file downloads from a shared workspace within a short time window. You need to configure a rule in Google SecOps that identifies these suspicious events and assigns higher risk scores to repeated anomalies. What should you do?
Configure a rule that flags file download events with the highest risk score, regardless of time frame.
Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.
Configure a single-event YARA-L detection rule that assigns a risk outcome score and is triggered when a user downloads a large number of files in 24 hours.
Enable default curated detections, and use automatic alerting for single file download events.
You are implementing Google Security Operations (SecOps) at your organization. You discover that the current detection rules are too noisy. Due to the high volume of alerts, some true positives might be missed. You want to ingest additional context sources to reduce false positives in your security detections and to improve the overall positive ratio of the alerts. What should you do?
Ingest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules.
Ingest dark web forum handlers from your threat intelligence system to match dark web principals within the detection rules.
Ingest IOCs from your threat intelligence system to validate the IP addresses, domains and hashes with the detection rules.
Ingest tactics, techniques, and procedures (TTPs) from your threat intelligence system to validate the processes and tools with the detection rules.
You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes. What should you do?
Develop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.
Use Gemini in Google SecOps to develop the rule by providing a description of the parameters and conditions, and transfer the rule into the Rules Editor.
Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule using the test rule feature.
Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by setting it to live but not alerting. Run a YARA-L rethunt from the rules dashboard.
Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company A's security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts do not have access to any case data originating from outside of Company A and are able to re‑purpose playbooks previously developed by your organization's employees. You need to minimize effort to implement your solution. What is the first step you should take?
Acquire a second Google SecOps SOAR tenant for Company A.
Provision a new service account for Company A.
Define a new SOC role for Company A.
Create a Google SecOps SOAR environment for Company A.
You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group. What should you do?
Search for the threat group in Google Threat Intelligence.
Upload the malware to Google Threat Intelligence by using VirusTotal.
Upload the malware to Google Threat Intelligence by using Private Scanning.
Calculate the file checksum for the malware, and search for the checksum in Google Threat Intelligence by using VirusTotal.
Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer. You need to grant a group of users access to the Google SecOps instance with read‑only access to all resources, including detection engine rules. How should this be configured?
Create a Google Group and add the required users. Grant the roles/chronicle.Viewer IAM role to the group on the project associated with your Google SecOps instance.
Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
Create a workforce identity pool at the organization level. Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours. What should you do?
Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence. Run the rule in a rethunt against the full tenant.
Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
Write a YARA‑L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)
Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
Review the finding, investigate the pod and related resources, and research the related attack and response methods.
Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
You are reviewing the security analyst team's playbook action process. Currently, security analysts navigate to the Playbooks tab in Google Security Operations (SecOps) for each alert and manually run steps assigned to a user. You need to present all actions from alerts awaiting user input in one location for the analyst to execute. What should you do?
Enable approval links in the manual action and display them as clickable links to the user in a HTML widget in the Default Case View tab.
Add a general insight in your playbook to display manual action details to the user.
Use the Pending Actions widget in the Default Case View in settings.
Create an Alert View with the playbook that incorporates the Pending Actions widget.
You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six‑hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?
Modify the default parser and include a default time zone.
Create a parser extension to correct the time zone.
Create a custom parser to correct the time zone.
Modify the UI settings to correct the time zone.
Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?
Use the UDM lookup feature to identify relevant process‑related UDM fields and values.
Run a UDM search, and review aggregations for relevant process‑related UDM fields.
Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?
Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?
Generate a YARA-L rule in Google SecOps that detects when a service account key is created. Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.
Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.
Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName: "google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?
Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic. Configure a trigger to send an email alert when new events are sent to this feed.
Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.
Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag. What should you do?
Ask Cloud Customer Care to add a custom filter to the dashboard.
Add a custom filter to the dashboard.
Copy an existing dashboard and add a custom filter.
Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps.
A business unit in your organization plans to use Vertex AI to develop models within Google Cloud. The security team needs to implement detective and preventative guardrails to ensure that the environment meets internal security control requirements. How should you secure this environment?
Implement Assured Workloads by creating a folder for the business unit and assigning the relevant control package.
Implement preconfigured and custom organization policies to meet the control requirements. Apply these policies to the business unit folder.
Create a policy bundle representing the control requirements using Rego. Implement these policies using Workload Manager. Scope this scan to the business unit folder.
Create a posture consisting of predefined and custom organization policies and predefined and Security Health Analytics (SHA) custom modules. Scope this posture to the business unit folder.
You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?
Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.
Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.
Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.
A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts. The rule was designed to detect suspicious Cloud Storage enumeration by triggering an alert whenever the storage.objects.list API operation is called using the api.operation UDM field. However, a legitimate backup automation tool that uses the same API, causing the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while still detecting potentially malicious usage. How should you modify the rule to improve its accuracy?
Add principal.user.email != "backup-bot@foobaa.com" to the rule condition to exclude the automation account.
Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
Adjust the rule severity to LOW to deprioritize alerts from automation tools.
Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts. Specifically, you need to detect when a user account downloads an unusually large volume of data compared to the user's established baseline activity. You want to detect this anomalous data access behavior using the least amount of effort. What should you do?
Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.
Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.
Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.
Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.
Your organization uses Security Command Center (SCC) and relies on Compute Engine instances to run business-critical workloads. SCC has flagged a particular instance for exhibiting a high volume of outbound network connections to geographically diverse and unknown IP addresses. You need to determine whether the instance has been compromised by malware. What should you do?
Examine the IAM roles assigned to the service account that are associated with the instance. Revoke any permissions that could have facilitated malware installation.
Review the Google Cloud Service Health dashboard to identify any ongoing Google Cloud platform incidents that could be causing unusual network traffic from the instance.
Disable and re-enable the instances' network interface and determine whether the unusual network behavior is resolved.
Analyze Event Threat Detection findings. Review the events and the outbound network connections associated with the instance.
Your company wants to enhance its detection capabilities to prevent insider threat incidents. You need to be alerted when a privileged Google Group is modified to allow access to the general public. You need to identify and enable the optimal log source, and configure the alert. What should you do?
Enable Google Drive log events. Create a reporting rule that triggers when a file sharing event occurs with the visibility set to anyone with the link.
Enable VPC Flow Logs for the default VPC network. Configure a log-based alert in Cloud Logging to detect anomalous traffic patterns associated with Google Groups API endpoints.
Enable IAM Admin Activity audit logs, and export the logs to Google Security Operations (SecOps). Write a YARA-L rule in Google SecOps to capture any changes to relevant IAM policies.
Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.
You are using Google Security Operations (SecOps) to investigate suspicious activity linked to a specific user. You want to identify all assets the user has interacted with over the past seven days to assess potential impact. Your need to understand the user's relationships to endpoints, service accounts, and cloud resources. How should you identify user-to-asset relationships in Google SecOps?
Use the Raw Log Scan view to group events by asset ID.
Query for hostnames in UDM Search and filter the results by user.
Generate an ingestion report to identify sources where the user appeared in the last seven days.
Run a rethount to find rule matches triggered by the user.
Your organization recently acquired a Google Security Operations (SecOps) Enterprise Plus license. Your organization is already ingesting Cloud Audit Logs, firewall logs, proxy logs and endpoint logs, but there are no threat intelligence feeds being ingested into your Google SecOps environment. You need to design and deploy a solution that alerts your team quickly if an IOC of an active breach is observed in your environment. What should you do?
Write, enable, and configure alerting on a custom multi-event rule.
Write, enable, and configure alerting on a custom single-event rule.
Enable and configure alerting for relevant curated detection rule sets.
Create and schedule a dashboard to send periodic summaries of the active breach IOCs and their associated events.
Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?
Pull the firewall logs by using a Google SecOps feed integration.
Set the Google SecOps URL instance as the Syslog destination.
Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google Security Operations (SecOps). You previously manually exported context data from Active Directory (AD) and imported the data into your previous SIEM as a watchlist when there were changes in AD's user/asset context data. You want to improve this process using Google SecOps. What should you do?
Configure a Google SecOps SOAR integration for AD to enrich user/asset information in your security alerts.
Create a reference list that contains the AD context data. Use the reference list in your YARA-L rule to find user/asset information for each security event.
Create a data table that contains AD context data. Use the data table in your YARA-L rule to find user/asset data that can be correlated within each security event.
Ingest AD organizational context data as user/asset context to enrich user/asset information in your security events.
You manage a large fleet of Compute Engine instances. Security Health Analytics (SHA) has generated a CONFIDENTIAL_COMPUTING_DISABLED finding within Security Command Center (SCC). You need to quickly remediate this finding. What should you do?
Delete the offending VM instance, and mute the finding.
Delete the offending VM instance, and disable the SHA detector.
Delete the offending VM instance, and manually mark the finding as inactive.
Delete the offending VM instance, and allow the finding to be automatically marked as inactive.
Your company's SOC recently responded to a ransomware incident that began with the execution of a malicious document. EDR tools contained the initial infection. However, multiple privileged service accounts continued to exhibit anomalous behavior, including credential dumping and scheduled task creation. You need to design an automated playbook in Google Security Operations (SecOps) SOAR to minimize dwell time and accelerate containment for future similar attacks. Which action should you take in your Google SecOps SOAR playbook to support containment and escalation?
Configure a step that revokes OAuth tokens and suspends sessions for high-privilege accounts based on entity risk.
Add an approval step that requires an analyst to validate the alert before executing a containment action.
Create an external API call to VirusTotal to submit hashes from forensic artifacts.
Add a YARA-L rule that sends an alert when a document is executed using a scripting engine such as wscript.exe.
Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?
Customize the Close Case dialog and add the five DLP event types as root cause options.
Customize the Case Name format to include the DLP event type.
Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps. What should you do?
Initiate a SIEM Search to query the entity.
Initiate a SOAR Search to query the entity.
Select View Details for the entity in the Entity Highlights widget.
Select the entity identifier in the Entity Highlights widget to open Entity Explorer.
During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?
Use Policy Analyzer to identify the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
You are a security analyst at an organization that uses Google Security Operations (SecOps). You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?
Enable default curated detections to automatically block suspicious IP addresses.
Use UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.
Remove user accounts that have repeated invalid login attempts.
Look for correlations across impacted users in the Risk Analytics dashboard.
Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?
Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
Add an exception in the detection rule to exclude matches originating from specific asset groups.
You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?
Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.
Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).
Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.
Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).
You work for a large international company that has several Compute Engine instances running in production. You need to configure monitoring and alerting for Compute Engine instances tagged with compliance=pci that have an external IP address assigned. What should you do?
Create a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance=pci tag is assigned an external IP address.
Deploy the compute.vmExternalIpAccess organization policy constraint to prevent specific projects or folders with the compliance=pci tag from creating Compute Engine instances with external IP addresses.
Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance=pci tag.
Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance=pci tag exists on the instances.
Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead. What should you do?
Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.
Create a Cron Scheduled Connector for this use case. Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.
Use a VM to host a script that runs a playbook via an API call.
You have discovered that a server that hosts an internal web application has been accidentally exposed to the internet for 48 hours. Logging is enabled on the server. You want to use Google Security Operations (SecOps) to run a UDM search against the server logs to identify whether there have been any successful exploitations against it. What event field search should you use?
Perform a search for antimalware or endpoint security events by using the product_event_type UDM field.
Perform a search for sign-on activity for user accounts that are not expected on the server by using the principal.user.userid UDM field.
Perform a search for network traffic where the principal is rarely seen by using the principal.ip UDM field.
Perform a search for process launches and commands that are rarely seen by using the metadata.event_type UDM field.
You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship with other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?
Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.
Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.
Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.
You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?
Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable.
Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.
You are a SOC manager, and your company recently migrated to Google Security Operations (SecOps). As the team grows, you want to monitor all audit logs related to data feeds in Google SecOps. What should you do?
Enable Data Access and Admin Activity audit logs in Cloud Logging, and ingest those logs into Google SecOps SIEM.
Ingest the Google SecOps audit logs into Google SecOps SIEM for monitoring.
Monitor Google SecOps SOAR user activity logs for administrative activity.
Configure the Cloud Logging filter to ingest audit logs related to data feeds into Google SecOps for monitoring.
Your company is taking a more proactive approach to security. You want to generate an alert when a binary hash first appears in your environment. What should you do?
Enable the Applied Threat Intelligence - Curated Prioritization rule set in curated detections.
Navigate to the Alerts & IOCs page in Google Security Operations (SecOps). Create a filter that targets hashes and specifies a first_seen_time value excluding the current date.
Write a rule to examine file-related events that join with derived context for hashes in the entity graph. Compare the timestamp of the hash with the first_seen_time field.
Create a table by using the Google Security Operations (SecOps) statistics in search to examine file-related events for the current day. Verify that the first_seen_time value predates the current day.
You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?
Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.
Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.
Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.
Create a Google SecOps SOAR dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.
Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps: Firewall logs - Proxy logs - DNS logs - DHCP logs - What should you do? (Choose two.)
Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
Your company recently started pulling JSON logs from a third-party system into Google Security Operations (SecOps). You noticed that some fields are missing, and you want to parse them into UDM fields as quickly as possible. What should you do?
Configure auto extraction to add the additional fields.
Create parser extensions using the no-code approach.
Create parser extensions using the code snippet approach.
Submit a parser improvement request to Cloud Customer Care.
You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?
In Google SecOps SOAR settings, create a new environment for each customer.
In Google SecOps SOAR settings, create a role for each customer.
In Google SecOps SOAR settings, create a permissions group for each customer.
In Google SecOps Playbooks, create a playbook for each customer.
Your organization recently conducted a penetration test on their environment. You have been tasked with identifying a successful attack chain. The required log sources have been ingested into Google Security Operations (SecOps). You discover anomalous outbound traffic to external domains. You suspect that the finding is a communication to a command and control (C2) infrastructure. You need to identify the least common network communications over the last 14 days. What should you do?
Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for target domains over the last 14 days.
Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for principal domains over the last 14 days.
Perform a Google SecOps SOAR search that looks for cases with low rolling prevalence of NETWORK_CONNECTION or NETWORK_HTTP events over the last 14 days.
Perform a Google SecOps SIEM raw log search that looks for low rolling prevalence domains with NETWORK_CONNECTION or NETWORK_HTTP in the firewall and proxy logs over the last 14 days.
Your organization is conducting a penetration test. The CISO has asked you to implement a real-time method to track cases that originate from the penetration test, and clearly differentiate these cases from other security incidents. You need to recommend the most effective and efficient approach to achieve this goal in Google Security Operations (SecOps). What should you do?
Implement case tagging within Google SecOps and apply a unique tag (e.g., PenTest) to all cases related to the penetration test entities. Use this tag for filtering and monitoring.
Create a dashboard that is connected to the Google SecOps data lake. Use pre-built templates to visualize case status based on the penetration testing IP address range.
Create a custom Google SecOps SOAR playbook that automatically extracts case metadata, including key findings and risk scores, and sends an email summary to the CISO.
Configure a custom alert rule that triggers a high-severity alert for all activity originating from the penetration testing team's source IP addresses and sends a notification for potential critical vulnerabilities. Verify that these alerts are immediately visible in the alert queue.
You are tasked with building a workflow in Google Security Operations (SecOps) SOAR. The documentation you are using requires a logical split that has eight different possible paths. You need to break the workflow into eight separate workflows using an accurate and efficient approach. What should you do?
Create eight playbooks for each workflow. Configure the triggered playbook to end on an instruction action that tells the analyst to pick a workflow from the playbooks tab and attach that workflow to the alert.
Create eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to the alert.
Create a playbook that uses a flow condition. Add four more branches to have a total of five branches and an "Else" branch. On the "Else" branch, include another flow condition. Include the remaining three branches with the logic required.
Create a playbook that uses a Multi-Choice Question flow and a second Multi-Choice Question for the additional answer choices. Add instructions describing which logic to use in the instruction or question fields. Have the analyst select the appropriate answer to move the flow into the right branch.
You are a member of the incident response team working in a global enterprise. You need to identify all potential Google Threat Intelligence IOCs within your organization's data using Google Security Operations (SecOps). What should you do?
Use the Cases page in Google SecOps.
Create YARA-L rules to detect and alert when Google Threat Intelligence identifies potential threats.
Use Gemini to perform a search for potential cybersecurity threats against your organization's data.
Use the Alerts & IOCs page in Google SecOps.
You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Your organization recently faced a cybersecurity breach. You need to increase the threat analytics as quickly as possible. What should you do?
Enable curated detections to identify threats.
Design YARA-L detection rules based on Google SecOps Marketplace use cases.
Develop YARA-L detection rules that focus on threat intelligence.
Ingest data from a threat intelligence platform (TIP) into Google SecOps.
You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes: A SHA256 hash for a malicious DLL A known command and control (C2) domain A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?
Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following: Receive a notification when data sources go silent within 15 minutes. Visualize ingestion throughput and parsing errors. What should you do?
Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane. Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).
Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring. Create a Cloud Monitoring dashboard to visualize data ingestion metrics.
Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.
Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.
Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process and integrate with the existing SOC ticketing system. How should you implement this functionality?
Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.
Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.
Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system.
Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.
You are creating a playbook for the SOC. The SOC requires that each Google Security Operations (SecOps) role sees different information for the alert that the playbook runs on. You need to ensure that the playbook presents the relevant information for each Google SecOps role. What should you do?
Add a view to the playbook for each Google SecOps role.
Add the Case Comment action to the playbook for each Google SecOps role.
Add the Create Siemplify Task action to the playbook to assign a task to each Google SecOps role.
Add the Add General insight action to the playbook for each Google SecOps role.
You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool. You must recommend a tool to your leadership team as quickly as possible. What should you do? (Choose two.)
Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.
Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
Review the architecture of the tool to identify the cloud provider that hosts the tool.
Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.
Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps). You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR's features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?
Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.
Use the ROI - Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.
Use the filters and visualizations in the Management - SOC Status report in SOAR Reports to extract case-specific performance data.
Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.
Your company works with an external Managed Service Provider (MSP) that requires its users to have the ability to list findings from Security Command Center (SCC) using the Google Cloud SDK. You need to configure the required access for the managed service provider while minimizing your involvement in their external user lifecycle management processes. What should you do?
Create a user account in your Cloud Identity instance using a subdomain indicating they are external to your organization. Grant this user account the appropriate IAM role at the organization level.
Create a service account in a SCC project. Grant the MSP user permission to impersonate this account. Grant this service account the appropriate IAM role at the organization level.
Create a workload identity pool in a SCC project. Grant the MSP user the permission to impersonate a service account from this pool, and grant the service account the appropriate IAM role at the organization level.
Create a workforce identity pool and federate with the identity provider (IdP) of the managed service provider. Grant users of the MSP the appropriate IAM role at the organization level.
You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?
Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.
Perform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.
Perform a UDM search for login events, and pivot to group results by user and country of origin.
Run a YARA-L rethhunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
You are using a Google-managed image on a Compute Engine instance in Google Cloud to run an application. You need to ingest the application's log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time required to move this data into Google SecOps. What should you do?
Use the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging. Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.
Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.
Create a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.
Use the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.
You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise, Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI). You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time. What should you do?
Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.
Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.
Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.
Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.
You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?
Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
Create a case for each identified user with the user designated as the entity.
Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
You are a security engineer at a financial technology company. You need to create a centralized dashboard to provide security posture visibility for your leadership team. The dashboard must meet these requirements: Provide insights from Security Command Center (SCC) findings and security-related events captured in Cloud Logging. Support large volumes of historical data. Be able to join SCC findings and audit logs. You want to use the most effective visualization solution that uses Google Cloud managed services. What should you do?
Ingest the SCC findings and Cloud Audit Logs into a Cloud Storage bucket. Write a Python script that reads the data and uses Matplotlib to create the visualizations.
Create custom metrics in Cloud Monitoring based on the SCC findings, and configure log-based metrics for security-related events. Build Cloud Monitoring dashboards to visualize these custom and log-based metrics.
Export SCC findings and Cloud Audit Logs to BigQuery. Connect Looker Studio to the BigQuery datasets, and create the visualizations and filters.
Use the built-in SCC dashboard to visualize the SCC finding, and extract log counts for specific log events from Cloud Audit Logs.
Your organization has mission-critical production Compute Engine VMs that you monitor daily. While performing a UDM search in Google Security Operations (SecOps), you discover several outbound network connections from one of the production VMs to an unfamiliar external IP address occurring over the last 48 hours. You need to use Google SecOps to quickly gather more context and assess the reputation of the external IP address. What should you do?
Examine the Google SecOps Asset view details for the production VM.
Create a new detection rule to alert on future traffic from the external IP address.
Search for the external IP address in the Alerts & IOCs page in Google SecOps.
Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.
You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?
net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?
Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
Use a custom parser that outputs all fields as raw JSON for detection.
Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?
Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?
Configure each network in the Google SecOps SOAR settings.
Enrich the IP address entities as the initial step of the playbook.
Modify the entity attribute in the alert overview.
Create an outcome variable in the rule to assign the network name.
You have identified a common malware variant on a potentially infected computer. You need to find reliable IOCs and malware behaviors as quickly as possible to confirm whether the computer is infected and search for signs of infection on other computers. What should you do?
Create a Compute Engine VM, and perform dynamic and static malware analysis.
Perform a UDM search for the file checksum in Google Security Operations (SecOps). Review activities that are associated with, or attributed to the malware.
Run a Google Web Search for the malware hash, and review the results.
Search for the malware hash in Google Threat Intelligence, and review the results.
Your Google Security Operations (SecOps) SOAR integration with Security Command Center (SCC) uses a service account that currently has read access to the findings at the organization level. Google SecOps SOAR successfully reads SCC finding data, but actions attempting to update the finding states consistently fail with a permission denied error. You need to resolve this error while following the principle of least privilege. What should you do?
Grant the service account the roles/securitycenter.findingsBulkMuteEditor IAM role at the organization level.
Grant the service account the roles/securitycenter.findingsEditor IAM role at the organization level.
Grant the service account the roles/iam.serviceAccountUser IAM role to itself.
Regenerate the service account key, and update the credentials in Google SecOps SOAR.
You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCs and would like to include external signals for this capability to ensure broad detection coverage. What should you do?
Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
Create a Security Health Analytics (SHA) custom module using the compute address resource.
Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting data. You need to minimize the cost of these configurations. What should you do?
Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.
Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.
Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?
Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
Revoke additional role access from Tier 1 and Tier 2 analysts.
Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
Assign the cases to a user in the Tier 3 role.
You are the lead engineer on your organization's incident response team. You are running CrowdStrike Falcon and SentinelOne to protect the Windows devices in different regions of your organization. You are ingesting the following logs into Google Security Operations (SecOps): Azure AD Directory Audit (AZURE_AD_AUDIT) Crowdstrike Falcon (CS_EDR) Microsoft Sysmon (WINDOWS_SYSMON) SentinelOne (SENTINEL_EDR) Windows Event (WINEVTLOG) You notice that a high volume of ransomware incidents are impacting your team's SLAs. You need to automate the response to ransomware on Windows devices. How should you automate the detection and containment of ransomware incidents? (Choose two.)
Enable the Windows Threats category in curated detections to detect the latest Windows threats.
Enable the Risk Analytics for User and Endpoint Behavioral Analytics (UEBA) category in curated detections to detect peer group-based anomalous behavior and suspicious actions.
Install SOAR EDR integrations for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
Install SOAR EDR jobs to execute remote endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
Install a SOAR remote agent on each Windows device for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
You need to ingest audit logs from your organization's entire Google Cloud environment into Google Security Operations (SecOps). This process must include Cloud NAT logs for workloads within a designated folder. You need to configure this ingestion while minimizing integration complexity. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next?
Create a custom filter to export the folder-level Cloud NAT logs.
Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder.
Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps.
Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps.
You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?
Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.
Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.
Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
