Font size
WorksheetsExam Part 2
Total questions: 73
Worksheet time: 37mins
You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?
Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
Create a case for each identified user with the user designated as the entity.
Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
You are a security engineer at a financial technology company. You need to create a centralized dashboard to provide security posture visibility for your leadership team. The dashboard must meet these requirements: Provide insights from Security Command Center (SCC) findings and security-related events captured in Cloud Logging; support large volumes of historical data; and be able to join SCC findings and audit logs. You want to use the most effective visualization solution that uses Google Cloud managed services. What should you do?
Ingest the SCC findings and Cloud Audit Logs into a Cloud Storage bucket. Write a Python script that reads the data and uses Matplotlib to create the visualizations.
Create custom metrics in Cloud Monitoring based on the SCC findings, and configure log-based metrics for security-related events. Build Cloud Monitoring dashboards to visualize these custom and log-based metrics.
Export SCC findings and Cloud Audit Logs to BigQuery. Connect Looker Studio to the BigQuery datasets, and create the visualizations and filters.
Use the built-in SCC dashboard to visualize the SCC finding, and extract log counts for specific log events from Cloud Audit Logs.
Your organization has mission-critical production Compute Engine VMs that you monitor daily. While performing a UDM search in Google Security Operations (SecOps), you discover several outbound network connections from one of the production VMs to an unfamiliar external IP address occurring over the last 48 hours. You need to use Google SecOps to quickly gather more context and assess the reputation of the external IP address. What should you do?
Examine the Google SecOps Asset view details for the production VM.
Create a new detection rule to alert on future traffic from the external IP address.
Search for the external IP address in the Alerts & IOCs page in Google SecOps.
Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.
You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?
net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?
Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
Use a custom parser that outputs all fields as raw JSON for detection.
Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?
Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?
Configure each network in the Google SecOps SOAR settings.
Enrich the IP address entities as the initial step of the playbook.
Modify the entity attribute in the alert overview.
Create an outcome variable in the rule to assign the network name.
You have identified a common malware variant on a potentially infected computer. You need to find reliable IOCs and malware behaviors as quickly as possible to confirm whether the computer is infected and search for signs of infection on other computers. What should you do?
Create a Compute Engine VM, and perform dynamic and static malware analysis.
Perform a UDM search for the file checksum in Google Security Operations (SecOps). Review activities that are associated with, or attributed to the malware.
Run a Google Web Search for the malware hash, and review the results.
Search for the malware hash in Google Threat Intelligence, and review the results.
Your Google Security Operations (SecOps) SOAR integration with Security Command Center (SCC) uses a service account that currently has read access to the findings at the organization level. Google SecOps SOAR successfully reads SCC finding data, but actions attempting to update the finding states consistently fail with a permission denied error. You need to resolve this error while following the principle of least privilege. What should you do?
Grant the service account the roles/securitycenter.findingsBulkMuteEditor IAM role at the organization level.
Grant the service account the roles/securitycenter.findingsEditor IAM role at the organization level.
Grant the service account the roles/iam.serviceAccountUser IAM role to itself.
Regenerate the service account key, and update the credentials in Google SecOps SOAR.
You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCs and would like to include external signals for this capability to ensure broad detection coverage. What should you do?
Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
Create a Security Health Analytics (SHA) custom module using the compute address resource.
Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting data. You need to minimize the cost of these configurations. What should you do?
Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.
Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.
Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?
Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
Revoke additional role access from Tier 1 and Tier 2 analysts.
Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
Assign the cases to a user in the Tier 3 role.
You are the lead engineer on your organization's incident response team. You are running CrowdStrike Falcon and SentinelOne to protect the Windows devices in different regions of your organization. You are ingesting the following logs into Google Security Operations (SecOps): Azure AD Directory Audit (AZURE_AD_AUDIT), Crowdstrike Falcon (CS_EDR), Microsoft Sysmon (WINDOWS_SYSMON), SentinelOne (SENTINEL_EDR), Windows Event (WINEVTLOG). You notice that a high volume of ransomware incidents are impacting your team's SLAs. You need to automate the response to ransomware on Windows devices. How should you automate the detection and containment of ransomware incidents? (Choose two.)
Enable the Windows Threats category in curated detections to detect the latest Windows threats.
Enable the Risk Analytics for User and Endpoint Behavioral Analytics (UEBA) category in curated detections to detect peer group-based anomalous behavior and suspicious actions.
Install SOAR EDR integrations for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
Install SOAR EDR jobs to execute remote endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
Install a SOAR remote agent on each Windows device for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
You need to ingest audit logs from your organization's entire Google Cloud environment into Google Security Operations (SecOps). This process must include Cloud NAT logs for workloads within a designated folder. You need to configure this ingestion while minimizing integration complexity. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next?
Create a custom filter to export the folder-level Cloud NAT logs.
Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder.
Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps.
Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps.
You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?
Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.
Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.
Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
You received an IOC from your threat intelligence feed that is identified as a suspicious domain used for command and control (C2). You want to use Google Security Operations (SecOps) to investigate whether this domain appeared in your environment. You want to search for this IOC using the most efficient approach. What should you do?
Run a raw log search to search for the domain string.
Configure a UDM search that queries the DNS section of the network noun.
Enable Group by Field in scan view to cluster events by hostname.
Enter the IOC into the IOC Search feature, and wait for detections with this domain to appear in the Case view.
You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?
Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.
You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox. The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?
Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
Modify the detection rule in the SIEM to include the query results as part of the detection.
Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
Add an action to the playbook that runs the SIEM query and returns the results.
You work for a telecommunications company that wants to monitor their multi-region 5G network logs in Google Security Operations (SecOps). The logs are currently only available on-premises and are stored in a standalone network-attached storage (NAS) located in four different regions. You need to ingest the logs into Google SecOps and tag each NAS as a specific log source to avoid IP address aliasing. What should you do?
Configure feed management to pull data from each log's location, and configure a namespace for each log source.
Configure feed management to pull data from each log's location, and configure an ingestion label for each log source.
Configure a Bindplane agent that collects Syslog from each log's location, and configure a namespace for each log source.
Configure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source.
You are a security analyst at an organization that uses Google Security Operations (SecOps). Google SecOps triggered a medium severity alert of Unusual Cloud Storage Access - High Volume Download for user1@securecloudservices.com from the internal-project-code-repository bucket. This user is a senior developer within your organization who has legitimate access, but their download volume is unusually high and occurs outside working hours. You need to investigate this alert. What should you do first?
Run a Google SecOps SOAR playbook to suspend user1's bucket access, and review their user timeline.
Enrich the bucket entity with sensitivity labels and access control list (ACL) data.
Create a default detection rule in Google SecOps to monitor future high-volume downloads from the bucket, and add user1 to a high-risk watchlist.
Review user1's timeline in Google SecOps, focusing on network events and resource access immediately preceding the download anomaly.
Your company uses Google-managed images on Compute Engine VM instances extensively and has deployed Security Command Center Enterprise (SCCE) at the organization level. Due to a recent increase in vulnerability exploits, you want to improve visibility into operating system (OS) risks for all VMs in your organization. You want to use managed services to enhance security detection capabilities related to these vulnerabilities using minimal effort. What should you do?
Enable VM Manager across your projects, and allow VM Manager to write findings to SCCE.
Enable Virtual Machine Threat Detection in SCCE, and allow it to generate findings.
Set up Google Open Source Vulnerability (OSV)-Scanner to scan all Compute Engine VMs. Configure a Google Security Operations (SecOps) forwarder to write logs to your Google SecOps instance.
Create a custom Security Health Analytics (SHA) scanner to check the sourceImage of the compute disk. Check for matches in a vulnerability database.
Your Google Security Operations (SecOps) instance is generating alerts for unusual login times from multiple user accounts. Your SOC analysts are reporting a high number of the alerts are false positives involving service accounts used by scheduled automation tasks. You want to refine the detection logic using entity-level context available in Google SecOps. You want to use the most effective approach. What should you do?
Use asset tags to group known automation systems, and exclude them from the alert logic.
Modify the rule to include the principal.user.type != "service_account" condition.
Update the rule to only alert when the principal.user.email and principal.user.userid fields match in the same event.
Add a reference list of all service accounts, and suppress alerts for any matches on the principal.user.email field.
You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution, but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?
Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data.
Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious.
Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time.
Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.
You are helping a new Google Security Operations (SecOps) customer configure access for their SOC team. The Google SecOps administrators currently have access to the instance. The customer is reporting that new Google SecOps users are not getting authorized to access the instance, but they are able to authenticate to the third-party identity provider (IdP). How should you fix the issue? (Choose two.)
Link Google SecOps to a Google Cloud project with the Chronicle API.
Integrate Google SecOps with the third-party IdP using Workforce Identity Federation.
Grant the appropriate data access scope to the SOC team's IdP group in IAM.
Grant the roles/chronicle.viewer role to the SOC team's IdP group in IAM.
Grant the Basic permission to the appropriate IdP groups in the Google SecOps SOAR Advanced Settings.
You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC). You want to follow the Google-recommended approach. What should you do?
Create a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories for IAM policy changes. When a change is detected identify the principal that made the change.
Configure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a custom dashboard in SCC to visualize the data.
Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects when a specified principal calls a method against a resource.
Implement a Cloud Run function that is triggered by IAM policy changes within the project and sends an alert to SCC using the Security Command Center API.
Your Google Security Operations (SecOps) case queue contains a case with IP address entities. You need to determine whether the entities are internal or external assets and ensure that internal IP address entities are marked accordingly upon ingestion into Google SecOps SOAR. What should you do?
Indicate your organization's known internal CIDR ranges in the Environment Networks list in the Settings.
Modify the connector logic to perform a secondary lookup against your CMDB and flag incoming entities as internal or external.
Configure a feed to ingest enrichment data about the networks, and include these fields into your detection outcome.
Create a custom action to ping the IP address entity from your Remote Agent. If successful, the custom action designates the IP address entity as internal.
Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match. What should you do?
Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.
Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.
You observe several distinct, low-severity suspicious activities associated with a single internal server. You determine that no single event is a high-confidence IOC. You need to create a solution that ensures ongoing and heightened scrutiny for this server. What should you do?
Schedule a daily Google Security Operations (SecOps) report detailing all activity on this server.
Develop a YARA-L detection rule specific to this server.
Add the server to a Google Security Operations (SecOps) watchlist, and monitor the watchlist closely for the next few weeks.
Create a case, isolate the server from the network, and escalate the case for forensic investigation.
Your organization recently adopted Google Security Operations (SecOps), and has configured ingestion, parsing and rules for their log sources. The security operations team is currently triaging alerts one at a time using several external product dashboards with alerts and enrichment data. You want to use the case management functionality in Google SecOps to reduce the amount of pivoting between products your SOC analysts are required to do. You want to minimize development effort. What should you do first?
Build a playbook for each detection rule to enrich and remediate alerts relative to the particular threat each rule is designed to detect.
Build a playbook for each of the noisiest alert sources to gather additional context on the case from the source product.
Build a job to periodically iterate over recent cases, determine relevant context, and enrich alerts.
Build a low-priority, catch-all playbook for enrichment of entities in a case using threat intelligence sources.
You were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand the current performance by calculating the mean time to respond or remediate (MTTR) for your cases. What should you do?
Create a multi-event detection rule to calculate the response metrics in the outcome section based on the entity graph. Create a dashboard based on these metrics.
Create a dashboard table widget that displays the average case handling times by analyst, case priority, and environment.
Create a playbook block that can be re-used in all alert playbooks to write timestamps in the case wall after each change to the case. Write a job to calculate the case metrics.
Use the playbooks' case stages to capture metrics for each stage change. Create a dashboard based on these metrics.
You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota. Which log type should you ingest into Google SecOps?
VPC Flow Logs
Security Command Center Premium (SCCP) findings
Cloud IDS logs
Cloud Audit Logs
You are a SOC analyst working a case in Google Security Operations (SecOps). The case contains a file hash that your playbooks have automatically enriched with VirusTotal context and categorized as likely malicious. You need to quickly identify devices and users in your organization who have interacted with this file. What should you do?
Build a playbook to perform a UDM search matching on the file hash in Google SecOps SIEM.
Build a playbook to query your threat intelligence platform (TIP) for the presence of the file hash.
Use a manual action in Google SecOps SOAR to perform a UDM search matching on the file hash in Google SecOps SIEM.
Use a manual action in Google SecOps SOAR to query your threat intelligence platform (TIP) for the presence of the file hash.
You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?
Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.
Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
Configure the Windows server to send an email notification if there is an error in the Bindplane process.
You are implementing Google Security Operations (SecOps) for your organization. Your organization has their own threat intelligence feed that has been ingested to Google SecOps by using a native integration with a Malware Information Sharing Platform (MISP). You are working on the following detection rule to leverage the command and control (C2) indicators that were ingested into the entity graph. rule ioc_domain_c2 { meta: author = "Google Cloud Security" description = "Detect DNS events that indicate communication with C2" events: $dns.metadata.event_type = "NETWORK_DNS" dns.network.dns.questions.name= dns_query $ioc.graph.metadata.product_name = "MISP" << Add code >> $ioc.graph.metadata.threat.summary = "C2 domains" ioc.graph.entity.hostname= dns_query match: $dns_query over 5m condition: dnsand ioc } What code should you add in the detection rule to filter for the domain IOCs?
ioc.graph.metadata.entitytype= ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
ioc.graph.metadata.entitytype= ioc.graph.metadata.source_type = "GLOBAL_CONTEXT"
ioc.graph.metadata.entitytype= ioc.graph.metadata.source_type = "DERIVED_CONTEXT"
ioc.graph.metadata.entitytype= ioc.graph.metadata.source_type = "SOURCE_TYPE_UNSPECIFIED"
Your organization is a Google Security Operations (SecOps) customer. You use Google Threat Intelligence to identify cyber threats within your organization's threat profile. You believe your organization may have been targeted by a cyber crime group. You need to identify whether your organization has been the victim of an attack. What should you do?
Implement monitors in the Digital Threat Monitoring feature to identify new compromised credentials, dark web mentions, or data leaks.
In the Reports & Analysis feature, extract the IOCs from the recent reports, and implement detection rules and lists in Google SecOps to identify whether they are present in your organization's environment.
Review the Threat Landscape feature to identify threat groups that are active in your industry, research their known MITRE ATT&CK tactics, techniques, and procedures (TTPs) and implement detection rules in Google SecOps.
In the Vulnerability Intelligence feature, identify new high and critical vulnerabilities in products or technologies that your organization uses so they can be patched.
You are responsible for selecting and prioritizing potential sources of data to integrate with Google Security Operations (SecOps). Your company has recently started using several Google Cloud services to increase security in its Google Cloud organization. You need to determine which logs should be ingested into Google SecOps to reduce the effort required to write detections. What should you do?
Ingest Google Cloud Armor logs by using Cloud Logging.
Deploy a Bindplane agent to ingest event logs from Compute Engine VMs that provide endpoint visibility.
Integrate Security Command Center (SCC) into Google SecOps to ingest logs originating from the Google Cloud services.
Use Google Threat Intelligence to gain insight about threat group behavior and support threat hunting activities.
You are developing a security strategy for your organization. You are planning to use Google Security Operations (SecOps) and Google Threat Intelligence (GTI). You need to enhance the detection and response across multi-cloud and on-premises systems. How should you integrate these products? (Choose two.)
Ingest GTI IOCs into Google SecOps as security events.
Ingest on-premises and cloud security logs into Google SecOps SIEM as events.
Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.
Use Google SecOps SOAR integrations with GTI for event enrichment.
Use Google SecOps SOAR integrations with GTI for entity enrichment.
Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post-processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning. What should you do?
Generate a report in SOAR Reports, and schedule delivery of the report.
Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
You are reviewing the results of a UDM search in Google Security Operations (SecOps). The UDM fields shown in the default view are not relevant to your search. You want to be able to quickly view the relevant data for your analysis. What should you do?
Download the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.
Create a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.
Select the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.
Use the columns feature to select or remove columns that are relevant to your analysis.
Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?
Configure a rule exclusion for the network.asset.ip field.
Configure a rule exclusion for the principal.ip field.
Configure a rule exclusion for the target.domain field.
Configure a rule exclusion for the target.ip field.
Your third-party application data is published in a Pub/Sub topic located in a separate Google Cloud project from your Google Security Operations (SecOps) instance. Your attempts to push data from the Pub/Sub topic to Google SecOps have failed. You need to send this data into Google SecOps in a low-latency, robust way. What should you do?
Push the data to Cloud Logging, and modify the export filter in direct ingestion.
Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.
Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.
Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.
Your organization requires the SOC director to be notified by email of escalated incidents and their results before a case is closed. You need to create a process that automatically sends the email when an escalated case is closed. You need to ensure the email is reliably sent for the appropriate cases. What process should you use?
Use the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director.
Write a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director.
Navigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director Use the Close Case action in the UI to close the case.
Create a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email.
You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?
Write a YARA-L 2.0 detection rule that searches for events with the IP address.
Run raw log searches using the IP address as a search term.
On the Alerts & IOCs page, review results and entries where the IP address appears.
Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.
You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions: Send an email to users who do not have a Google Security Operations (SecOps) account to request approval for endpoint containment Automatically continue executing its logic after the user responds You plan to implement this process in the playbook by using the Gmail integration. You want to minimize the amount of effort required by the SOC analyst. What should you do?
Set the containment action to 'Manual' and assign the action to the user to execute or skip the containment action.
Set the containment action to 'Manual' and assign the action to the appropriate tier. Contact the user by email to request approval. The analyst chooses to execute or skip the containment action.
Use the 'Send Email' action to send an email requesting approval to contain the endpoint, and use the 'Wait For Thread Reply' action to receive the result. The analyst manually contains the endpoint.
Generate an approval link for the containment action and include the placeholder in the body of the 'Send Email' action. Configure additional playbook logic to manage approved or denied containment actions.
Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?
Configure a third-party API feed in Google SecOps.
Configure direct ingestion from your Google Cloud organization.
Configure and deploy a Google SecOps forwarder.
Configure and deploy a Bindplane collection agent.
Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift. This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?
Enable and enforce the constraints/compute.vmExternalIpAccess organization policy constraint at the project level for the project where the VM resides.
Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.
Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.
Navigate to the underlying Security Health Analytics (SHA) finding for PUBLIC_IP_ADDRESS on the VM, and mark this finding as fixed.
You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCs from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?
Create a list in Google Security Operations (SecOps), and grant the required access to the other teams.
Export the IOCs from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams.
Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams.
Create a new threat graph in Google Threat Intelligence, and share the graph with the other teams.
You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into: User identity behavior - Lateral movement - Privilege escalation attempts - You need to determine which telemetry sources are ingested first. Which log source should you prioritize?
Cloud access security broker (CASB) logs
EDR logs
IAM logs
Network firewall logs
You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?
Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.
Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
You are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization's environment. Alerts in Google SecOps indicate repeated PowerShell activity on a set of endpoints. Outbound connections are made to a domain that does not appear in your threat intelligence feeds. The activity occurs across multiple systems and user accounts. You need to search across impacted systems and user identities to identify the malicious user and understand the scope of the compromise. What should you do?
Perform a YARA-L 2.0 search to correlate activity across impacted systems and users.
Perform a raw log search for the suspicious domain string, and manually pivot to related user activity.
Use the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.
Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?
Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
Your team hunts for threats in a large multinational corporation. You have subscriptions to threat intelligence feeds from third-party sources. You want to implement a solution to continuously compare DNS calls on endpoints to your threat intelligence feeds. What should you do?
Use custom modules in Event Threat Detection in Security Command Center (SCC) to correlate feed data with Google Cloud logs.
Push endpoint logs to BigQuery and use scripts to compare entries to Google Threat Intelligence by using a Google Threat Intelligence API key.
Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the entity graph.
Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the VirusTotal table in the entity graph.
Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?
Use Gemini to generate YARA-L rules for multi-cloud use cases.
Use curated detections from the Cloud Threats category to monitor your cloud environment.
Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.
Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.
You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on-premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?
Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
Ask the Gemini agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
You have identified a new threat actor group that has several IOCs in Google Threat Intelligence. You want to use some of these IOCs in several detection rules in Google Security Operations (SecOps) to help identify suspicious activity. You want to use the most effective approach. What should you do?
Identify the detection rules that apply to the new IOCs, and update the YARA-L logic to reference the threat actor group.
Add the IOCs to a new or existing reference list, and update the YARA-L logic of detection rules to include the reference list.
Save the IOCs in a new collection in Google Threat Intelligence. Share this list with other members of the security team to facilitate their searches and rule creation.
Configure a new data feed in Google SecOps that includes the IOCs. Update the YARA-L logic to reference the new IOCs against applicable UDM fields.
You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?
Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.
Set a retention period for the BigQuery export.
Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.
Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.
Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?
Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
Your company uses Cloud Identity to manage employee identities and has Google Security Operations (SecOps) linked to your Google Cloud project. You have assigned the roles/chronicle.viewer IAM role at the project level to a specific Google Group that contains users with external Google accounts. Users in this external group authenticate successfully to Google Cloud, but are unable to access Google SecOps. Internal users granted the same role can access Google SecOps. What Google Cloud configuration is most likely preventing the external users from accessing Google SecOps?
External users must be synchronized to Cloud Identity using Google Cloud Directory Sync (GCDS) for IAM roles to take effect.
Google SecOps inherently blocks sign-ins from identities outside the organization's primary domain.
The constraints/iam.allowedPolicyMemberDomains organization policy is restricting IAM role assignments to identities within your company domain only.
The roles/chronicle.viewer IAM role does not apply correctly when granted to Google Groups containing external identities.
Your company's SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall installed and configured with credentials. You want to use the integration to trigger firewall rule changes directly from the Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve the requested changes prior to deployment. How should you implement the workflow for analysts to trigger on demand?
Create an email template for the analyst to get approval for the change from the system administrator. Have the analyst fill out the needed fields, and send the email for approval. Once approved, use a manual action to make the change to the firewall rule from any open case.
Create an account for the system administrator in your Google SecOps instance to allow the system administrator to make the changes from Google SecOps directly. Add an escalation step to enable the analyst to assign the case to the system administrator.
Create a playbook where the firewall rule change is a manual step, allowing the analyst to edit the firewall rule as a pending action. Have the analyst email the system administrator with the change. Once approved, the analyst lets the playbook continue.
Create a request in the Google SecOps SOAR account settings that includes a field for the firewall rule. Create a playbook that is triggered by this request. Configure the playbook step that makes the firewall rule change to send an approval request from the system administrator. The approval request must include the parameter being changed.
You are conducting proactive threat hunting in your company's Google Cloud environment. You suspect that an attacker compromised a developer's credentials and is attempting to move laterally from a development Google Kubernetes Engine (GKE) cluster to critical production systems. You need to identify IOCs and prioritize investigative actions by using Google Cloud's security tools before analyzing raw logs in detail. What should you do next?
In the Security Command Center (SCC) console, apply filters for the cluster and analyze the resulting aggregated findings' timeline and details for IOCs. Examine the attack path simulations associated with attack exposure scores to prioritize subsequent actions.
Review threat intelligence feeds within Google Security Operations (SecOps), and enrich any anomalies with context on known IOCs, attacker tactics, techniques, and procedures (TTPs), and campaigns.
Investigate Virtual Machine (VM) Threat Detection findings in Security Command Center (SCC). Filter for VM Threat Detection findings to target the Compute Engine instances that serve as the nodes for the cluster, and look for malware or rootkits on the nodes.
Create a Google SecOps SOAR playbook that automatically isolates any GKE resources exhibiting unusual network connections to production environments and triggers an alert to the incident response team.
During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of 30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?
Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.
Change the default case assignment logic to route all phishing alerts to the Tier 2 team.
Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.
Update the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.
You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)
Create a widget that translates the JSON output to a severity score.
Use the number of detections from the response JSON in a conditional statement to set the severity.
Verify that the response is accurate by manually checking the URL in VirusTotal.
Pass the response back to the SIEM.
Use a conditional statement to determine whether to treat the URL as suspicious or benign.
You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)
Filter for RDP connections with non-standard ports.
Filter for events using protocol-level attributes that indicate RDP connections.
Group events by user identity and time to identify repeated access patterns.
Correlate events based on the asset role or classification such as database or user workstation.
Use a saved search to identify all events with the LATERAL_MOVEMENT tag over the past 30 days.
You are configuring role-based data access controls for two groups of users in Google Security Operations (SecOps). Group A requires access to all data, and Group B requires access to all data except data from the "restricted" namespace. You need to configure access for these two groups. What should you do? (Choose two.)
Create a custom label with a UDM query to include all labels for Group A. Assign this data label to Group A in IAM.
Create a custom label with a UDM query to include all data except the "restricted" namespace data for Group B. Assign this data label to Group B in IAM.
Create a new data access scope to allow access to the "restricted" namespace data for Group A. Assign this data scope to Group A in IAM.
Create a new data access scope in the Google SecOps SIEM settings to allow access to all data for Group A. Assign this data access scope to Group A in IAM.
Create a new data access scope in the Google SecOps SIEM settings to allow access to all data and exclude the "restrict" namespace data for Group B. Assign this data access scope to Group B in IAM.
You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?
Design and develop a custom parser.
Apply any pending updates to the prebuilt parser.
Implement a parser extension on top of the prebuilt parser.
Implement middleware to modify the underlying data structure.
You are configuring a new integration in Google Security Operations (SecOps) to perform enrichment actions in playbooks. This enrichment technology is located in a private data center that does not allow inbound network connections. You need to connect your Google SecOps instance to the integration. What should you do?
Create a forwarder in the private data center. Configure an instance of the integration to run on the forwarder.
Query the enrichment source in the private data center and upload the results to the case wall in Google SecOps.
Create a network route in Google Cloud to the private data center.
Create a remote agent in the private data center. Configure an instance of the integration to run on a remote agent in Google SecOps.
You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?
Ingest logs from Windows Sysmon.
Ingest logs from Microsoft Entra ID.
Ingest logs from Windows PowerShell.
Ingest logs from Windows Procmon.
You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCs in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?
Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
Configure alert grouping for the most repetitive alerts.
Implement curated detections instead of custom YARA-L rules.
Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC-Score) is between 60% and 80%.
You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IOCs that you suspect were generated due to the exercise. What should you do?
Ask Gemini to provide a list of IOCs from the red team exercise.
Filter IOCs with an ingestion time that matches the time period of the red team exercise.
Navigate to the IOC Matches page. Identify and mute the IOCs from the red team exercise.
Navigate to the IOC Matches page. Review IOCs with an Indicator Confidence Score (IC-Score) label >= 80%.
You are managing the integration of Security Command Center (SCC) with downstream tooling. You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?
Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.
Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.
You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?
Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.
Perform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.
Perform a UDM search for login events, and pivot to group results by user and country of origin.
Run a YARA-L rethrount rule that detects users who are logging in from multiple regions using multiple entity contexts.
You are using a Google-managed image on a Compute Engine instance in Google Cloud to run an application. You need to ingest the application's log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time required to move this data into Google SecOps. What should you do?
Use the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging. Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.
Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.
Create a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.
Use the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.
You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise, Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI). You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time. What should you do?
Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.
Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.
Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.
Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.
