Font size
WorksheetsThreat Intelligence and Security Operations Quiz
Total questions: 30
Worksheet time: 15mins
You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise, Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI). You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time. What should you do?
Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.
Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.
Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.
Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.
You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?
Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
Create a case for each identified user with the user designated as the entity.
Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
You are a security engineer at a financial technology company. You need to create a centralized dashboard to provide security posture visibility for your leadership team. The dashboard must meet these requirements: Provide insights from Security Command Center (SCC) findings and security-related events captured in Cloud Logging. Support large volumes of historical data. Be able to join SCC findings and audit logs. You want to use the most effective visualization solution that uses Google Cloud managed services. What should you do?
Ingest the SCC findings and Cloud Audit Logs into a Cloud Storage bucket. Write a Python script that reads the data and uses Matplotlib to create the visualizations.
Create custom metrics in Cloud Monitoring based on the SCC findings, and configure log-based metrics for security-related events. Build Cloud Monitoring dashboards to visualize these custom and log-based metrics.
Export SCC findings and Cloud Audit Logs to BigQuery. Connect Looker Studio to the BigQuery datasets, and create the visualizations and filters.
Use the built-in SCC dashboard to visualize the SCC finding, and extract log counts for specific log events from Cloud Audit Logs.
Your organization has mission-critical production Compute Engine VMs that you monitor daily. While performing a UDM search in Google Security Operations (SecOps), you discover several outbound network connections from one of the production VMs to an unfamiliar external IP address occurring over the last 48 hours. You need to use Google SecOps to quickly gather more context and assess the reputation of the external IP address. What should you do?
Examine the Google SecOps Asset view details for the production VM.
Create a new detection rule to alert on future traffic from the external IP address.
Search for the external IP address in the Alerts & IOCs page in Google SecOps.
Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.
You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?
net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?
Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
Use a custom parser that outputs all fields as raw JSON for detection.
Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process, and restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?
Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?
Configure each network in the Google SecOps SOAR settings.
Enrich the IP address entities as the initial step of the playbook.
Modify the entity attribute in the alert overview.
Create an outcome variable in the rule to assign the network name.
You have identified a common malware variant on a potentially infected computer. You need to find reliable IOCs and malware behaviors as quickly as possible to confirm whether the computer is infected and search for signs of infection on other computers. What should you do?
Create a Compute Engine VM, and perform dynamic and static malware analysis.
Perform a UDM search for the file checksum in Google Security Operations (SecOps). Review activities that are associated with, or attributed to the malware.
Run a Google Web Search for the malware hash, and review the results.
Search for the malware hash in Google Threat Intelligence, and review the results.
Your Google Security Operations (SecOps) SOAR integration with Security Command Center (SCC) uses a service account that currently has read access to the findings at the organization level. Google SecOps SOAR successfully reads SCC finding data, but actions attempting to update the finding states consistently fail with a permission denied error. You need to resolve this error while following the principle of least privilege. What should you do?
Grant the service account the roles/securitycenter.findingsBulkMuteEditor IAM role at the organization level.
Grant the service account the roles/securitycenter.findingsEditor IAM role at the organization level.
Grant the service account the roles/iam.serviceAccountUser IAM role to itself.
Regenerate the service account key, and update the credentials in Google SecOps SOAR.
You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCs and would like to include external signals for this capability to ensure broad detection coverage. What should you do?
Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
Create a Security Health Analytics (SHA) custom module using the compute address resource.
Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting data. You need to minimize the cost of these configurations. What should you do?
Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.
Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.
Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?
Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
Revoke additional role access from Tier 1 and Tier 2 analysts.
Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
Assign the cases to a user in the Tier 3 role.
You are the lead engineer on your organization's incident response team. You notice a high volume of ransomware incidents impacting your team's SLAs. Which two actions should you take to automate the detection and containment of ransomware incidents on Windows devices?
Enable the Windows Threats category in curated detections to detect the latest Windows threats and install SOAR EDR integrations for endpoint containment actions.
Enable the Risk Analytics for User and Endpoint Behavioral Analytics (UEBA) category and install SOAR remote agent on each Windows device.
Enable the Windows Threats category in curated detections to detect the latest Windows threats and install SOAR EDR integrations for endpoint containment actions.
Install SOAR EDR jobs to execute remote endpoint containment actions and enable the Risk Analytics for User and Endpoint Behavioral Analytics (UEBA) category.
You need to ingest audit logs from your organization's entire Google Cloud environment into Google Security Operations (SecOps), including Cloud NAT logs for workloads within a designated folder. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next to minimize integration complexity?
Create a custom filter to export the folder-level Cloud NAT logs.
Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder.
Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps.
Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps.
You work for an organization that operates an ecommerce platform and have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts using available tools in Google Security Operations (SecOps). What should you do to streamline the playbook creation process?
Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.
Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.
Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IOCs that you suspect were generated due to the exercise. What should you do?
Ask Gemini to provide a list of IOCs from the red team exercise.
Filter IOCs with an ingestion time that matches the time period of the red team exercise.
Navigate to the IOC Matches page. Identify and mute the IOCs from the red team exercise.
Navigate to the IOC Matches page. Review IOCs with an Indicator Confidence Score (IC-Score) label >= 80%.
You are managing the integration of Security Command Center (SCC) with downstream tooling. You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?
Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.
Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.
You are configuring a new integration in Google Security Operations (SecOps) to perform enrichment actions in playbooks. The enrichment technology is located in a private data center that does not allow inbound network connections. What should you do to connect your Google SecOps instance to the integration?
Create a forwarder in the private data center. Configure an instance of the integration to run on the forwarder.
Query the enrichment source in the private data center and upload the results to the case wall in Google SecOps.
Create a network route in Google Cloud to the private data center.
Create a remote agent in the private data center. Configure an instance of the integration to run on a remote agent in Google SecOps.
You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?
Ingest logs from Windows Sysmon.
Ingest logs from Microsoft Entra ID.
Ingest logs from Windows PowerShell.
Ingest logs from Windows Procmon.
You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCs in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?
Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
Configure alert grouping for the most repetitive alerts.
Implement curated detections instead of custom YARA-L rules.
Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC-Score) is between 60% and 80%.
You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?
Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.
Set a retention period for the BigQuery export.
Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.
Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.
Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?
Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
Your company uses Cloud Identity to manage employee identities and has Google Security Operations (SecOps) linked to your Google Cloud project. You have assigned the roles/chronicle.viewer IAM role at the project level to a specific Google Group that contains users with external Google accounts. Users in this external group authenticate successfully to Google Cloud, but are unable to access Google SecOps. Internal users granted the same role can access Google SecOps. What Google Cloud configuration is most likely preventing the external users from accessing Google SecOps?
External users must be synchronized to Cloud Identity using Google Cloud Directory Sync (GCDS) for IAM roles to take effect.
Google SecOps inherently blocks sign-ins from identities outside the organization's primary domain.
The constraints/iam.allowedPolicyMemberDomains organization policy is restricting IAM role assignments to identities within your company domain only.
The roles/chronicle.viewer IAM role does not apply correctly when granted to Google Groups containing external identities.
Your company's SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall installed and configured with credentials. You want to use the integration to trigger firewall rule changes directly from the Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve the requested changes prior to deployment. How should you implement the workflow for analysts to trigger on demand?
Create an email template for the analyst to get approval for the change from the system administrator. Have the analyst fill out the needed fields, and send the email for approval. Once approved, use a manual action to make the change to the firewall rule from any open case.
Create an account for the system administrator in your Google SecOps instance to allow the system administrator to make the changes from Google SecOps directly. Add an escalation step to enable the analyst to assign the case to the system administrator.
Create a playbook where the firewall rule change is a manual step, allowing the analyst to edit the firewall rule as a pending action. Have the analyst email the system administrator with the change. Once approved, the analyst lets the playbook continue.
Create a request in the Google SecOps SOAR settings that includes a field for the firewall rule. Create a playbook that is triggered by this request. Configure the playbook step that makes the firewall rule change to send an approval request to the system administrator. The approval request must include the firewall rule change details.
You are conducting proactive threat hunting in your company's Google Cloud environment. You suspect that an attacker compromised a developer's credentials and is attempting to move laterally from a development Google Kubernetes Engine (GKE) cluster to critical production systems. You need to identify IOCs and prioritize investigative actions by using Google Cloud's security tools before analyzing raw logs in detail. What should you do next?
In the Security Command Center (SCC) console, apply filters for the cluster and analyze the resulting aggregated findings' timeline and details for IOCs. Examine the attack path simulations associated with attack exposure scores to prioritize subsequent actions.
Review threat intelligence feeds within Google Security Operations (SecOps), and enrich any anomalies with context on known IOCs, attacker tactics, techniques, and procedures (TTPs), and campaigns.
Investigate Virtual Machine (VM) Threat Detection findings in Security Command Center (SCC). Filter for VM Threat Detection findings to target the Compute Engine instances that serve as the nodes for the cluster, and look for malware or rootkits on the nodes.
Create a Google SecOps SOAR playbook that automatically isolates any GKE resources exhibiting unusual network connections to production environments and triggers an alert to the incident response team.
During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of 30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?
Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.
Change the default case assignment logic to route all phishing alerts to the Tier 2 team.
Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.
Update the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.
You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL reported by a threat hunter. You need to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. Which two actions should you take? (Choose two.)
Create a widget that translates the JSON output to a severity score.
Use the number of detections from the response JSON in a conditional statement to set the severity.
Verify that the response is accurate by manually checking the URL in VirusTotal.
Pass the response back to the SIEM.
Use a conditional statement to determine whether to treat the URL as suspicious or benign.
You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. Which two actions should you take to build this query?
Filter for RDP connections with non-standard ports and correlate events based on asset role.
Filter for events using protocol-level attributes that indicate RDP connections and group events by user identity and time to identify repeated access patterns.
Use a saved search to identify all events with the LATERAL_MOVEMENT tag and filter for RDP connections with non-standard ports.
Correlate events based on asset role and use a saved search to identify all events with the LATERAL_MOVEMENT tag.
You are configuring role-based data access controls for two groups of users in Google Security Operations (SecOps). Group A requires access to all data, and Group B requires access to all data except data from the "restricted" namespace. You need to configure access for these two groups. What should you do? (Choose two.)
Create a custom label with a UDM query to include all labels for Group Assign this data label to Group A in IAM.
Create a custom label with a UDM query to include all data except the "restricted" namespace data for Group Assign this data label to Group B in IAM.
Create a new data access scope to allow access to the "restricted" namespace data for Group A. Assign this data scope to Group A in IAM.
Create a new data access scope in the Google SecOps SIEM settings to allow access to all data for Group A. Assign this data access scope to Group A in IAM.
Create a new data access scope in the Google SecOps SIEM settings to allow access to all data and exclude the "restrict" namespace data for Group B. Assign this data access scope to Group B in IAM.
