Font size
WorksheetsData Ingestion in Google Security Operations
Total questions: 30
Worksheet time: 15mins
You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?
Design and develop a custom parser.
Apply any pending updates to the prebuilt parser.
Implement a parser extension on top of the prebuilt parser.
Implement middleware to modify the underlying data structure.
Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?
Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
Your team hunts for threats in a large multinational corporation. You have subscriptions to threat intelligence feeds from third-party sources. You want to implement a solution to continuously compare DNS calls on endpoints to your threat intelligence feeds. What should you do?
Use custom modules in Event Threat Detection in Security Command Center (SCC) to correlate feed data with Google Cloud logs.
Push endpoint logs to BigQuery and use scripts to compare entries to Google Threat intelligence by using a Google Threat Intelligence API key.
Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the entity graph.
Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the VirusTotal table in the entity graph.
Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?
Use Gemini to generate YARA-L rules for multi-cloud use cases.
Use curated detections from the Cloud Threats category to monitor your cloud environment.
Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.
Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.
You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on-premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?
Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
You have identified a new threat actor group that has several IOCs in Google Threat Intelligence. You want to use some of these IOCs in several detection rules in Google Security Operations (SecOps) to help identify suspicious activity. You want to use the most effective approach. What should you do?
Identify the detection rules that apply to the new IOCs, and update the YARA-L logic to reference the threat actor group.
Add the IOCs to a new or existing reference list, and update the YARA-L logic of detection rules to include the reference list.
Save the IOCs in a new collection in Google Threat Intelligence. Share this list with other members of the security team to facilitate their searches and rule creation.
Configure a new data feed in Google SecOps that includes the IOCs. Update the YARA-L logic to reference the new IOCs against applicable UDM fields.
You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?
Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.
Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
You are a SOC analyst investigating suspicious PowerShell activity and outbound connections to an unknown domain across multiple systems and user accounts. What is the best initial action to correlate activity across impacted systems and users?
Perform a YARA-L 2.0 search to correlate activity across impacted systems and users.
Perform a raw log search for the suspicious domain string, and manually pivot to related user activity.
Use the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.
Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. A Security Command Center (SCC) posture deployment based on the PCI DSS v4.0 template generates a finding that a Compute Engine VM within the CDE scope has been configured with an external IP address. What immediate action should you take to remediate the compliance drift identified by this SCC posture finding?
Enable and enforce the constraints/compute.vmExternalIpAccess organization policy constraint at the project level for the project where the VM resides.
Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.
Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.
Navigate to the underlying Security Health Analytics (SHA) finding for PUBLIC_IP_ADDRESS on the VM, and mark this finding as fixed.
You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCs from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?
Create a list in Google Security Operations (SecOps), and grant the required access to the other teams.
Export the IOCs from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams.
Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams.
Create a new threat graph in Google Threat Intelligence, and share the graph with the other teams.
You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into: User identity behavior - Lateral movement - Privilege escalation attempts - You need to determine which telemetry sources are ingested first. Which log source should you prioritize?
Cloud access security broker (CASB) logs
EDR logs
IAM logs
Network firewall logs
You are responsible for selecting and prioritizing potential sources of data to integrate with Google Security Operations (SecOps). Your company has recently started using several Google Cloud services to increase security in its Google Cloud organization. You need to determine which logs should be ingested into Google SecOps to reduce the effort required to write detections. What should you do?
Ingest Google Cloud Armor logs by using Cloud Logging.
Deploy a Bindplane agent to ingest event logs from Compute Engine VMs that provide endpoint visibility.
Integrate Security Command Center (SCC) into Google SecOps to ingest logs originating from the Google Cloud services.
Use Google Threat Intelligence to gain insight about threat group behavior and support threat hunting activities.
You are developing a security strategy for your organization using Google Security Operations (SecOps) and Google Threat Intelligence (GTI). To enhance detection and response across multicloud and on-premises systems, which two integration methods should you use?
Ingest GTI IOCs into Google SecOps as security events.
Ingest on-premises and cloud security logs into Google SecOps SIEM as events.
Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.
Use Google SecOps SOAR integrations with GTI for event enrichment.
Use Google SecOps SOAR integrations with GTI for entity enrichment.
Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post-processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning. What should you do?
Generate a report in SOAR Reports, and schedule delivery of the report.
Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
You are reviewing the results of a UDM search in Google Security Operations (SecOps). The UDM fields shown in the default view are not relevant to your search. You want to be able to quickly view the relevant data for your analysis. What should you do?
Download the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.
Create a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.
Select the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.
Use the columns feature to select or remove columns that are relevant to your analysis.
Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?
Configure a rule exclusion for the network.asset.ip field.
Configure a rule exclusion for the principal.ip field.
Configure a rule exclusion for the target.domain field.
Configure a rule exclusion for the target.ip field.
Your third-party application data is published in a Pub/Sub topic located in a separate Google Cloud project from your Google Security Operations (SecOps) instance. Your attempts to push data from the Pub/Sub topic to Google SecOps have failed. You need to send this data into Google SecOps in a low-latency, robust way. What should you do?
Push the data to Cloud Logging, and modify the export filter in direct ingestion.
Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.
Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.
Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.
Your organization requires the SOC director to be notified by email of escalated incidents and their results before a case is closed. You need to create a process that automatically sends the email when an escalated case is closed. You need to ensure the email is reliably sent for the appropriate cases. What process should you use?
Use the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director.
Write a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director.
Navigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director. Use the Close Case action in the UI to close the case.
Create a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email.
You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?
Write a YARA-L 2.0 detection rule that searches for events with the IP address.
Run raw log searches using the IP address as a search term.
On the Alerts & IOCs page, review results and entries where the IP address appears.
Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.
You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should send an email to users who do not have a Google Security Operations (SecOps) account to request approval for endpoint containment and automatically continue executing its logic after the user responds. You want to minimize the amount of effort required by the SOC analyst. What should you do?
Set the containment action to 'Manual' and assign the action to the user to execute or skip the containment action.
Set the containment action to 'Manual' and assign the action to the appropriate tier. Contact the user by email to request approval. The analyst chooses to execute or skip the containment action.
Use the 'Send Email' action to send an email requesting approval to contain the endpoint, and use the 'Wait For Thread Reply' action to receive the result. The analyst manually contains the endpoint.
Generate an approval link for the containment action and include the placeholder in the body of the 'Send Email' action. Configure additional playbook logic to manage approved or denied containment actions.
Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?
Configure a third-party API feed in Google SecOps.
Configure direct ingestion from your Google Cloud organization.
Configure and deploy a Google SecOps forwarder.
Configure and deploy a Bindplane collection agent.
Your organization is a Google Security Operations (SecOps) customer. You use Google Threat Intelligence to identify cyber threats within your organization's threat profile. You believe your organization may have been targeted by a cyber crime group. You need to identify whether your organization has been the victim of an attack. What should you do?
Implement monitors in the Digital Threat Monitoring feature to identify new compromised credentials, dark web mentions, or data leaks.
In the Reports & Analysis feature, extract the IOCs from the recent reports, and implement detection rules and lists in Google SecOps to identify whether they are present in your organization's environment.
Review the Threat Landscape feature to identify threat groups that are active in your industry, research their known MITRE ATT&CK tactics, techniques, and procedures (TTPs) and implement detection rules in Google SecOps.
In the Vulnerability Intelligence feature, identify new high and critical vulnerabilities in products or technologies that your organization uses so they can be patched.
You are implementing Google Security Operations (SecOps) for your organization, which uses a native integration with a Malware Information Sharing Platform (MISP). You need to add code in a detection rule to filter for command and control (C2) indicators ingested into the entity graph. Which code should you add in the detection rule?
$ioc.graph.metadata.entity_type = "DOMAIN_NAME" $ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
$ioc.graph.metadata.entity_type = "DOMAIN_NAME" $ioc.graph.metadata.source_type = "GLOBAL_CONTEXT"
$ioc.graph.metadata.entity_type = "DOMAIN_NAME" $ioc.graph.metadata.source_type = "DERIVED_CONTEXT"
$ioc.graph.metadata.entity_type = "DOMAIN_NAME" $ioc.graph.metadata.source_type = "SOURCE_TYPE_UNSPECIFIED"
You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota. Which log type should you ingest into Google SecOps?
VPC Flow Logs
Security Command Center Premium (SCCP) findings
Cloud IDS logs
Cloud Audit Logs
You are a SOC analyst working a case in Google Security Operations (SecOps). The case contains a file hash that your playbooks have automatically enriched with VirusTotal context and categorized as likely malicious. You need to quickly identify devices and users in your organization who have interacted with this file. What should you do?
Build a playbook to perform a UDM search matching on the file hash in Google SecOps SIEM.
Build a playbook to query your threat intelligence platform (TIP) for the presence of the file hash.
Use a manual action in Google SecOps SOAR to perform a UDM search matching on the file hash in Google SecOps SIEM.
Use a manual action in Google SecOps SOAR to query your threat intelligence platform (TIP) for the presence of the file hash.
You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?
Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.
Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
Configure the Windows server to send an email notification if there is an error in the Bindplane process.
You observe several distinct, low-severity suspicious activities associated with a single internal server. You determine that no single event is a high-confidence IOC. You need to create a solution that ensures ongoing and heightened scrutiny for this server. What should you do?
Schedule a daily Google Security Operations (SecOps) report detailing all activity on this server.
Develop a YARA-L detection rule specific to this server.
Add the server to a Google Security Operations (SecOps) watchlist, and monitor the watchlist closely for the next few weeks.
Create a case, isolate the server from the network, and escalate the case for forensic investigation.
Your organization recently adopted Google Security Operations (SecOps) and has configured ingestion, parsing, and rules for log sources. The security operations team is triaging alerts one at a time using several external product dashboards with alerts and enrichment data. You want to use the case management functionality in Google SecOps to reduce the amount of pivoting between products your SOC analysts are required to do. You want to minimize development effort. What should you do first?
Build a playbook for each detection rule to enrich and remediate alerts relative to the particular threat each rule is designed to detect.
Build a playbook for each of the noisiest alert sources to gather additional context on the case from the source product.
Build a job to periodically iterate over recent cases, determine relevant context, and enrich alerts.
Build a low-priority, catch-all playbook for enrichment of entities in a case using threat intelligence sources.
You were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand the current performance by calculating the mean time to respond or remediate (MTTR) for your cases. What should you do?
Create a multi-event detection rule to calculate the response metrics in the outcome section based on the entity graph. Create a dashboard based on these metrics.
Create a dashboard table widget that displays the average case handling times by analyst, case priority, and environment.
Create a playbook block that can be re-used in all alert playbooks to write timestamps in the case wall after each change to the case. Write a job to calculate the case metrics.
Use the playbooks' case stages to capture metrics for each stage change. Create a dashboard based on these metrics.
You received an IOC from your threat intelligence feed that is identified as a suspicious domain used for command and control (C2). You want to use Google Security Operations (SecOps) to investigate whether this domain appeared in your environment. You want to search for this IOC using the most efficient approach. What should you do?
Run a raw log search to search for the domain string.
Configure a UDM search that queries the DNS section of the network noun.
Enable Group by Field in scan view to cluster events by hostname.
Enter the IOC into the IOC Search feature, and wait for detections with this domain to appear in the Case view.
