You work for a large international company with several Compute Engine instances running in production. You must configure monitoring and alerting for Compute Engine instances that are tagged compliance=pci and have an external IP address assigned. What should you do?
ACreate a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance=pci tag is assigned an external IP address.
BDeploy the compute.vmExternalIpAccess organization policy constraint to prevent specific projects or folders with the compliance=pci tag from creating Compute Engine instances with external IP addresses.
CCreate a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance=pci tag.
DUse the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance=pci tag exists on the instances.
0
Community Discussion
No comments yet. Be the first to start the discussion!
The organization requires that the SOC director be notified by email about escalated incidents and their results before a case is closed. You need to create a process that automatically sends this email when an escalated case is closed. You must ensure that the email is sent reliably for the appropriate cases. Which process should you use?
AUse the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director.
BWrite a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director.
CNavigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director Use the Close Case action in the UI to close the case.
DCreate a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email.
0
Community Discussion
No comments yet. Be the first to start the discussion!
You work for a telecommunications company that needs to monitor logs from its multi-region 5G network in Google Security Operations (SecOps). The logs are currently available only on-premises and reside on standalone network-attached storage (NAS) in four different regions. You need to ingest these logs into Google SecOps and tag each NAS as a distinct log source to prevent IP address aliasing. What should you do?
AConfigure feed management to pull data from each log's location, and configure a namespace for each log source.
BConfigure feed management to pull data from each log's location, and configure an ingestion label for each log source.
CConfigure a Bindplane agent that collects Syslog from each log's location, and configure a namespace for each log source.
DConfigure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source.
0
Community Discussion
No comments yet. Be the first to start the discussion!
You received an IOC from your threat-intelligence feed that is identified as a suspicious domain used for command and control (C2). You want to use Google Security Operations (SecOps) to investigate whether this domain has appeared in your environment. You want to search for this IOC using the most efficient approach. What should you do?
ARun a raw log search to search for the domain string.
BConfigure a UDM search that queries the DNS section of the network noun.
CEnable Group by Field in scan view to cluster events by hostname.
DEnter the IOC into the IOC Search feature, and wait for detections with this domain to appear in the Case view.
0
Community Discussion
No comments yet. Be the first to start the discussion!
You manage the integration of Security Command Center (SCC) with downstream tooling. You need to retrieve security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You must configure the connection between SCC and Google SecOps. What should you do?
AInstall the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
BInstall the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.
CCreate a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
DCreate a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.
0
Community Discussion
No comments yet. Be the first to start the discussion!
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
You are collaborating with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox. The analyst team currently uses a SIEM query to search for related information. You need to design a solution that automatically includes the query results in the Google SecOps case without writing any new code. What should you do?
ACreate a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
BModify the detection rule in the SIEM to include the query results as part of the detection.
CAdd a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
DAdd an action to the playbook that runs the SIEM query and returns the results.
You are performing a proactive threat hunt in Google Security Operations (SecOps). You notice multiple login events with the same principal.user.userid field that come from different countries within a short time window. You need to confirm whether the account may be compromised. What should you do?
AUse the entity graph to correlate the user's risk score with linked assets, and review any active alerts.
BPerform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.
CPerform a UDM search for login events, and pivot to group results by user and country of origin.
DRun a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
You need to enhance your organization’s existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCs and want to incorporate external signals for this capability to provide broad detection coverage. What should you do?
ACreate an Event Threat Detection custom module using the "Configurable Bad IP" template.
BCreate a Security Health Analytics (SHA) custom module using the compute address resource.
CCreate a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
DCreate a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
A company's risk management and compliance team requires regular reports on adherence to industry-standard control frameworks for a regulated business unit that continually adds projects. You need to create a report containing evidence of non-compliant resources identified in this environment. How should you generate this report?
ARun an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
BRun queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
CImplement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
DImplement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps). You must create a report showing the Return on Investment (ROI) attributable to analyst activities in Google SecOps SOAR for the previous month. The report must include the time saved and efficiency gains from using SOAR features. You need to produce this report with the most efficient and accurate approach while providing the required level of detail. What should you do?
ACreate a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.
BUse the ROI - Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.
CUse the filters and visualizations in the Management - SOC Status report in SOAR Reports to extract case-specific performance data.
DDevelop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.
You need to build a workflow in Google Security Operations (SecOps) SOAR. The documentation being used calls for a logical split with eight possible paths. You must divide the workflow into eight separate workflows through an automatic, efficient method. What should you do?
ACreate eight playbooks for each workflow. Configure the triggered playbook to end on an instruction action that tells the analyst to pick a workflow from the playbooks tab and attach that workflow to the alert.
BCreate eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to the alert.
CCreate a playbook that uses a flow condition. Add four more branches to have a total of five branches and an "Else" branch. On the "Else" branch, include another flow condition. Include the remaining three branches with the logic required.
DCreate a playbook that uses a Multi-Choice Question flow and a second Multi-Choice Question for the additional answer choices. Add instructions describing which logic to use in the instruction or question fields. Have the analyst select the appropriate answer to move the flow into the right branch.
Your company's SOC analysts frequently submit manual change requests to a system administrator to modify firewall rules on a specific router. The firewall integration is installed and configured with credentials. You want to use the integration to trigger firewall-rule changes directly from Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve requested changes before deployment. How should you implement the on-demand workflow for analysts to trigger?
ACreate an email template for the analyst to get approval for the change from the system administrator. Have the analyst fill out the needed fields, and send the email for approval. Once approved, use a manual action to make the change to the firewall rule from any open case.
BCreate an account for the system administrator in your Google SecOps instance to allow the system administrator to make the changes from Google SecOps directly. Add an escalation step to enable the analyst to assign the case to the system administrator.
CCreate a playbook where the firewall rule change is a manual step, allowing the analyst to edit the firewall rule as a pending action. Have the analyst email the system administrator with the change. Once approved, the analyst lets the playbook continue.
DCreate a request in the Google SecOps SOAR settings that includes a field for the firewall rule. Create a playbook that is triggered by this request. Configure the playbook step that makes the firewall rule change to send an approval request from the system administrator. The approval request must include the parameter being changed.
You are examining the results of a UDM search in Google Security Operations (SecOps). The UDM fields displayed in the default view are not pertinent to your search. You want to quickly see the data that is relevant to your analysis. What should you do?
ADownload the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.
BCreate a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.
CSelect the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.
DUse the columns feature to select or remove columns that are relevant to your analysis.
Your company's Google Security Operations (SecOps) instance uses three roles: Tier 1, Tier 2, and Tier 3. At present, analysts across all tiers can access every case in Google SecOps. Your company's SOC has a new requirement to limit other tiers' access to cases assigned to the Tier 3 role. You need to ensure that cases assigned to the Tier 3 role are accessible only to Tier 3 analysts. What should you do?
AInstruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
BRevoke additional role access from Tier 1 and Tier 2 analysts.
CConfigure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
DAssign the cases to a user in the Tier 3 role.
You are a security analyst at an organization that uses Google Security Operations (SecOps). You observe suspicious login attempts on several user accounts. You need to determine as quickly as possible whether these attempts are part of a coordinated attack. What action should you take first?
AEnable default curated detections to automatically block suspicious IP addresses.
BUse UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.
CRemove user accounts that have repeated invalid login attempts.
DLook for correlations across impacted users in the Risk Analytics dashboard.
Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high-priority network indicators. You are seeing a very large number of false positives from your on-premises proxy servers. You need to decrease the number of alerts. What should you do?
AConfigure a rule exclusion for the network.asset.ip field.
BConfigure a rule exclusion for the principal.ip field.
CConfigure a rule exclusion for the target.domain field.
DConfigure a rule exclusion for the target.ip field.
You are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization’s environment. Google SecOps alerts show repeated PowerShell activity on a group of endpoints. Outbound connections are being made to a domain that is absent from your threat intelligence feeds. The activity takes place across multiple systems and user accounts. You must search across affected systems and user identities to identify the malicious user and determine the scope of the compromise. What should you do?
APerform a YARA-L 2.0 search to correlate activity across impacted systems and users.
BPerform a raw log search for the suspicious domain string, and manually pivot to related user activity.
CUse the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
DUse the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.
You are an incident-response engineer at an organization that uses Google Security Operations (SecOps). You recently began monitoring IOCs in Applied Threat Intelligence with YARA-L rules. You have found more false-positive alerts than expected, creating noise for the SOC team. You need to lower the number of false-positive alerts. What should you do?
AModify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
BConfigure alert grouping for the most repetitive alerts.
CImplement curated detections instead of custom YARA-L rules.
DCreate a playbook that automatically tunes the IOC source if its indicator confidence score (IC-Score) is between 60% and 80%.
Your Google Security Operations (SecOps) instance is producing a high volume of alerts for an IP address that recently appeared in a threat-intelligence feed. Multiple vendors flag the IP address as a known command-and-control (C2) server. The IP address is present in repeated DNS queries from a sandboxing system and test environment used by your malware-analysis team. You want to prevent alert fatigue while retaining visibility if the IOC appears again in real production telemetry. What should you do?
ATemporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
BAdd the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
CReduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
DAdd an exception in the detection rule to exclude matches originating from specific asset groups.
You are creating a security strategy for your organization. You plan to use Google Security Operations (SecOps) and Google Threat Intelligence (GTI). You need to improve detection and response across multi-cloud and on-premises systems. How should you integrate these products?
Choose two
AIngest GTI IOCs into Google SecOps as security events.
BIngest on-premises and cloud security logs into Google SecOps SIEM as events.
CIngest on-premises and cloud security logs into Google SecOps SIEM as entities.
DUse Google SecOps SOAR integrations with GTI for event enrichment.
EUse Google SecOps SOAR integrations with GTI for entity enrichment.
You are a SOC analyst investigating a case in Google Security Operations (SecOps). The case includes a file hash that playbooks have automatically enriched with VirusTotal context and classified as likely malicious. You need to rapidly identify the devices and users in your organization that have interacted with this file. What should you do?
ABuild a playbook to perform a UDM search matching on the file hash in Google SecOps SIEM.
BBuild a playbook to query your threat intelligence platform (TIP) for the presence of the file hash.
CUse a manual action in Google SecOps SOAR to perform a UDM search matching on the file hash in Google SecOps SIEM.
DUse a manual action in Google SecOps SOAR to query your threat intelligence platform (TIP) for the presence of the file hash.
You are performing proactive threat hunting in your company’s Google Cloud environment. You suspect an attacker has compromised a developer’s credentials and is trying to move laterally from a development Google Kubernetes Engine (GKE) cluster to critical production systems. You need to identify IOCs and prioritize investigative actions with Google Cloud security tools before analyzing raw logs in detail. What should you do next?
AIn the Security Command Center (SCC) console, apply filters for the cluster and analyze the resulting aggregated findings' timeline and details for IOCs. Examine the attack path simulations associated with attack exposure scores to prioritize subsequent actions.
BReview threat intelligence feeds within Google Security Operations (SecOps), and enrich any anomalies with context on known IOCs, attacker tactics, techniques, and procedures (TTPs), and campaigns.
CInvestigate Virtual Machine (VM) Threat Detection findings in Security Command Center (SCC). Filter for VM Threat Detection findings to target the Compute Engine instances that serve as the nodes for the cluster, and look for malware or rootkits on the nodes.
DCreate a Google SecOps SOAR playbook that automatically isolates any GKE resources exhibiting unusual network connections to production environments and triggers an alert to the incident response team.
Your organization recently acquired Company A, which operates its own SOC and security tooling. You have already configured ingestion for Company A's security telemetry and migrated its detection rules into Google Security Operations (SecOps).
You now need to let Company A's analysts work their cases in Google SecOps. Ensure that Company A's analysts:
cannot access case data originating outside Company A
can repurpose playbooks previously developed by your organization's employees
You need to minimize the effort required to implement the solution. What should you do first?
AAcquire a second Google SecOps SOAR tenant for Company A.
BProvision a new service account for Company A.
CDefine a new SOC role for Company A.
DCreate a Google SecOps SOAR environment for Company A.
Your Google Security Operations (SecOps) instance is creating alerts for unusual login times across multiple user accounts. SOC analysts report that many of these alerts are false positives associated with service accounts used by scheduled automation tasks. You want to refine the detection logic by using entity-level context available in Google SecOps. What is the most effective action to take?
AUse asset tags to group known automation systems, and exclude them from the alert logic.
BModify the rule to include the principal.user.type != "service_account" condition.
CUpdate the rule to only alert when the principal.user.email and principal.user.userid fields match in the same event.
DAdd a reference list of all service accounts, and suppress alerts for any matches on the principal.user.email field.
You use Google Security Operations (SecOps) curated detections and YARA-L rules to identify suspicious activity on Windows endpoints. Your source telemetry consists of EDR and Windows Event logs, and your rules match the principal.user.userid UDM field. You need to ingest an additional log source so this field can match all possible log entries from your EDR and Windows Event logs. What should you do?
Community Discussion