Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ41

Incident response

Your organization uses Security Command Center (SCC) and depends on Compute Engine instances to run business-critical workloads. SCC has flagged one instance for generating a high number of outbound network connections to geographically diverse, unknown IP addresses. You need to determine whether the instance has been compromised by malware. What should you do?

  • A Examine the IAM roles assigned to the service account that are associated with the instance. Revoke any permissions that could have facilitated malware installation.
  • B Review the Google Cloud Service Health dashboard to identify any ongoing Google Cloud platform incidents that could be causing unusual network traffic from the instance.
  • C Disable and re-enable the instances' network interface and determine whether the unusual network behavior is resolved.
  • D Analyze Event Threat Detection findings. Review the events and the outbound network connections associated with the instance.
Explanation

Event Threat Detection generates Security Command Center threat findings from relevant logs, including network-related malware detections such as connections to known bad IP addresses or domains. Reviewing its findings, events, and the instance’s outbound connections provides the evidence needed to investigate indicators of compromise and determine whether the instance is affected by malware.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!