Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ5

Data management

You manage the integration of Security Command Center (SCC) with downstream tooling. You need to retrieve security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You must configure the connection between SCC and Google SecOps. What should you do?

  • A Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
  • B Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.
  • C Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
  • D Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.
Explanation

Google SecOps SOAR provides a Google Security Command Center Marketplace integration and a Findings connector for retrieving SCC findings and using them in SOAR alerts and actions. The supported integration requires appropriate IAM-authorized service-account or Workload Identity access to SCC. Pub/Sub notification configurations are not the primary SOAR Marketplace-connector configuration described for pulling findings into SOAR.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!