Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ91

Incident response

You are a security analyst at an organization using Google Security Operations (SecOps). Google SecOps generated a medium-severity Unusual Cloud Storage Access - High Volume Download alert for [email protected] from the internal-project-code-repository bucket. This senior developer has legitimate access within your organization, but their download volume is unusually high and takes place outside working hours. You need to investigate this alert. What should you do first?

  • A Run a Google SecOps SOAR playbook to suspend user1's bucket access, and review their user timeline.
  • B Enrich the bucket entity with sensitivity labels and access control list (ACL) data.
  • C Create a default detection rule in Google SecOps to monitor future high-volume downloads from the bucket, and add user1 to a high-risk watchlist.
  • D Review user1's timeline in Google SecOps, focusing on network events and resource access immediately preceding the download anomaly.
Explanation

An anomalous download by a user with legitimate access should initially be triaged by correlating the user’s activity around the event. Examining network events and resource-access activity immediately before the download can establish whether the behavior is consistent with normal work or indicates account compromise or data exfiltration. Google SecOps investigation guidance recommends pivoting to an entity’s timeline to review historical context and correlated events before follow-up actions.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!