Study with Google : Security-Operations-Engineer Exam Torrent as your best preparation materials

You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?

• A. Perform a UDM search for login events, and pivot to group results by user and country of origin.
• B. Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.
• C. Run a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
• D. Perform a YARA-L 2.0 search for login events and their associated principal.location.country field.
  Use an outcome field to aggregate the number of failed logins.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
• B. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• C. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
• D. Add an exception in the detection rule to exclude matches originating from specific asset groups.

You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions:
- Send an email to users who do not have a Google Security Operations (SecOps) account to request approval for endpoint containment
- Automatically continue executing its logic after the user responds
You plan to implement this process in the playbook by using the Gmail integration. You want to minimize the amount of effort required by the SOC analyst. What should you do?

• A. Set the containment action to 'Manual' and assign the action to the user to execute or skip the containment action.
• B. Use the 'Send Email' action to send an email requesting approval to contain the endpoint, and use the 'Wait For Thread Reply' action to receive the result. The analyst manually contains the endpoint.
• C. Set the containment action to 'Manual' and assign the action to the appropriate tier. Contact the user by email to request approval. The analyst chooses to execute or skip the containment action.
• D. Generate an approval link for the containment action and include the placeholder in the body of the 'Send Email' action. Configure additional playbook logic to manage approved or denied containment actions.

You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?

• A. Implement middleware to modify the underlying data structure.
• B. Implement a parser extension on top of the prebuilt parser.
• C. Design and develop a custom parser.
• D. Apply any pending updates to the prebuilt parser.

You are a security analyst at an organization that uses Google Security Operations (SecOps).
Google SecOps triggered a medium severity alert of Unusual Cloud Storage Access - High Volume Download for [email protected] from the internal-project-code-repository bucket. This user is a senior developer within your organization who has legitimate access, but their download volume is unusually high and occurs outside working hours. You need to investigate this alert. What should you do first?

• A. Enrich the bucket entity with sensitivity labels and access control list (ACL) data.
• B. Run a Google SecOps SOAR playbook to suspend user1's bucket access, and review their user timeline.
• C. Create a default detection rule in Google SecOps to monitor future high-volume downloads from the bucket, and add user1 to a high-risk watchlist.
• D. Review user1's timeline in Google SecOps, focusing on network events and resource access immediately preceding the download anomaly.