Study with Google : GCP-SOE-B Exam Torrent as your best preparation materials

You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool.
You must recommend a tool to your leadership team as quickly as possible. What should you do? (Choose two.)

• A. Review the architecture of the tool to identify the cloud provider that hosts the tool.
• B. Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
• C. Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
• D. Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.
• E. Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.

Your Google Security Operations (SecOps) SOAR integration with Security Command Center (SCC) uses a service account that currently has read access to the findings at the organization level. Google SecOps SOAR successfully reads SCC finding data, but actions attempting to update the finding states consistently fail with a permission denied error. You need to resolve this error while following the principle of least privilege. What should you do?

• A. Grant the service account the roles/securitycenter.findings Editor IAM role at the organization level.
• B. Grant the service account the roles/iam.serviceAccountUser IAM role to itself.
• C. Regenerate the service account key, and update the credentials in Google SecOps SOAR.
• D. Grant the service account the roles/securitycenter.findingsBulkMuteEditor IAM role at the organization level.

You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Your organization recently faced a cybersecurity breach. You need to increase the threat analytics as quickly as possible. What should you do?

• A. Design YARA-L detection rules based on Google SecOps Marketplace use cases.
• B. Develop YARA-L detection rules that focus on threat intelligence.
• C. Ingest data from a threat intelligence platform (TIP) into Google SecOps.
• D. Enable curated detections to identify threats.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
• B. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• C. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
• D. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

• A. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
• B. Configure the Windows server to send an email notification if there is an error in the Bindplane process.
• C. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
• D. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.