Online Access Free Security-Operations-Engineer Exam Questions

You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps. What should you do?

• A.Initiate a SIEM Search to query the entity.
• B.Select View Details for the entity in the Entity Highlights widget.
• C.Initiate a SOAR Search to query the entity.
• D.Select the entity identifier in the Entity Highlights widget to open Entity Explorer.

You are implementing Google Security Operations (SecOps) for your organization. Your organization has their own threat intelligence feed that has been ingested to Google SecOps by using a native integration with a Malware Information Sharing Platform (MISP). You are working on the following detection rule to leverage the command and control (C2) indicators that were ingested into the entity graph.

What code should you add in the detection rule to filter for the domain IOCs?

• A.$ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "GLOBAL_CONTEXT"
• B.$ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
• C.$ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "SOURCE_TYPE_UNSPECIFIED"
• D.$ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "DERIVED_CONTEXT"

You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool.
You must recommend a tool to your leadership team as quickly as possible. What should you do?
(Choose two.)

• A.Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
• B.Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.
• C.Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
• D.Review the architecture of the tool to identify the cloud provider that hosts the tool.
• E.Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.

You are the lead engineer on your organization's incident response team. You are running CrowdStrike Falcon and SentinelOne to protect the Windows devices in different regions of your organization. You are ingesting the following logs into Google Security Operations (SecOps):
- Azure AD Directory Audit (AZURE_AD_AUDIT)
- Crowdstrike Falcon (CS_EDR)
- Microsoft Sysmon (WINDOWS_SYSMON)
- SentinelOne (SENTINEL_EDR)
- Windows Event (WINEVTLOG)
You notice that a high volume of ransomware incidents are impacting your team's SLAs. You need to automate the response to ransomware on Windows devices. How should you automate the detection and containment of ransomware incidents? (Choose two.)

• A.Enable the Risk Analytics for User and Endpoint Behavioral Analytics (UEBA) category in curated detections to detect peer group-based anomalous behavior and suspicious actions.
• B.Install a SOAR remote agent on each Windows device for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
• C.Enable the Windows Threats category in curated detections to detect the latest Windows threats.
• D.Install SOAR EDR integrations for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
• E.Install SOAR EDR jobs to execute remote endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift. This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?

• A.Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.
• B.Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.
• C.Enable and enforce the constraints/compute.vmExternalIpAccess organization policy constraint at the project level for the project where the VM resides.
• D.Navigate to the underlying Security Health Analytics (SHA) finding for PUBLIC_IP_ADDRESSon the VM, and mark this finding as fixed.