Prep and try our Security-Operations-Engineer valid and latest training questions & answers

You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCs and would like to include external signals for this capability to ensure broad detection coverage. What should you do?

• A. Create a Security Health Analytics (SHA) custom module using the compute address resource.
• B. Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
• C. Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
• D. Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.

Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?

• A. Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
• B. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
• C. Pull the firewall logs by using a Google SecOps feed integration.
• D. Set the Google SecOps URL instance as the Syslog destination.

Your Google Security Operations (SecOps) instance is generating alerts for unusual login times from multiple user accounts. Your SOC analysts are reporting a high number of the alerts are false positives involving service accounts used by scheduled automation tasks. You want to refine the detection logic using entity-level context available in Google SecOps. You want to use the most effective approach. What should you do?

• A. Use asset tags to group known automation systems, and exclude them from the alert logic.
• B. Add a reference list of all service accounts, and suppress alerts for any matches on the principal.user.email field.
• C. Update the rule to only alert when the principal.user.email and principal.user.userid fields match in the same event.
• D. Modify the rule to include the principal.user.type != "service_account" condition.

You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise. Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI).
You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time. What should you do?

• A. Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.
• B. Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.
• C. Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.
• D. Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.

You are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization's environment. Alerts in Google SecOps indicate repeated PowerShell activity on a set of endpoints. Outbound connections are made to a domain that does not appear in your threat intelligence feeds. The activity occurs across multiple systems and user accounts. You need to search across impacted systems and user identities to identify the malicious user and understand the scope of the compromise. What should you do?

• A. Perform a YARA-L 2.0 search to correlate activity across impacted systems and users.
• B. Perform a raw log search for the suspicious domain string, and manually pivot to related user activity.
• C. Use the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
• D. Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.