Prep and try our GCP-SOE-B valid and latest training questions & answers

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• B. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
• C. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
• D. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
• B. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• C. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
• D. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• E. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

• A. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
• B. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
• C. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
• D. Generate a report in SOAR Reports, and schedule delivery of the report.

A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?

• A. Increase alert thresholds globally
• B. Disable medium-severity rules
• C. Limit alerts to business hours
• D. Apply risk-based alert scoring and entity correlation

You are an incident responder at your organization using Google Security Operations (SecOps) for monitonng and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?

• A. Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.
• B. Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
• C. Deploy emergency patches, and reboot the server to remove malicious persistence.
• D. Use the EDR integration to quarantine the compromised asset.