Question 1

You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red
team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IoCs that you suspect were generated due to the
exercise. What should you do?

Accepted Answer

Correct answer: C

Question 2

You manage a large fleet of Compute Engine instances. Security Command Center (SCC) has generated a large number of
CONFIDENTIAL_COMPUTING_DISABLED findings. You need to quickly tune these findings.
What should you do?

Accepted Answer

Correct answer: C

Question 3

You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data
exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

Accepted Answer

Correct answer: A

Question 4

You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google Security Operations (SecOps). You previously manually
exported context data from Active Directory (AD) and imported the data into your previous SIEM as a watchlist when there were changes in AD's user/asset
context data. You want to improve this process using Google SecOps. What should you do?

Accepted Answer

Correct answer: A

Question 5

You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IoCs and
would like to include external signals for this capability to ensure broad detection coverage. What should you do?

Accepted Answer

Correct answer: C

Question 6

You have a custom-built YARA-L rule in Google Security Operations (SecOps) correlating observed IP addresses in network and EDR logs against threat
intelligence findings ingested from a Malware Information Sharing Platform (MISP) over a 2-minute time window. Your company's SOC reported that the rule
generates too many false positives. You want to reduce the number of false positives generated by the rule while continuing to use threat intelligence.
What should you do?

Accepted Answer

Correct answer: B

Question 7

Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's
SOC. You want to automate the response process within SCCE and integrate with the existing SOC ticketing system. You want to use the most efficient solution.
How should you implement this functionality?

Accepted Answer

Correct answer: C

Question 8

You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture
time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?

Accepted Answer

Correct answer: B

Question 9

You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident
response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon
as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should
you do?

Accepted Answer

Correct answer: C

Question 10

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want
to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you
do?

Accepted Answer

Correct answer: D