Instantly download Security-Operations-Engineer updated real questions

You observe several distinct, low-severity suspicious activities associated with a single internal server. You determine that no single event is a high-confidence IOC. You need to create a solution that ensures ongoing and heightened scrutiny for this server. What should you do?

• A. Schedule a daily Google Security Operations (SecOps) report detailing all activity on this server.
• B. Create a case, isolate the server from the network, and escalate the case for forensic investigation.
• C. Add the server to a Google Security Operations (SecOps) watchlist, and monitor the watchlist closely for the next few weeks.
• D. Develop a YARA-L detection rule specific to this server.

You are a SOC manager, and your company recently migrated to Google Security Operations (SecOps). As the team grows, you want to monitor all audit logs related to data feeds in Google SecOps. What should you do?

• A. Enable Data Access and Admin Activity audit logs in Cloud Logging, and ingest those logs into Google SecOps SIEM.
• B. Ingest the Google SecOps audit logs into Google SecOps SIEM for monitoring.
• C. Monitor Google SecOps SOAR user activity logs for administrative activity.
• D. Configure the Cloud Logging filter to ingest audit logs related to data feeds into Google SecOps for monitoring.

You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCs and would like to include external signals for this capability to ensure broad detection coverage. What should you do?

• A. Create a Security Health Analytics (SHA) custom module using the compute address resource.
• B. Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
• C. Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
• D. Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.

You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes. What should you do?

• A. Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by setting it to live but not alerting. Run a YARA-L retrohunt from the rules dashboard.
• B. Develop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.
• C. Use Gemini in Google SecOps to develop the rule by providing a description of the parameters and conditions, and transfer the rule into the Rules Editor.
• D. Develop the rule in the Rules Editor, define the sections the rule logic, and test the rule using the test rule feature.

Your organization recently acquired a Google Security Operations (SecOps) Enterprise Plus license. Your organization is already ingesting Cloud Audit Logs, firewall logs, proxy logs and endpoint logs, but there are no threat intelligence feeds being ingested into your Google SecOps environment. You need to design and deploy a solution that alerts your team quickly if an IOC of an active breach is observed in your environment. What should you do?

• A. Write, enable, and configure alerting on a custom single-event rule.
• B. Enable and configure alerting for relevant curated detection rule sets.
• C. Create and schedule a dashboard to send periodic summaries of the active breach IOCs and their associated events.
• D. Write, enable, and configure alerting on a custom multi-event rule.