Purchase Google : Security-Operations-Engineer Exam Materials and then pass exam easily

A security analyst wants to detect lateral movement between Compute Engine instances using valid credentials. Which data source is MOST useful?

• A. Cloud Load Balancer logs
• B. VPC Flow Logs
• C. Identity-aware Proxy logs
• D. Compute Engine serial console output

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process.
Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

• A. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
• B. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
• C. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
• D. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.

You are managing the integration of Security Command Center (SCC) with downstream tooling.
You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?

• A. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
• B. Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.
• C. Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
• D. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.

You have identified a common malware variant on a potentially infected computer. You need to find reliable IOCs and malware behaviors as quickly as possible to confirm whether the computer is infected and search for signs of infection on other computers. What should you do?

• A. Run a Google Web Search for the malware hash, and review the results.
• B. Search for the malware hash in Google Threat Intelligence, and review the results.
• C. Create a Compute Engine VM, and perform dynamic and static malware analysis.
• D. Perform a UDM search for the file checksum in Google Security Operations (SecOps). Review activities that are associated with, or attributed to the malware.

You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCs from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?

• A. Export the IOCs from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams.
• B. Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams.
• C. Create a list in Google Security Operations (SecOps), and grant the required access to the other teams.
• D. Create a new threat graph in Google Threat Intelligence, and share the graph with the other teams.