Google Security Operations Engineer (Beta) : GCP-SOE-B

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

• A. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
• B. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
• C. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
• D. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

• A. Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
• B. Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.
• C. In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
• D. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.

After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

• A. Increasing log retention
• B. Adding more analysts
• C. Closing all related alerts
• D. Updating detections, playbooks, and IAM controls based on lessons learned

You observe several distinct, low-severity suspicious activities associated with a single internal server. You determine that no single event is a high-confidence IO You need to create a solution that ensures ongoing and heightened scrutiny for this server. What should you do?

• A. Schedule a daily Google Security Operations (SecOps) report detailing all activity on this server.
• B. Develop a YARA-L detection rule specific to this server.
• C. Add the server to a Google Security Operations (SecOps) watchlist, and monitor the watchlist closely for the next few weeks.
• D. Create a case, isolate the server from the network, and escalate the case for forensic investigation.

You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

• A. Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.
• B. Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable
• C. Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
• D. Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.