You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Your organization recently faced a cybersecurity breach. You need to increase the threat analytics as quickly as possible. What should you do?
Answer(s): A
The fastest way to increase threat analytics in Google SecOps after a breach is to enable curated detections.These are prebuilt, continuously updated detection rules maintained by Google that provide immediate coverage against a wide range of threats, requiring no custom development and delivering quick improvements in visibility and response.
You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:A SHA256 hash for a malicious DLLA known command and control (C2) domainA behavior pattern where rundll32.exe spawns powershell.exe with obfuscated argumentsYour Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?
Since process hashes are not consistently available across all endpoints, relying solely on the DLL hash would miss activity. The best solution is to write a multi-event YARA-L detection rule that correlates the process relationship (rundll32.exe spawning powershell.exe with obfuscated arguments) together with the C2 domain and hash when available, and run a retrohunt. This approach detects both behavior-based and IOC-based indicators, ensuring coverage even when hashes are missing.
You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:Receive a notification when data sources go silent within 15 minutes.Visualize ingestion throughput and parsing errors.What should you do?
Answer(s): B
The correct approach is to configure silent source notifications for SecOps collection agents in Cloud Monitoring so that you are alerted if data sources go silent within 15 minutes. Then, create a Cloud Monitoring dashboard to visualize ingestion throughput and parsing errors. This leverages native monitoring for Bindplane agents and provides real-time visibility into ingestion health.
Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process and integrate with the existing SOW ticketing system. How should you implement this functionality?
Answer(s): C
The correct solution is to configure the SCC notifications feed to Pub/Sub and then use a Cloud Run function triggered by new events in the topic to call the SOC ticketing system's API. This automates ticket creation for findings, integrates seamlessly with the existing SOC process, and minimizes manual intervention while ensuring timely response.
You are creating a playbook for the SOC. The SOC requires that each Google Security Operations (SecOps) role sees different information for the alert that the playbook runs on. You need to ensure that the playbook presents the relevant information for each Google SecOps role. What should you do?
The correct approach is to add a view to the playbook for each Google SecOps role. Views allow you to control what information is displayed based on the role, ensuring that each SOC role only sees the relevant details for their responsibilities during alert handling.
Post your Comments and Discuss Google Security-Operations-Engineer exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Security-Operations-Engineer content, but please register or login to continue.