Security-Operations-Engineer Practice Questions

A.  

Ingest AD organizational context data as user/asset context to enrich user/asset information in your security events.

B.  

Configure a Google SecOps SOAR integration for AD to enrich user/asset information in your security alerts.

C.  

Create a data table that contains AD context data. Use the data table in your YARA-L rule to find user/asset data that can be correlated within each security event.

D.  

Create a data table that contains the AD context data. Use the data table in your YARA-L rule to find user/asset information for each security event.

A.  

$ioc.graph.metadata.entity_type = MDOMAlN_NAME"

$ioc.graph.metadata.scurce_type = "ElfelTYj^ONTEXT"

B.  

$ioc.graph.metadata.entity_type = "DOMAlN_NAME"

Sioc.graph.metadata.source_type = "GLOBAL_CONTEXT"

C.  

$ioc.graph.metadata.entity_type = "D0MAIN_NAME"

$ioc.graph.metadata.source_type = MDERIVED_CONTEXT"

D.  

$ioc.graph.metadata.entity_type = ,'D0MAIN_NAME*'

$ioc.graph.metadata.source type = "source type unspecified"

A.  

Manually mark the findings as inactive.

B.  

Disable Event Threat Detection (ETD)

C.  

Create a mute rule for the finding.

D.  

Disable the Security Health Analytics detector (SHA).

A.  

Employ attack path simulation with high-value resource sets to simulate potential lateral movement.

B.  

Navigate to the Asset Query tab, and join resources from the Cloud Asset Inventory resource table. Export the results to BigQuery for analysis.

C.  

Create a Bash script to iterate through various resource types using gcloud CLI commands, and export a CSV file. Load this data into BigQuery for analysis.

D.  

Use the Cloud Asset Inventory relationship table, and ingest the data into Spanner Graph.

A.  

Search for the external IP address in the Alerts & IoCs page in Google SecOps.

B.  

Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.

C.  

Examine the Google SecOps Asset view details for the production VM.

D.  

Create a new detection rule to alert on future traffic from the external IP address.

A.  

Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

B.  

Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.

C.  

Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.

D.  

Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

A.  

Ingest logs from Microsoft Entra I

D.  

B.  

Ingest logs from Windows Procmon.

C.  

Ingest logs from Windows PowerShell.

D.  

Ingest logs from Windows Sysmon.

A.  

Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.

B.  

Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.

C.  

Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.

D.  

Create a case for each identified user with the user designated as the entity.

A.  

Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time-to-live values.

B.  

Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.

C.  

Store the flagged users in a data table column with their corresponding time-to-live values in a second column. Use row-based comparisons in the detection rule.

D.  

Create a regex data table to store each user and the corresponding time-to-live value in a single row, pipe-delimited, and use an "in" keyword in your detection rule.

A.  

Use Gemini to generate a playbook based on a template from a standard incident response plan, and implement automated scripts to filter network traffic based on known malicious IP addresses.

B.  

Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.

C.  

Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.

D.  

Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.