Google : Security-Operations-Engineer Questions & Answers

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

• A. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
• B. Modify the detection rule in the SIEM to include the query results as part of the detection.
• C. Add an action to the playbook that runs the SIEM query and returns the results.
• D. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.

You are creating a playbook for the SOC. The SOC requires that each Google Security Operations (SecOps) role sees different information for the alert that the playbook runs on. You need to ensure that the playbook presents the relevant information for each Google SecOps role.
What should you do?

• A. Add the Add General insight action to the playbook for each Google SecOps role.
• B. Add a view to the playbook for each Google SecOps role.
• C. Add the Create Siemplify Task action to the playbook to assign a task to each Google SecOps role.
• D. Add the Case Comment action to the playbook for each Google SecOps role.

Your company is taking a more proactive approach to security. You want to generate an alert when a binary hash first appears in your environment. What should you do?

• A. Create a table by using the Google Security Operations (SecOps) statistics in search to examine file-related events for the current day. Verify that the first_seen_time value predates the current day.
• B. Navigate to the Alerts & IOCs page in Google Security Operations (SecOps). Create a filter that targets hashes and specifies a first_seen_time value excluding the current date.
• C. Enable the Applied Threat Intelligence - Curated Prioritization rule set in curated detections.
• D. Write a rule to examine file-related events that join with derived context for hashes in the entity graph. Compare the timestamp of the hash with the first_seen_time field.

You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise. Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI).
You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time. What should you do?

• A. Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.
• B. Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.
• C. Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.
• D. Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.

Your company's SOC recently responded to a ransomware incident that began with the execution of a malicious document. EDR tools contained the initial infection. However, multiple privileged service accounts continued to exhibit anomalous behavior, including credential dumping and scheduled task creation. You need to design an automated playbook in Google Security Operations (SecOps) SOAR to minimize dwell time and accelerate containment for future similar attacks. Which action should you take in your Google SecOps SOAR playbook to support containment and escalation?

• A. Add a YARA-L rule that sends an alert when a document is executed using a scripting engine such as wscript.exe.
• B. Configure a step that revokes OAuth tokens and suspends sessions for high-privilege accounts based on entity risk.
• C. Create an external API call to VirusTotal to submit hashes from forensic artifacts.
• D. Add an approval step that requires an analyst to validate the alert before executing a containment action.