Google : GCP-SOE-B Questions & Answers

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

• A. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
• B. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
• C. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
• D. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.

During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

• A. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
• B. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
• C. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
• D. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.

You have identified a new threat actor group that has several IOCs in Google Threat Intelligence. You want to use some of these IOCs in several detection rules in Google Security Operations (SecOps) to help identify suspicious activity. You want to use the most effective approach. What should you do?

• A. Add the IOCs to a new or existing reference list, and update the YARA-L logic of detection rules to include the reference list.
• B. Identify the detection rules that apply to the new IOCS, and update the YARA-L logic to reference the threat actor group.
• C. Configure a new data feed in Google SecOps that includes the IOCS. Update the YARA-L logic to reference the new IOCS against applicable UDM fields.
• D. Save the IOCs in a new collection in Google Threat Intelligence. Share this list with other members of the security team to facilitate their searches and rule creation.

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

• A. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
• B. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.
• C. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
• D. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Add an exception in the detection rule to exclude matches originating from specific asset groups.
• B. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• C. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
• D. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.