Free Google Security-Operations-Engineer Exam Dumps Questions & Answers

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A.Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• B.Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
• C.Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
• D.Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
• E.Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.

You are a security engineer at a financial technology company. You need to create a centralized dashboard to provide security posture visibility for your leadership team. The dashboard must meet these requirements:
- Provide insights from Security Command Center (SCC) findings and security-related events captured in Cloud Logging.
- Support large volumes of historical data.
- Be able to join SCC findings and audit logs.
You want to use the most effective visualization solution that uses Google Cloud managed services. What should you do?

• A.Create custom metrics in Cloud Monitoring based on the SCC findings, and configure log-based metrics for security-related events. Build Cloud Monitoring dashboards to visualize these custom and log-based metrics.
• B.Use the built-in SCC dashboard to visualize the SCC finding, and extract log counts for specific log events from Cloud Audit Logs.
• C.Ingest the SCC findings and Cloud Audit Logs into a Cloud Storage bucket. Write a Python script that reads the data and uses Matplotlib to create the visualizations.
• D.Export SCC findings and Cloud Audit Logs to BigQuery. Connect Looker Studio to the BigQuery datasets, and create the visualizations and filters.

You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps. What should you do?

• A.Select the entity identifier in the Entity Highlights widget to open Entity Explorer.
• B.Initiate a SIEM Search to query the entity.
• C.Initiate a SOAR Search to query the entity.
• D.Select View Details for the entity in the Entity Highlights widget.

Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead. What should you do?

• A.Create a Cron Scheduled Connector for this use case Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.
• B.Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
• C.Use a VM to host a script that runs a playbook via an API call.
• D.Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A.Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• B.Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
• C.Add an exception in the detection rule to exclude matches originating from specific asset groups.
• D.Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.