Free Google Security-Operations-Engineer Exam Dumps Questions & Answers

You are configuring a new integration in Google Security Operations (SecOps) to perform enrichment actions in playbooks. This enrichment technology is located in a private data center that does not allow inbound network connections. You need to connect your Google SecOps instance to the integration. What should you do?

• A.Create a remote agent in the private data center. Configure an instance of the integration to run on a remote agent in Google SecOps.
• B.Create a network route in Google Cloud to the private data center.
• C.Create a forwarder in the private data center. Configure an instance of the integration to run on the forwarder.
• D.Query the enrichment source in the private data center and upload the results to the case wall in Google SecOps.

Your Google Security Operations (SecOps) instance is generating alerts for unusual login times from multiple user accounts. Your SOC analysts are reporting a high number of the alerts are false positives involving service accounts used by scheduled automation tasks. You want to refine the detection logic using entity-level context available in Google SecOps. You want to use the most effective approach. What should you do?

• A.Use asset tags to group known automation systems, and exclude them from the alert logic.
• B.Add a reference list of all service accounts, and suppress alerts for any matches on the principal.user.email field.
• C.Update the rule to only alert when the principal.user.email and principal.user.userid fields match in the same event.
• D.Modify the rule to include the principal.user.type != "service_account" condition.

Which approach BEST improves detection of compromised service accounts in Google Cloud?

• A.Alerting on login failures only
• B.Disabling all service accounts
• C.Baseline service account behavior and alert on deviations
• D.Monitoring VM uptime

A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?

• A.Increase alert thresholds globally
• B.Disable medium-severity rules
• C.Apply risk-based alert scoring and entity correlation
• D.Limit alerts to business hours

You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group. What should you do?

• A.Upload the malware to Google Threat Intelligence by using Private Scanning.
• B.Search for the threat group in Google Threat Intelligence.
• C.Calculate the file checksum for the malware, and search for the checksum in GoogleThreat Intelligence by using VirusTotal.
• D.Upload the malware to Google Threat Intelligence by using VirusTotal.