Choose Security-Operations-Engineer most accurate study material

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

• A. Customize the Close Case dialog and add the five DLP event types as root cause options.
• B. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
• C. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
• D. Customize the Case Name format to include the DLP event type.

You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC). You want to follow the Google-recommended approach.
What should you do?

• A. Create a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories for IAM policy changes. When a change is detected identify the principal that made the change.
• B. Implement a Cloud Run function that is triggered by IAM policy changes within the project and sends an alert to SCC using the Security Command Center API.
• C. Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects when a specified principal calls a method against a resource.
• D. Configure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a custom dashboard in SCC to visualize the data.

After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

• A. Closing all related alerts
• B. Increasing log retention
• C. Updating detections, playbooks, and IAM controls based on lessons learned
• D. Adding more analysts

You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

• A. Remove user accounts that have repeated invalid login attempts.
• B. Enable default curated detections to automatically block suspicious IP addresses.
• C. Look for correlations across impacted users in the Risk Analytics dashboard.
• D. Use UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.

Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?

• A. Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
• B. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
• C. Set the Google SecOps URL instance as the Syslog destination.
• D. Pull the firewall logs by using a Google SecOps feed integration.