Your organization recently adopted Google Security Operations (SecOps), and has configured ingestion, parsing and rules for their log sources. The security operations team is currently triaging alerts one at a time using several external product dashboards with alerts and enrichment data. You want to use the case management functionality in Google SecOps to reduce the amount of pivoting between products your SOC analysts are required to do. You want to minimize development effort. What should you do first?

• A. Build a playbook for each detection rule to enrich and remediate alerts relative to the particular threat each rule is designed to detect.
• B. Build a playbook for each of the noisiest alert sources to gather additional context on the case from the source product.
• C. Build a job to periodically iterate over recent cases, determine relevant context, and enrich alerts.
• D. Build a low-priority, catch-all playbook for enrichment of entities in a case using threat intelligence sources.

Your company's SOC recently responded to a ransomware incident that began with the execution of a malicious document. EDR tools contained the initial infection. However, multiple privileged service accounts continued to exhibit anomalous behavior, including credential dumping and scheduled task creation. You need to design an automated playbook in Google Security Operations (SecOps) SOAR to minimize dwell time and accelerate containment for future similar attacks. Which action should you take in your Google SecOps SOAR playbook to support containment and escalation?

• A. Create an external API call to VirusTotal to submit hashes from forensic artifacts.
• B. Add an approval step that requires an analyst to validate the alert before executing a containment action.
• C. Add a YARA-L rule that sends an alert when a document is executed using a scripting engine such as wscript.exe.
• D. Configure a step that revokes OAuth tokens and suspends sessions for high-privilege accounts based on entity risk.

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
• B. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
• C. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• D. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• E. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

• A. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.
• B. Configure the Windows server to send an email notification if there is an error in the Bindplane process.
• C. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
• D. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?

• A. VPC Flow Logs
• B. Security Command Center Premium (SCCP) findings
• C. Cloud IDS logs
• D. Cloud Audit Logs