Google Security-Operations-Engineer Prüfungsfragen : Google Cloud Certified - Professional Security Operations Engineer (PSOE) Exam

You are developing a security strategy for your organization. You are planning to use Google Security Operations (SecOps) and Google Threat Intelligence (GTI). You need to enhance the detection and response across multi-cloud and on-premises systems. How should you integrate these products? (Choose two.)

• A. Ingest GTI IOCs into Google SecOps as security events.
• B. Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.
• C. Ingest on-premises and cloud security logs into Google SecOps SIEM as events.
• D. Use Google SecOps SOAR integrations with GTI for entity enrichment.
• E. Use Google SecOps SOAR integrations with GTI for event enrichment.

Your company's SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall installed and configured with credentials. You want to use the integration to trigger firewall rule changes directly from the Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve the requested changes prior to deployment.
How should you implement the workflow for analysts to trigger on demand?

• A. Create an email template for the analyst to get approval for the change from the system administrator. Have the analyst fill out the needed fields, and send the email for approval. Once approved, use a manual action to make the change to the firewall rule from any open case.
• B. Create a request in the Google SecOps SOAR settings that includes a field for the firewall rule.Create a playbook that is triggered by this request. Configure the playbook step that makes the firewall rule change to send an approval request from the system administrator. The approval request must include the parameter being changed.
• C. Create a playbook where the firewall rule change is a manual step, allowing the analyst to edit the firewall rule as a pending action. Have the analyst email the system administrator with the change. Once approved, the analyst lets the playbook continue.
• D. Create an account for the system administrator in your Google SecOps instance to allow the system administrator to make the changes from Google SecOps directly. Add an escalation step to enable the analyst to assign the case to the system administrator.

You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group. What should you do?

• A. Upload the malware to Google Threat Intelligence by using Private Scanning.
• B. Search for the threat group in Google Threat Intelligence.
• C. Calculate the file checksum for the malware, and search for the checksum in GoogleThreat Intelligence by using VirusTotal.
• D. Upload the malware to Google Threat Intelligence by using VirusTotal.

Your organization requires the SOC director to be notified by email of escalated incidents and their results before a case is closed. You need to create a process that automatically sends the email when an escalated case is closed. You need to ensure the email is reliably sent for the appropriate cases. What process should you use?

• A. Use the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director.
• B. Navigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director Use the Close Case action in the UI to close the case.
• C. Write a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director.
• D. Create a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email.

You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google Security Operations (SecOps). You previously manually exported context data from Active Directory (AD) and imported the data into your previous SIEM as a watchlist when there were changes in AD's user/asset context data. You want to improve this process using Google SecOps. What should you do?

• A. Ingest AD organizational context data as user/asset context to enrich user/asset information in your security events.
• B. Configure a Google SecOps SOAR integration for AD to enrich user/asset information in your security alerts.
• C. Create a data table that contains AD context data. Use the data table in your YARA-L rule to find user/asset data that can be correlated within each security event.
• D. Create a reference list that contains the AD context data. Use the reference list in your YARA-L rule to find user/asset information for each security event.