Google GCP-SOE-B Value Pack (Frequently Bought Together)

You work for a telecommunications company that wants to monitor their multi-region 5G network logs in Google Security Operations (SecOps). The logs are currently only available on- premises and are stored in a standalone network-attached storage (NAS) located in four different regions.
You need to ingest the logs into Google SecOps and tag each NAS as a specific log source to avoid IP address aliasing. What should you do?

• A. Configure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source.
• B. Configure a Bindplane agent that collects Syslog from each log's location, and configure a namespace for each log source.
• C. Configure feed management to pull data from each log's location, and configure a namespace for each log source.
• D. Configure feed management to pull data from each log's location, and configure an ingestion label for each log source.

You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?

• A. Create a parser extension to correct the time zone.
• B. Create a custom parser to correct the time zone.
• C. Modify the UI settings to correct the time zone.
• D. Modify the default parser and include a default time zone.

Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting dat a. You need to minimize the cost of these configurations.
What should you do?

• A. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.
• B. Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• C. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• D. Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?

• A. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
• B. Use the UDM lookup feature to identify relevant process- related UDM fields and values.
• C. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
• D. Run a UDM search, and review aggregations for relevant process-related UDM fields.

You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?

• A. In Google SecOps SOAR settings, create a new environment for each customer.
• B. In Google SecOps SOAR settings, create a role for each customer.
• C. In Google SecOps SOAR settings, create a permissions group for each customer.
• D. In Google SecOps Playbooks, create a playbook for each customer.