Google Security-Operations-Engineer Value Pack (Frequently Bought Together)

Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?

• A. Pull the firewall logs by using a Google SecOps feed integration.
• B. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
• C. Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
• D. Set the Google SecOps URL instance as the Syslog destination.

Your organization is a Google Security Operations (SecOps) customer. You use Google Threat Intelligence to identify cyber threats within your organization's threat profile. You believe your organization may have been targeted by a cyber crime group. You need to identify whether your organization has been the victim of an attack. What should you do?

• A. In the Vulnerability Intelligence feature, identify new high and critical vulnerabilities in products or technologies that your organization uses so they can be patched.
• B. Review the Threat Landscape feature to identify threat groups that are active in your industry, research their known MITRE ATT&CK tactics, techniques, and procedures (TTPs) and implement detection rules in Google SecOps.
• C. Implement monitors in the Digital Threat Monitoring feature to identify new compromised credentials, dark web mentions, or data leaks.
• D. In the Reports & Analysis feature, extract the IOCs from the recent reports, and implement detection rules and lists in Google SecOps to identify whether they are present in your organization's environment.

Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting data. You need to minimize the cost of these configurations.
What should you do?

• A. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.
• B. Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• C. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• D. Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.

You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group. What should you do?

• A. Upload the malware to Google Threat Intelligence by using VirusTotal.
• B. Search for the threat group in Google Threat Intelligence.
• C. Calculate the file checksum for the malware, and search for the checksum in GoogleThreat Intelligence by using VirusTotal.
• D. Upload the malware to Google Threat Intelligence by using Private Scanning.

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

• A. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
• B. Modify the detection rule in the SIEM to include the query results as part of the detection.
• C. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
• D. Add an action to the playbook that runs the SIEM query and returns the results.