GCP-SOE-B 무료 덤프문제 온라인 액세스

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A.Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
• B.Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• C.Add an exception in the detection rule to exclude matches originating from specific asset groups.
• D.Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.

You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

• A.Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.
• B.Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
• C.Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
• D.Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

• A.Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
• B.Customize the Case Name format to include the DLP event type.
• C.Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
• D.Customize the Close Case dialog and add the five DLP event types as root cause options.

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on- premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

• A.Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
• B.Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
• C.Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
• D.Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.

You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?

• A.Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.
• B.Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.
• C.Set a retention period for the BigQuery export.
• D.Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.