Security-Operations-Engineer 무료 덤프문제 온라인 액세스

You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCs from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?

• A.Create a list in Google Security Operations (SecOps), and grant the required access to the other teams.
• B.Export the IOCs from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams.
• C.Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams.
• D.Create a new threat graph in Google Threat Intelligence, and share the graph with the other teams.

You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise. Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI).
You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time. What should you do?

• A.Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.
• B.Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.
• C.Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.
• D.Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on-premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

• A.Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
• B.Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
• C.Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
• D.Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.

You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?

• A.Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.
• B.Set a retention period for the BigQuery export.
• C.Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.
• D.Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.

A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?

• A.Apply risk-based alert scoring and entity correlation
• B.Increase alert thresholds globally
• C.Disable medium-severity rules
• D.Limit alerts to business hours