Instantly download GCP-SOE-B training test engine

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

• A. Use a conditional statement to determine whether to treat the URL as suspicious or benign.
• B. Pass the response back to the SIEM.
• C. Verify that the response is accurate by manually checking the URL in VirusTotal
• D. Use the number of detections from the response JSON in a conditional statement to set the severity.
• E. Create a widget that translates the JSON output to a severity score.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
• B. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• C. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
• D. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?

• A. Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.
• B. Write a YARA-L 2.0 detection rule that searches for events with the IP address.
• C. Run raw log searches using the IP address as a search term.
• D. On the Alerts & IOCS page, review results and entries where the IP address appears.

A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?

• A. Short-lived (ephemeral) resources
• B. High availability architecture
• C. Encryption at rest
• D. Global IP addressing

You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?

• A. Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data.
• B. Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.
• C. Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time.
• D. Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious.