Study with GCP-SOE-B Actual Test Questions

Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting dat a. You need to minimize the cost of these configurations.
What should you do?

• A. Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• B. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• C. Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.
• D. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.

You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC). You want to follow the Google-recommended approach.
What should you do?

• A. Create a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories for IAM policy changes. When a change is detected identify the principal that made the change.
• B. Implement a Cloud Run function that is triggered by IAM policy changes within the project and sends an alert to SCC using the Security Command Center API.
• C. Configure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a custom dashboard in SCC to visualize the data.
• D. Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects when a specified principal calls a method against a resource.

Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

• A. Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
• B. Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.
• C. In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
• D. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.

You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?

• A. Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
• B. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.
• C. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
• D. Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
• B. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• C. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
• D. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.