Google GCP-SOE-B valid study dumps : Security Operations Engineer (Beta)

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?

• A. Ingest logs from Microsoft Entra I
• B. Ingest logs from Windows Sysmon.
• C. Ingest logs from Windows Procmon.
• D. Ingest logs from Windows PowerShell.

You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?

• A. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
• B. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
• C. Create a case for each identified user with the user designated as the entity.
• D. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?

• A. Run a UDM search, and review aggregations for relevant process-related UDM fields.
• B. Use the UDM lookup feature to identify relevant process- related UDM fields and values.
• C. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
• D. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

• A. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
• B. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
• C. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
• D. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
• E. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

• A. Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
• B. Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
• C. Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
• D. Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.