Pass exam with Security-Operations-Engineer Top Exam Collection for sure one-shot

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

• A. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
• B. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
• C. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
• D. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
• E. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.

An organization detects a successful login to a Google Cloud IAM user from an unfamiliar country, followed by the creation of multiple new service account keys within minutes. No malware alerts are triggered. What is the MOST appropriate immediate action?

• A. Wait for evidence of data access
• B. Revoke active credentials, disable the compromised identity, and initiate an incident response
• C. Rotate only the affected user's password
• D. Disable the service accounts and continue monitorin

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

• A. Implement the control framework using Rego, and deploy this framework in Workload Manager.
  Schedule a regular report in Workload Manager.
• B. Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
• C. Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery.
  Schedule this report to run regularly.
• D. Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.

You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?

• A. Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.
• B. Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.
• C. Create a Google SecOps SOAR dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.
• D. Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

• A. Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
• B. Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
• C. Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.
• D. Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.