Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

• A. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
• B. Customize the Close Case dialog and add the five DLP event types as root cause options.
• C. Customize the Case Name format to include the DLP event type.
• D. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.

During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

• A. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
• B. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
• C. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
• D. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.

You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?

• A. Create a case for each identified user with the user designated as the entity.
• B. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
• C. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
• D. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.

Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?

• A. Pull the firewall logs by using a Google SecOps feed integration.
• B. Set the Google SecOps URL instance as the Syslog destination.
• C. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
• D. Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

• A. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
• B. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
• C. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
• D. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.