Online Access Free GCP-SOE-B Practice Test

You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?

• A.Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.
• B.Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.
• C.Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
• D.Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A.Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• B.Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
• C.Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
• D.Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• E.Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.

A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?

• A.Global IP addressing
• B.Encryption at rest
• C.High availability architecture
• D.Short-lived (ephemeral) resources

Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

• A.In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
• B.Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.
• C.Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
• D.Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

• A.Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
• B.Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
• C.Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
• D.Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.