Online Access Free Security-Operations-Engineer Practice Test

Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?

• A.Configure and deploy a Google SecOps forwarder.
• B.Configure and deploy a Bindplane collection agent.
• C.Configure a third-party API feed in Google SecOps.
• D.Configure direct ingestion from your Google Cloud organization.

You have discovered that a server that hosts an internal web application has been accidentally exposed to the internet for 48 hours. Logging is enabled on the server. You want to use Google Security Operations (SecOps) to run a UDM search against the server logs to identify whether there have been any successful exploitations against it. What event field search should you use?

• A.Perform a search for network traffic where the principal is rarely seen by using the principal.ip UDM field.
• B.Perform a search for process launches and commands that are rarely seen by using the metadata.event_type UDM field.
• C.Perform a search for antimalware or endpoint security events by using the product_event_type UDM field.
• D.Perform a search for sign-on activity for user accounts that are not expected on the server by using the principal.user.userid UDM field.

Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead. What should you do?

• A.Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
• B.Use a VM to host a script that runs a playbook via an API call.
• C.Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.
• D.Create a Cron Scheduled Connector for this use case Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A.Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
• B.Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• C.Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
• D.Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.

You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into:
- User identity behavior
- Lateral movement
- Privilege escalation attempts
You need to determine which telemetry sources are ingested first. Which log source should you prioritize?

• A.Cloud access security broker (CASB) logs
• B.Network firewall logs
• C.EDR logs
• D.IAM logs