Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting dat a. You need to minimize the cost of these configurations.
What should you do?

• A. Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.
• B. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• C. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.
• D. Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

• A. Modify the detection rule in the SIEM to include the query results as part of the detection.
• B. Add an action to the playbook that runs the SIEM query and returns the results.
• C. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
• D. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?

• A. Ingest logs from Microsoft Entra I
• B. Ingest logs from Windows PowerShell.
• C. Ingest logs from Windows Sysmon.
• D. Ingest logs from Windows Procmon.

You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCS and would like to include external signals for this capability to ensure broad detection coverage. What should you do?

• A. Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
• B. Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
• C. Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
• D. Create a Security Health Analytics (SHA) custom module using the compute address resource.

A SOC team notices repeated outbound HTTPS connections from a Compute Engine instance to an external IP every 60 seconds. CPU usage is normal and no malware signatures trigger. What is the BEST next analytical step?

• A. Block the destination IP immediately
• B. Identify the process and service account generating the traffic
• C. Notify executive leadership
• D. Power off the instance