Pay attention on Pass-king Security-Operations-Engineer Practice Materials, clear exam 100% for sure

Your organization has mission-critical production Compute Engine VMS that you monitor daily.
While performing a UDM search in Google Security Operations (SecOps), you discover several outbound network connections from one of the production VMs to an unfamiliar external IP address occurring over the last 48 hours. You need to use Google SecOps to quickly gather more context and assess the reputation of the external IP address. What should you do?

• A. Examine the Google SecOps Asset view details for the production VM.
• B. Create a new detection rule to alert on future traffic from the external IP address.
• C. Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.
• D. Search for the external IP address in the Alerts & IOCs page in Google SecOps.

You are developing a security strategy for your organization. You are planning to use Google Security Operations (SecOps) and Google Threat Intelligence (GTI). You need to enhance the detection and response across multi-cloud and on-premises systems. How should you integrate these products? (Choose two.)

• A. Ingest GTI IOCs into Google SecOps as security events.
• B. Use Google SecOps SOAR integrations with GTI for event enrichment.
• C. Ingest on-premises and cloud security logs into Google SecOps SIEM as events.
• D. Use Google SecOps SOAR integrations with GTI for entity enrichment.
• E. Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.

You are using a Google-managed image on a Compute Engine instance in Google Cloud to run an application. You need to ingest the application's log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time required to move this data into Google SecOps. What should you do?

• A. Use the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging.
  Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.
• B. Create a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.
• C. Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.
• D. Use the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
• B. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
• C. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• D. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.

You are the lead engineer on your organization's incident response team. You are running CrowdStrike Falcon and SentinelOne to protect the Windows devices in different regions of your organization. You are ingesting the following logs into Google Security Operations (SecOps):
- Azure AD Directory Audit (AZURE_AD_AUDIT)
- Crowdstrike Falcon (CS_EDR)
- Microsoft Sysmon (WINDOWS_SYSMON)
- SentinelOne (SENTINEL_EDR)
- Windows Event (WINEVTLOG)
You notice that a high volume of ransomware incidents are impacting your team's SLAs. You need to automate the response to ransomware on Windows devices. How should you automate the detection and containment of ransomware incidents? (Choose two.)

• A. Install SOAR EDR integrations for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
• B. Enable the Risk Analytics for User and Endpoint Behavioral Analytics (UEBA) category in curated detections to detect peer group-based anomalous behavior and suspicious actions.
• C. Enable the Windows Threats category in curated detections to detect the latest Windows threats.
• D. Install a SOAR remote agent on each Windows device for endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.
• E. Install SOAR EDR jobs to execute remote endpoint containment actions. Create a playbook to contain impacted Windows devices based on curated detections.