Google GCP-SOE-B Value Pack (Frequently Bought Together)

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

• A. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.
• B. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
• C. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
• D. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• B. Add an exception in the detection rule to exclude matches originating from specific asset groups.
• C. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
• D. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.

You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

• A. Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
• B. Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.
• C. Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
• D. Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.

After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

• A. Closing all related alerts
• B. Increasing log retention
• C. Updating detections, playbooks, and IAM controls based on lessons learned
• D. Adding more analysts

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

• A. Add an action to the playbook that runs the SIEM query and returns the results.
• B. Modify the detection rule in the SIEM to include the query results as part of the detection.
• C. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
• D. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.