Google Security Operations Engineer (Beta) : GCP-SOE-B

You are an incident responder at your organization using Google Security Operations (SecOps) for monitonng and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?

• A. Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
• B. Deploy emergency patches, and reboot the server to remove malicious persistence.
• C. Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.
• D. Use the EDR integration to quarantine the compromised asset.

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
• B. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
• C. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• D. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.

An organization detects a successful login to a Google Cloud IAM user from an unfamiliar country, followed by the creation of multiple new service account keys within minutes. No malware alerts are triggered. What is the MOST appropriate immediate action?

• A. Rotate only the affected user's password
• B. Revoke active credentials, disable the compromised identity, and initiate an incident response
• C. Wait for evidence of data access
• D. Disable the service accounts and continue monitorin

You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)

• A. Group events by user identity and time to identify repeated access patterns.
• B. Filter for events using protocol-level attributes that indicate RDP connections.
• C. Use a saved search to identify all events with the LATERAL MOVEMENT tag over the past 30 days.
• D. Correlate events based on the asset role or classification such as database or user workstation.
• E. Filter for RDP connections with non-standard ports.

You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?

• A. Create a parser extension to correct the time zone.
• B. Create a custom parser to correct the time zone.
• C. Modify the default parser and include a default time zone.
• D. Modify the UI settings to correct the time zone.