What is the primary purpose of using a ticketing system as a notification mechanism in incident response?

To replace the need for any other communication

To automatically resolve incidents without human intervention

To provide a persistent record and track the status of required actions

To send real-time alerts to all employees

A security team is building a playbook for a new type of phishing attack that uses legitimate cloud storage services to host malware. The playbook must include steps to enrich the URL, block the URL, and notify the user. The team is debating which steps to automate. The incident response lead wants to minimize false positives while ensuring fast response. Which step should be automated?

Notifying the user that they clicked a malicious link

Enriching the URL with threat intelligence

Deciding whether the URL is malicious

Which integration would be MOST useful in a playbook that needs to automatically block a malicious IP address on the firewall?

A threat intelligence feed integration

A firewall or network security integration (e.g., Palo Alto, Cisco)

After a postmortem reveals a new attack pattern involving abuse of a cloud API, what is the FIRST step in designing a new playbook for this pattern?

Immediately automate all response steps to save time

Delete the existing playbook that covers similar attacks

Wait for the next incident to occur before designing the playbook

Document the specific indicators and response actions needed for the attack

A security team uses Google SecOps for orchestration. They notice that the playbook for phishing incidents stops after creating a ticket and does not automatically enrich the sender's domain. They want to improve the playbook. What should they do?

Add a step to query threat intelligence for the domain

Remove the ticketing step to simplify the playbook

Assign the enrichment task to a human analyst

Increase the frequency of playbook execution

Google CloudProfessional Security Operations Engineer

Domain 5Objective 2

5.2 Building, Implementing, and Using Response Playbooks PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Part of the Incident response domain, which accounts for 21% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

23questions here

5free pages

6concepts

21%of the exam

Questions 16–20

16foundation · easy
What is the primary purpose of using a ticketing system as a notification mechanism in incident response?
Select an answer first
17expert · hard
A security team is building a playbook for a new type of phishing attack that uses legitimate cloud storage services to host malware. The playbook must include steps to enrich the URL, block the URL, and notify the user. The team is debating which steps to automate. The incident response lead wants to minimize false positives while ensuring fast response. Which step should be automated?
Select an answer first
18foundation · easy
Which integration would be MOST useful in a playbook that needs to automatically block a malicious IP address on the firewall?
Select an answer first
19foundation · easy
After a postmortem reveals a new attack pattern involving abuse of a cloud API, what is the FIRST step in designing a new playbook for this pattern?
Select an answer first
20application · medium
A security team uses Google SecOps for orchestration. They notice that the playbook for phishing incidents stops after creating a ticket and does not automatically enrich the sender's domain. They want to improve the playbook. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.