5.1 Containing and Investigating Security Incidents PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a primary benefit of using BigQuery for analyzing large volumes of Cloud Logging data during incident scope analysis?

   • AIt stores logs in a proprietary format that only Google can access
   • BIt allows running complex SQL queries over historical log data to identify affected systems
   • CIt automatically blocks malicious IP addresses
   • DIt provides real-time alerting on security findings
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is the primary purpose of hashing a forensic image immediately after acquisition?

   • ATo compress the image so it takes less storage space
   • BTo encrypt the image so that only authorized analysts can read it
   • CTo verify the integrity of the image and ensure it has not been altered
   • DTo identify the file system type of the acquired image
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of a forensic artifact that an analyst would analyze to understand an attack?

   • AA network diagram of the organization
   • BA suspicious URL observed in the logs
   • CA list of employee names
   • DThe organization's incident response policy
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An analyst is reviewing a security alert in Google SecOps (Chronicle). Which activity is most directly part of alert observation and analysis?

   • ACreating a new detection rule for future alerts
   • BPatching the vulnerable system that triggered the alert
   • CExamining the alert's associated events and entities to identify indicators of compromise
   • DDeleting the alert to reduce noise
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of performing root cause analysis after a security incident?

   • ATo identify the underlying cause of the incident to inform remediation
   • BTo assign blame to the responsible employee
   • CTo restore systems to their pre-incident state as quickly as possible
   • DTo delete all evidence of the incident
   Reveal Solution Discussion Select an answer first