5.1 Containing and Investigating Security Incidents PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a key outcome of effective collaboration between security and engineering teams during incident response?

   • AImmediate deletion of all logs to prevent further exposure
   • BImplementation of long-term remediation strategies to prevent recurrence
   • CGuaranteed prevention of all future security incidents
   • DTransfer of all security responsibilities to the engineering team
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is investigating a data exfiltration incident. They have identified a set of suspicious API calls in Cloud Audit Logs. The team needs to determine the full scope of the exfiltration, including which data was accessed and whether the attacker used multiple accounts. They have access to BigQuery and Google SecOps. What is the most efficient approach?

   • AContact the cloud provider to request a full export of all logs.
   • BUse Google SecOps to create a detection rule for the suspicious API calls.
   • CUse BigQuery to query the audit logs for all API calls from the suspicious IP addresses and correlate with user accounts.
   • DManually review each audit log entry in Logs Explorer.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an incident investigation, the security team discovers that a vulnerability in a custom application was exploited. The application team is responsible for the code. The security team needs to ensure that the vulnerability is fixed and that the detection is improved. What should the security team do?

   • AAsk the application team to rewrite the application from scratch.
   • BProvide the application team with the root cause analysis and work with them to implement a patch and add detection rules.
   • CFile a ticket with the application team and wait for them to respond.
   • DDisable the application until the team fixes it.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which Google Cloud security tool can be used to perform root cause analysis by correlating security findings and logs?

   • ACloud Functions
   • BCloud Storage
   • CCloud DNS
   • DGoogle SecOps SIEM
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident investigation, the security team identifies a suspicious binary on a compromised VM. They also have the hash of the binary and a network connection to an external IP. What is the most effective way to determine if this binary is known malware?

   • ADisassemble the binary to analyze its code.
   • BCheck the binary's file size and creation time.
   • CRun the binary in a sandbox and observe its behavior.
   • DSearch Google SecOps for the hash and the IP address in threat intelligence feeds.
   Reveal Solution Discussion Select an answer first