4.1 Developing and Implementing Mechanisms to Detect Risks and Identify Threats PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A detection engineer wants to create rules that detect changes in the security posture or risk profile of the environment. Which Google Cloud service provides Security Health Analytics for this purpose?

   • ACloud Logging
   • BSecurity Command Center (SCC)
   • CCloud Monitoring
   • DGoogle SecOps SIEM
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing a YARA-L rule that flags any user who logs in from two different countries within a one-hour window. The rule has generated several alerts, but the analyst suspects they are false positives because the users might be using a VPN. What is the best way to refine the rule to reduce these false positives?

   • AAdd a condition to the rule that excludes logins from known VPN egress IP addresses using a reference list.
   • BRemove the rule and rely on manual review of all login logs.
   • CUse the entity graph to check if the user has a history of traveling between those two countries.
   • DIncrease the time window from one hour to 24 hours.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations team ingests a commercial threat intelligence feed that lists a newly observed command-and-control (C2) domain. The team wants to detect any internal host that has attempted to resolve this domain over the past 30 days. The DNS logs are stored in Google SecOps. Which approach should the team use to identify affected hosts?

   • ACreate a dashboard that displays all DNS queries from the last 30 days and manually review the list for the C2 domain.
   • BUse the entity graph to find all assets that have ever communicated with any external domain and export the list.
   • CConfigure a Security Command Center Event Threat Detection custom detector to block DNS queries to the C2 domain.
   • DCreate a YARA-L rule that matches DNS log events against the C2 domain string and run it as a retro search for the last 30 days.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security analyst wants to identify potential threats by matching indicators from an external threat intelligence feed against the organization's own activity logs. Which activity best describes this process?

   • AThreat intelligence reconciliation
   • BRisk scoring
   • CLog retention management
   • DAnomaly detection
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of assigning risk values to detections in Google SecOps?

   • ATo replace the need for human analysts
   • BTo ensure all detections are equally important
   • CTo automatically delete low-risk logs
   • DTo help prioritize which detections need immediate attention
   Reveal Solution Discussion Select an answer first