4.1 Developing and Implementing Mechanisms to Detect Risks and Identify Threats PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations team has enabled Google SecOps Risk Analytics. They notice that a service account is receiving a high risk score due to repeated failed login attempts from a new IP address. The team wants to understand why this account is being flagged and what behavior is contributing to the score. What should they do?

   • ACheck the entity graph to see if the service account is related to any other high-risk assets.
   • BOpen the Risk Analytics dashboard and drill down into the specific asset to see the contributing events and the risk score breakdown.
   • CCreate a new YARA-L rule that alerts on any failed login attempt from a new IP address.
   • DRun a search for all events from the new IP address in the last 24 hours.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of configuring custom detectors in SCC Event Threat Detection?

   • ATo automatically patch vulnerabilities
   • BTo detect specific indicators of compromise that are relevant to the organization
   • CTo replace the need for Security Health Analytics
   • DTo reduce the number of security tools
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security analyst wants to identify new or low prevalence processes, domains, and IP addresses that are not in threat intelligence sources. Which method is commonly used for this?

   • AYARA-L rules and dashboards
   • BPosture management
   • CRisk analytics
   • DThreat intelligence reconciliation
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team has a detection rule that alerts when a user accesses a sensitive database. The rule is generating false positives because some users legitimately access the database as part of their job. The team wants to use the entity graph to reduce false positives by only alerting when the user's role does not require database access. However, the entity graph data is not always up to date. What is the best approach to handle this?

   • ARely solely on the entity graph data and only alert if the user's role does not require database access.
   • BIncrease the sensitivity of the rule to alert on any database access, regardless of role.
   • CUse the entity graph data in the rule, but also include a fallback condition that alerts if the user's role is unknown.
   • DRemove the rule and rely on manual review of all database access logs.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of using detection rules and searches across timelines?

   • ATo reduce log storage costs
   • BTo assess suspicious behavior patterns over time
   • CTo automatically block malicious IP addresses
   • DTo comply with data retention regulations
   Reveal Solution Discussion Select an answer first