4.1 Developing and Implementing Mechanisms to Detect Risks and Identify Threats PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is investigating a potential lateral movement incident. They have identified a sequence of events: a user ran a previously unseen executable, then connected to an internal database server, and then executed a SQL query. The team wants to find other instances of this exact behavioral sequence across the entire environment in the last 90 days. Which Google SecOps feature should they use?

   • AA YARA-L rule with a multi-event condition that specifies the sequence of events and a retro search for 90 days.
   • BA Security Command Center posture report that lists all assets with the executable installed.
   • CA dashboard that shows all connections to the database server in the last 90 days.
   • DA single-event search for the executable name across all logs in the last 90 days.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security team uses Google SecOps Risk Analytics to assign risk values to detections and discover anomalous behavior of assets or users. What is this capability called?

   • ARisk analytics and curated detections
   • BPosture management
   • CThreat intelligence reconciliation
   • DEntity context analysis
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team has a detection rule that alerts on any user who downloads a large number of files from a cloud storage bucket. The rule is generating too many false positives because some users legitimately download large files. The team wants to reduce false positives by using the entity graph to understand the user's role and typical behavior. How should they modify the rule?

   • ACreate a separate rule for each user in the environment with custom thresholds.
   • BAdd a condition to the rule that checks the user's department and job function from the entity graph, and only alert if the user is not in a data-analyst role.
   • CIncrease the threshold for the number of files downloaded in the rule.
   • DRemove the rule and rely on manual review of all download logs.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security analyst is using a detection rule to search for suspicious behavior patterns across a 7-day timeline. What is this activity called?

   • ARisk analytics
   • BThreat intelligence reconciliation
   • CLog retention
   • DDetection rule and search analysis
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary benefit of using risk values in detection rule design?

   • ATo reduce the number of logs ingested
   • BTo prioritize threats that match a specific risk profile
   • CTo automatically remediate threats
   • DTo eliminate all false positives
   Reveal Solution Discussion Select an answer first