A detection engineer is designing a rule that uses risk values from Google SecOps reference lists to identify threats. What is this design approach called?

Threat intelligence reconciliation

Risk-based detection rule design

An analyst notices that a single user account has been authenticating successfully from a new geographic location at 3:00 AM local time for the past three days. The user works in a different time zone and has never traveled to that location. The company's identity logs are in Google SecOps. What is the most effective first step to determine if this is a genuine threat?

Check the entity graph to see if the user has any relationships with other assets in that location.

Immediately disable the user account and escalate the incident to the legal department.

Run a search for all authentication events for that user over the past 30 days and compare the source IPs and locations.

Create a YARA-L rule that alerts on any authentication event from that specific location and enable it immediately.

What is the purpose of identifying emerging threats that are not in threat intelligence sources?

To reduce the number of detection rules

To detect previously unknown or low prevalence threats

To improve log storage efficiency

To replace the need for threat intelligence feeds

Which of the following is the primary purpose of correlating threat intelligence feeds with activity logs?

To identify potential threats by finding matches between known indicators and internal activity

To automatically remediate all identified threats

To replace the need for anomaly detection rules

To reduce the volume of logs stored in the SIEM

What is the primary goal of anomaly detection in logs and events?

To identify unusual activities that may indicate a security threat

To ensure logs are stored in the correct format

To match logs against known threat intelligence indicators

To reduce the number of false positives in detection rules

Google CloudProfessional Security Operations Engineer

Domain 4Objective 1

4.1 Developing and Implementing Mechanisms to Detect Risks and Identify Threats PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Part of the Detection engineering domain, which accounts for 22% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

27questions here

6free pages

9concepts

22%of the exam

Questions 16–20

16foundation · easy
A detection engineer is designing a rule that uses risk values from Google SecOps reference lists to identify threats. What is this design approach called?
Select an answer first
17application · medium
An analyst notices that a single user account has been authenticating successfully from a new geographic location at 3:00 AM local time for the past three days. The user works in a different time zone and has never traveled to that location. The company's identity logs are in Google SecOps. What is the most effective first step to determine if this is a genuine threat?
Select an answer first
18foundation · easy
What is the purpose of identifying emerging threats that are not in threat intelligence sources?
Select an answer first
19foundation · easy
Which of the following is the primary purpose of correlating threat intelligence feeds with activity logs?
Select an answer first
20foundation · easy
What is the primary goal of anomaly detection in logs and events?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.