6.1 Developing and Maintaining Dashboards and Reports to Provide Insights PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is designing a dashboard for their SOC leadership. The leadership wants to see a high-level view of the organization's security posture, including the number of open critical alerts, the trend of phishing attempts over the last 30 days, and the current status of active incident response cases. The team uses Google SecOps SIEM and SOAR, and they want to use Looker Studio for the final presentation. What is the most efficient way to populate this dashboard?

   • AUse the built-in Google SecOps dashboards and take screenshots to embed in a Looker Studio report.
   • BCreate a custom Looker Studio dashboard that connects directly to the Google SecOps API to pull live data for all three views.
   • CExport the data from Google SecOps to Google Sheets and then link the Sheets to a Looker Studio dashboard for visualization.
   • DBuild the dashboard in Google SecOps using its native widgets for SIEM and SOAR data, then use the 'Share' feature to present it to leadership.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is using Looker Studio to build a report for a specific business unit. The report needs to show only the alerts that are relevant to that unit's assets. The analyst has a data source that includes an 'asset_owner' field. What is the most effective way to ensure the report only displays relevant data for the intended audience?

   • ACreate a new Looker Studio report and manually delete the irrelevant rows from the data table.
   • BChange the data source's schema to remove the 'asset_owner' field.
   • CApply a filter to the data source that only includes rows where 'asset_owner' matches the business unit.
   • DUse a chart-level filter on each individual chart in the report.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is customizing a Looker Studio dashboard for a security operations team. The team wants to be able to filter the entire dashboard by a specific 'business_unit' dimension. The data source contains this field. What is the most efficient way to add this functionality?

   • ACreate a new page for each business unit and manually filter the data on each page.
   • BAdd a filter control to only one chart and instruct users to use that chart's filter.
   • CUse the 'Data freshness' setting to automatically filter the data based on the user's profile.
   • DAdd a 'business_unit' filter control to the dashboard and apply it to all charts.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of a security trend that a security operations team would monitor over time to identify emerging threats?

   • AQuarterly revenue figures
   • BOffice location of the IT team
   • CNumber of employees in the company
   • DIncrease in phishing email reports from users
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is building a dashboard to measure the performance of their threat hunting program. They have defined two key performance indicators (KPIs): the number of hypotheses tested per week and the percentage of hypotheses that lead to a new detection rule. The data for these KPIs is not stored as a single field in the SIEM; it is tracked in a separate project management tool. The team wants to display these KPIs alongside their SIEM data in a single dashboard. What is the most effective approach?

   • ACreate a custom parser in Google SecOps to ingest the project management tool's data and then build the dashboard natively.
   • BCreate two separate dashboards, one in Google SecOps for SIEM data and one in Looker Studio for KPIs, and present them side-by-side.
   • CBuild the dashboard in Google SecOps and manually update the KPI values in a custom widget each week.
   • DUse Looker Studio to blend the SIEM data from Google SecOps with the KPI data from the project management tool, and build the dashboard there.
   Reveal Solution Discussion Select an answer first