1.1 Enhancing Detection and Response PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is evaluating the effectiveness of their detection tools. They find that their SIEM is missing alerts from Cloud IDS because the Cloud IDS logs are not being forwarded correctly. They also have a high number of false positives from SCC findings. Which approach best addresses both issues?

   • ATroubleshoot the Cloud IDS log forwarding to ensure all alerts reach the SIEM, and tune SCC findings to reduce false positives.
   • BReplace Cloud IDS with a third-party NIDS that has better SIEM integration.
   • CDisable SCC findings that are not critical to reduce false positives.
   • DIncrease the SIEM ingestion capacity to handle more logs.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is designing a detection strategy for a multi-cloud environment (Google Cloud and AWS). They want to prioritize telemetry sources that provide the most value for detecting incidents across both clouds. They have limited resources and must choose between using native cloud security tools or a third-party multi-cloud security platform. Which consideration should drive their decision?

   • ANative tools should be prioritized because they are easier to deploy.
   • BNative tools like SCC and AWS GuardDuty provide deep integration with their respective clouds, but a third-party platform offers a unified view and consistent policies across both clouds.
   • CNative tools are always more effective than third-party platforms.
   • DThird-party platforms are always cheaper than native tools.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A small security team manages a growing cloud environment. They spend hours manually triaging alerts from multiple sources and creating tickets in their ITSM tool. They want to reduce response times and scale their operations without adding staff. Which approach best leverages automation and cloud tools?

   • AConfigure all alerts to be sent directly to the ITSM tool without any processing.
   • BUse Chronicle SecOps SOAR playbooks to automatically enrich, deduplicate, and route alerts to the ITSM tool, with manual approval for high-risk actions.
   • CHire more analysts to handle the alert volume.
   • DIncrease the number of SIEM dashboards to help analysts triage faster.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is evaluating whether to keep both Security Command Center (SCC) and a third-party vulnerability scanner. The third-party scanner provides more detailed CVE information, while SCC provides native integration with Google Cloud services. The team is concerned about the cost of maintaining both. Which approach best justifies keeping both tools?

   • AUse both tools for the same purpose to ensure no vulnerability is missed.
   • BUse SCC for continuous compliance monitoring and the third-party scanner for in-depth vulnerability analysis before patching.
   • CKeep both tools but disable all alerts from SCC to avoid duplication.
   • DReplace SCC with the third-party scanner to reduce costs.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational enterprise is designing its detection strategy. They have a compliance requirement to detect and respond to data exfiltration attempts. They have limited SIEM budget and must choose between prioritizing Cloud IDS alerts or Security Command Center (SCC) findings. Which consideration should drive their decision?

   • ACloud IDS should be prioritized because it is a Google Cloud native service and requires no additional licensing.
   • BSCC findings are more important because they cover all cloud resources, while Cloud IDS only covers network traffic.
   • CSCC should be prioritized because it provides compliance reports that satisfy the auditor.
   • DCloud IDS provides network-level detection of data exfiltration, while SCC focuses on misconfigurations that could lead to exfiltration.
   Reveal Solution Discussion Select an answer first