1.1 Enhancing Detection and Response PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A company must comply with a regulation that requires independent verification of security configurations. They use both SCC and a third-party CSPM tool. Which requirement does this overlapping usage directly address?

   • APerformance improvement
   • BCost optimization
   • CUser convenience
   • DCompliance validation
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A security team wants to prioritize telemetry sources for early detection of misconfigurations in their Google Cloud environment. Which source provides the most direct signal for misconfigurations?

   • ASecurity Command Center (SCC)
   • BGoogle Threat Intelligence (GTI)
   • CCloud IDS
   • DCloud Logging
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team wants to automate the response to phishing emails reported by users. They use Chronicle SecOps and Google Workspace. They need to automatically quarantine the email and block the sender across all users. Which automation approach is most effective?

   • ACreate a SOAR playbook that triggers on user-reported phishing, uses the Gmail API to quarantine the email, and adds the sender to a blocklist.
   • BUse Cloud IDS to block the sender's IP address.
   • CManually review each reported email and then use the Gmail admin console to block the sender.
   • DConfigure Gmail to automatically quarantine all emails with the word 'phishing' in the subject.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team notices that their SIEM receives a high volume of low-severity alerts from Security Command Center (SCC), but they have missed several critical misconfigurations. They want to improve the effectiveness of their detection pipeline. Which approach best addresses this coverage gap?

   • ADisable low-severity SCC findings to reduce noise and focus only on critical ones.
   • BIncrease the frequency of SCC scans to generate more findings.
   • CReplace SCC with a third-party CSPM tool that provides more alerts.
   • DImplement SCC finding filters and forwarding rules to prioritize high-risk findings and route them to the SIEM with appropriate severity levels.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses Security Command Center (SCC) for vulnerability findings and Chronicle SecOps for SIEM/SOAR. They want to enrich their detection pipeline with network-level threat detection and feed all relevant alerts into their existing SIEM for centralized analysis. Which integration architecture best achieves this?

   • ASend all raw VPC flow logs to Chronicle SecOps and manually correlate them with SCC findings.
   • BReplace SCC with Cloud IDS to reduce tool sprawl and rely on Cloud IDS for all detection.
   • CConfigure Cloud IDS to send its alerts directly to Chronicle SecOps, and use Chronicle's SOAR to ingest SCC findings via API.
   • DUse Cloud IDS as the primary SIEM and ingest SCC findings into it.
   Reveal Solution Discussion Select an answer first