A security analyst is designing a scoring scheme to assign risk levels to indicators of compromise (IOCs). Which combination of factors is most appropriate to include when calculating an IOC's risk score?

The number of false positives generated, the log source, and the analyst's shift schedule

The IOC's age, the analyst's experience, and the number of characters in the IOC

The color of the threat intel feed, the time of day, and the source IP's geolocation

Threat actor reputation, malware family, and observed impact

A detection rule for 'suspicious PowerShell execution' is generating a high number of alerts. Investigation shows that most alerts are triggered by a legitimate administrative script that runs every hour. The script is used by the IT team for routine maintenance. The SOC wants to reduce the noise without losing visibility into malicious PowerShell activity. What is the most appropriate tuning action?

Change the rule to only alert on PowerShell executions from non-admin users.

Disable the rule during the hour when the script runs.

Whitelist the specific administrative script's hash or path for this rule.

Increase the alert threshold to require multiple PowerShell executions in a short time.

What is the purpose of flagging high-frequency alerts as likely false positives?

To block the source IP immediately

To automatically delete all related logs

To allow the SOC to tune detection rules and reduce noise

To increase the risk score of the associated IOCs

What does measuring alert frequency involve?

Calculating how often a particular alert occurs over a defined time window

Reviewing the alert's description text

Identifying the source IP of the alert

Determining the severity of each alert

What is the primary goal of automating IOC ingestion and update from threat intelligence feeds?

To ensure searches always use the latest indicators

To eliminate the need for any threat intelligence feeds

To manually approve each IOC before it is used

To reduce the number of IOCs stored in the system

Google CloudProfessional Security Operations Engineer

Domain 4Objective 2

4.2 Leveraging Threat Intelligence for Detection PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Part of the Detection engineering domain, which accounts for 22% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

25questions here

5free pages

7concepts

22%of the exam

Questions 1–5

1foundation · easy
A security analyst is designing a scoring scheme to assign risk levels to indicators of compromise (IOCs). Which combination of factors is most appropriate to include when calculating an IOC's risk score?
Select an answer first
2application · medium
A detection rule for 'suspicious PowerShell execution' is generating a high number of alerts. Investigation shows that most alerts are triggered by a legitimate administrative script that runs every hour. The script is used by the IT team for routine maintenance. The SOC wants to reduce the noise without losing visibility into malicious PowerShell activity. What is the most appropriate tuning action?
Select an answer first
3foundation · easy
What is the purpose of flagging high-frequency alerts as likely false positives?
Select an answer first
4foundation · easy
What does measuring alert frequency involve?
Select an answer first
5foundation · easy
What is the primary goal of automating IOC ingestion and update from threat intelligence feeds?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.