What is the primary purpose of using threat intelligence feeds like GTI in real-time threat detection?

To replace the need for detection rules

To recognize emerging attack patterns and techniques as they appear

To store historical logs for compliance purposes

A security operations center (SOC) uses Google Threat Intelligence (GTI) to enrich their SIEM. An analyst notices that a new GTI entry for a malicious domain has been ingested, but no detection rule currently references this feed. The analyst wants to ensure that any future traffic to this domain is flagged. What is the most appropriate action?

Wait for the GTI feed to automatically generate alerts when the domain is observed in network traffic.

Increase the entity risk score for the domain to ensure it is prioritized in future investigations.

Create a detection rule that references the GTI feed entry for the domain and enable it in live mode.

Perform a one-time UDM search for the domain to check for any historical traffic.

In the context of real-time threat pattern identification, what is the role of detection rules?

To define what constitutes a threat based on known patterns and behaviors

To generate risk scores for entities

To store threat intelligence feeds

To automatically remediate all detected threats

What is the main difference between proactive threat hunting and standard alert-based detection?

Proactive hunting is only performed after a breach

Proactive hunting does not use threat intelligence

Proactive hunting searches for threats that may not trigger existing alerts

Proactive hunting only uses automated tools

Google CloudProfessional Security Operations Engineer

Domain 3Objective 2

3.2 Leveraging Threat Intelligence for Threat Hunting PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Part of the Threat hunting domain, which accounts for 19% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

13questions here

3free pages

5concepts

19%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of using threat intelligence feeds like GTI in real-time threat detection?
Select an answer first
2application · medium
A security operations center (SOC) uses Google Threat Intelligence (GTI) to enrich their SIEM. An analyst notices that a new GTI entry for a malicious domain has been ingested, but no detection rule currently references this feed. The analyst wants to ensure that any future traffic to this domain is flagged. What is the most appropriate action?
Select an answer first
3foundation · easy
In the context of real-time threat pattern identification, what is the role of detection rules?
Select an answer first
4foundation · easy
Which of the following is a key input for proactive threat hunting?
Select an answer first
5foundation · easy
What is the main difference between proactive threat hunting and standard alert-based detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.