3.1 Performing Threat Hunting Across Environments PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the role of security posture data in hypothesis development?

   • AIt replaces the need for threat intelligence
   • BIt automatically fixes security issues
   • CIt helps identify weaknesses that might be exploited, guiding what to hunt for
   • DIt provides a list of all active threats
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is BigQuery well-suited for threat analysis on large log datasets?

   • AIt stores logs in a proprietary format that is faster to search
   • BIt provides scalable, serverless data warehousing with SQL querying
   • CIt is the only tool that can query logs
   • DIt automatically detects all security threats
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is reviewing user behavior analytics (UBA) alerts. The analyst sees an alert for a user who has accessed a large number of files in a short period. The user is a data scientist who frequently accesses large datasets. The analyst also notices that the user's account has not had a password change in 180 days. The analyst must decide whether to escalate this alert to the incident response team. What is the MOST appropriate action?

   • AEscalate the alert immediately because the user's password is old, which is a sign of compromise.
   • BInvestigate the alert further by checking the user's historical behavior and the specific files accessed to determine if the activity is anomalous.
   • CEscalate the alert to the incident response team because any deviation from normal behavior is a potential threat.
   • DIgnore the alert because the user is a data scientist who frequently accesses large datasets.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a user behavior deviation that a threat hunter might investigate?

   • AA user changing their password after a scheduled reminder
   • BA user connecting to the corporate VPN during business hours
   • CA user accessing a commonly used internal application
   • DA user logging in from a new geographic location at an unusual time
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A threat hunter needs to find all login failures across multiple projects in Google Cloud. Which query language feature is most appropriate for constructing this search across logs from different projects?

   • AUsing a single query with a filter that includes multiple project IDs
   • BRunning separate queries for each project and manually combining results
   • CUsing a wildcard in the project name field to match all projects
   • DExporting all logs to a single bucket and querying that bucket
   Reveal Solution Discussion Select an answer first