3.1 Performing Threat Hunting Across Environments PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of Google SecOps (Chronicle) in threat hunting?

   • ATo manage user identities and access
   • BTo create and manage firewall rules
   • CTo provide a platform for searching, correlating, and analyzing security data
   • DTo deploy virtual machines
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is Google Threat Intelligence (GTI) used for in threat hunting?

   • ATo automatically patch all vulnerable systems
   • BTo provide up-to-date information on known threats and indicators of compromise
   • CTo manage cloud resource quotas
   • DTo replace the need for any other security tools
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat hunter has identified a pattern of anomalous behavior in a user's account. The user has been logging in from multiple geographic locations in a short period, which is impossible for a single person to do. The hunter has a hypothesis that the account is compromised. What is the MOST appropriate action for the hunter to take with this finding?

   • AIgnore the finding because it is likely a false positive due to VPN usage.
   • BContact the user directly to ask if they have traveled recently.
   • CDisable the user's account immediately to prevent further damage.
   • DDocument the finding, share the hypothesis with the incident response team, and recommend a deeper investigation.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a best practice when constructing a search query to identify anomalous activity in logs?

   • AUsing only the most specific filters from the start to avoid noise
   • BAvoiding the use of logical operators to keep queries simple
   • CStarting with a broad query and then narrowing down using additional filters
   • DQuerying only a single log type to reduce complexity
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary reason for a threat hunter to collaborate with the incident response (IR) team?

   • ATo avoid duplicating work by having IR do all analysis
   • BTo delegate all threat hunting tasks to the IR team
   • CTo get approval for every query before running it
   • DTo share findings and coordinate on active threats
   Reveal Solution Discussion Select an answer first