Google GCP-SOE-B Value Pack (Frequently Bought Together)

Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?

• A. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
• B. Generate a YARA-L rule in Google SecOps that detects when a service account key is created. Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.
• C. Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName: "google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
• D. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
• B. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
• C. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• D. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

• A. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
• B. Generate a report in SOAR Reports, and schedule delivery of the report.
• C. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
• D. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift. This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?

• A. Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.
• B. Navigate to the underlying Security Health Analytics (SHA) finding for PUBLIC_IP_ADDRESSon the VM, and mark this finding as fixed.
• C. Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.
• D. Enable and enforce theconstraints/compute.vmExternallpAccess organization policy constraint at the project level for the project where the VM resides.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
• B. Add an exception in the detection rule to exclude matches originating from specific asset groups.
• C. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
• D. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.