You were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand the current performance by calculating the mean time to respond or remediate (MTTR) for your cases. What should you do?

• A. Use the playbooks' case stages to capture metrics for each stage change. Create a dashboard based on these metrics.
• B. Create a multi-event detection rule to calculate the response metrics in the outcome section based on the entity graph. Create a dashboard based on these metrics.
• C. Create a dashboard table widget that displays the average case handling times by analyst, case priority, and environment.
• D. Create a playbook block that can be re-used in all alert playbooks to write timestamps in the case wall after each change to the case. Write a job to calculate the case metrics.

Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?

• A. Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
• B. Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic.
  Configure a trigger to send an email alert when new events are sent to this feed.
• C. Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
• D. Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.

You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?

• A. In Google SecOps SOAR settings, create a new environment for each customer.
• B. In Google SecOps SOAR settings, create a role for each customer.
• C. In Google SecOps Playbooks, create a playbook for each customer.
• D. In Google SecOps SOAR settings, create a permissions group for each customer.

Your company wants to enhance its detection capabilities to prevent insider threat incidents. You need to be alerted when a privileged Google Group is modified to allow access to the general public. You need to identify and enable the optimal log source, and configure the alert. What should you do?

• A. Enable Google Drive log events. Create a reporting rule that triggers when a file sharing event occurs with the visibility set to anyone with the link.
• B. Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.
• C. Enable VPC Flow Logs for the default VPC network. Configure a log-based alert in Cloud Logging to detect anomalous traffic patterns associated with Google Groups API endpoints.
• D. Enable IAM Admin Activity audit logs, and export the logs to Google Security Operations (SecOps). Write a YARA-L rule in Google SecOps to capture any changes to relevant IAM policies.

During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

• A. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
• B. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
• C. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
• D. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.