You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Your organization recently faced a cybersecurity breach. You need to increase the threat analytics as quickly as possible. What should you do?

• A. Design YARA-L detection rules based on Google SecOps Marketplace use cases.
• B. Enable curated detections to identify threats.
• C. Develop YARA-L detection rules that focus on threat intelligence.
• D. Ingest data from a threat intelligence platform (TIP) into Google SecOps.

Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SO You want to automate the response process and integrate with the existing SOW ticketing system. How should you implement this functionality?

• A. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system.
• B. Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.
• C. Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.
• D. Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.

Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?

• A. Configure direct ingestion from your Google Cloud organization.
• B. Configure and deploy a Bindplane collection agent.
• C. Configure a third-party API feed in Google SecOps.
• D. Configure and deploy a Google SecOps forwarder.

You are tasked with building a workflow in Google Security Operations (SecOps) SOAR. The documentation you are using requires a logical split that has eight different possible paths. You need to break the workflow into eight separate workflows using an automatic and efficient approach. What should you do?

• A. Create a playbook that uses a Multi-Choice Question answer choices. Add instructions describing which logic to use in the instruction or question fields. Have the analyst select the appropriate answer to move the flow into the right branch.
• B. Create eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to the alert.
• C. Create a playbook that uses a flow condition. Add four more branches to have a total of five branches and an "Else" branch. On the "Else" branch, include another flow condition. Include the remaining three branches with the logic required.
• D. Create eight playbooks for each workflow. Configure the triggered playbook to end on an instruction action that tells the analyst to pick a workflow from the playbooks tab and attach that workflow to the alert.

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

• A. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
• B. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
• C. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
• D. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
• E. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.