You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?

• A. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.
• B. Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.
• C. Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
• D. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.

You need to ingest audit logs from your organization's entire Google Cloud environment into Google Security Operations (SecOps). This process must include Cloud NAT logs for workloads within a designated folder. You need to configure this ingestion while minimizing integration complexity. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next?

• A. Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps.
• B. Create a custom filter to export the folder-level Cloud NAT logs.
• C. Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps.
• D. Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder.

A SOC team notices repeated outbound HTTPS connections from a Compute Engine instance to an external IP every 60 seconds. CPU usage is normal and no malware signatures trigger. What is the BEST next analytical step?

• A. Identify the process and service account generating the traffic
• B. Block the destination IP immediately
• C. Power off the instance
• D. Notify executive leadership

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

• A. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
• B. Generate a report in SOAR Reports, and schedule delivery of the report.
• C. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
• D. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.

Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?

• A. Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
• B. Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
• C. Revoke additional role access from Tier 1 and Tier 2 analysts.
• D. Assign the cases to a user in the Tier 3 role.