During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

• A. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
• B. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
• C. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
• D. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.

You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps).
You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR's features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?

• A. Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.
• B. Use the ROI - Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.
• C. Use the filters and visualizations in the Management - SOC Status report in SOAR Reports to extract case-specific performance data.
• D. Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.

A SOC team notices repeated outbound HTTPS connections from a Compute Engine instance to an external IP every 60 seconds. CPU usage is normal and no malware signatures trigger. What is the BEST next analytical step?

• A. Identify the process and service account generating the traffic
• B. Power off the instance
• C. Block the destination IP immediately
• D. Notify executive leadership

You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)

• A. Use a saved search to identify all events with the LATERAL MOVEMENT tag over the past 30 days.
• B. Group events by user identity and time to identify repeated access patterns.
• C. Filter for events using protocol-level attributes that indicate RDP connections.
• D. Correlate events based on the asset role or classification such as database or user workstation.
• E. Filter for RDP connections with non-standard ports.

Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?

• A. Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
• B. Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
• C. Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
• D. Use a custom parser that outputs all fields as raw JSON for detection.