Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?

• A. Create a workforce identity pool at the organization level Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps Instance.
• B. Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
• C. Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
• D. Create a Google Group and add the required users. Grant the roles/chronicle.Viewer IAM role to the group on the project associated with your Google SecOps Instance.

Which Google Cloud security feature MOST helps enforce the principle of least privilege at scale?

• A. IAM predefined roles and conditional IAM policies
• B. Binary Authorization
• C. VPC Firewall Rules
• D. Cloud NAT

Your organization recently conducted a penetration test on their environment. You have been tasked with identifying a successful attack chain. The required log sources have been ingested into Google Security Operations (SecOps). You discover anomalous outbound traffic to external domains. You suspect that the finding is a communication to a command and control (C2) infrastructure. You need to identify the least common network communications over the last 14 days. What should you do?

• A. Perform a Google SecOps SIEM raw log search that looks for low rolling prevalence domains with NETWORK_CONNECTION or NETWORK_HTTP in the firewall and proxy logs over the last 14 days.
• B. Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for target domains over the last 14 days.
• C. Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for principal domains over the last 14 days.
• D. Perform a Google SecOps SOAR search that looks for cases with low rolling prevalence of NETWORK_CONNECTION or NETWORK_HTTP events over the last 14 days.

Your organization recently adopted Google Security Operations (SecOps), and has configured ingestion, parsing and rules for their log sources. The security operations team is currently triaging alerts one at a time using several external product dashboards with alerts and enrichment data. You want to use the case management functionality in Google SecOps to reduce the amount of pivoting between products your SOC analysts are required to do. You want to minimize development effort. What should you do first?

• A. Build a playbook for each of the noisiest alert sources to gather additional context on the case from the source product.
• B. Build a playbook for each detection rule to enrich and remediate alerts relative to the particular threat each rule is designed to detect.
• C. Build a job to periodically iterate over recent cases, determine relevant context, and enrich alerts.
• D. Build a low-priority, catch-all playbook for enrichment of entities in a case using threat intelligence sources.

Your company uses Google-managed images on Compute Engine VM instances extensively and has deployed Security Command Center Enterprise (SCCE) at the organization level Due to a recent increase in vulnerability exploits, you want to improve visibility into operating system (OS) risks for all VMs in your organization. You want to use managed services to enhance security detection capabilities related to these vulnerabilities using minimal effort. What should you do?

• A. Create a custom Security Health Analytics (SHA) scanner to check the sourceImage of the compute disk. Check for matches in a vulnerability database.
• B. Enable Virtual Machine Threat Detection in SCCE, and allow it to generate findings.
• C. Set up Google Open Source Vulnerability (OSV)-Scanner to scan all Compute Engine VMs.
  Configure a Google Security Operations (SecOps) forwarder to write logs to your Google SecOps instance.
• D. Enable VM Manager across your projects, and allow VM Manager to write findings to SCCE.