Your company wants to enhance its detection capabilities to prevent insider threat incidents. You need to be alerted when a privileged Google Group is modified to allow access to the general public. You need to identify and enable the optimal log source, and configure the alert. What should you do?

• A. Enable VPC Flow Logs for the default VPC network. Configure a log-based alert in Cloud Logging to detect anomalous traffic patterns associated with Google Groups API endpoints.
• B. Enable Google Drive log events. Create a reporting rule that triggers when a file sharing event occurs with the visibility set to anyone with the link.
• C. Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.
• D. Enable IAM Admin Activity audit logs, and export the logs to Google Security Operations (SecOps). Write a YARA-L rule in Google SecOps to capture any changes to relevant IAM policies.

You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions:
- Send an email to users who do not have a Google Security Operations (SecOps) account to request approval for endpoint containment
- Automatically continue executing its logic after the user responds
You plan to implement this process in the playbook by using the Gmail integration. You want to minimize the amount of effort required by the SOC analyst. What should you do?

• A. Set the containment action to 'Manual' and assign the action to the user to execute or skip the containment action.
• B. Set the containment action to 'Manual' and assign the action to the appropriate tier. Contact the user by email to request approval. The analyst chooses to execute or skip the containment action.
• C. Generate an approval link for the containment action and include the placeholder in the body of the 'Send Email' action. Configure additional playbook logic to manage approved or denied containment actions.
• D. Use the 'Send Email' action to send an email requesting approval to contain the endpoint, and use the 'Wait For Thread Reply' action to receive the result. The analyst manually contains the endpoint.

Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?

• A. Create a workforce identity pool at the organization level Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps Instance.
• B. Create a Google Group and add the required users. Grant the roles/chronicle.Viewer IAM role to the group on the project associated with your Google SecOps Instance.
• C. Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
• D. Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.

A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts.
The rule was designed to detect suspicious Cloud Storage enumeration by triggering an alert whenever the storage.objects.list API operation is called using the api.operation UDM field.
However, a legitimate backup automation tool that uses the same API, causing the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while still detecting potentially malicious usage. How should you modify the rule to improve its accuracy?

• A. Adjust the rule severity to LOWto deprioritize alerts from automation tools.
• B. Add principal.user.email != "[email protected]" to the rule condition to exclude the automation account.
• C. Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
• D. Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.

You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?

• A. Run a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
• B. Perform a UDM search for login events, and pivot to group results by user and country of origin.
• C. Perform a YARA-L 2.0 search for login events and their associated principal.location.country field.
  Use an outcome field to aggregate the number of failed logins.
• D. Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.