You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process.
Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

• A. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
• B. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
• C. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
• D. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.

You are implementing Google Security Operations (SecOps) for your organization. Your organization has their own threat intelligence feed that has been ingested to Google SecOps by using a native integration with a Malware Information Sharing Platform (MISP). You are working on the following detection rule to leverage the command and control (C2) indicators that were ingested into the entity graph.

What code should you add in the detection rule to filter for the domain IOCs?

• A. $ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "DERIVED_CONTEXT"
• B. $ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "ENTITY_CONTEXT"
• C. $ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "SOURCE_TYPE_UNSPECIFIED"
• D. $ioc.graph.metadata.entity_type = "DOMAIN_NAME"
  $ioc.graph.metadata.source_type = "GLOBAL_CONTEXT"

Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?

• A. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
• B. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.
• C. Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName:
  "google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
• D. Generate a YARA-L rule in Google SecOps that detects when a service account key is created.
  Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.

You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions:
- Send an email to users who do not have a Google Security Operations (SecOps) account to request approval for endpoint containment
- Automatically continue executing its logic after the user responds
You plan to implement this process in the playbook by using the Gmail integration. You want to minimize the amount of effort required by the SOC analyst. What should you do?

• A. Generate an approval link for the containment action and include the placeholder in the body of the 'Send Email' action. Configure additional playbook logic to manage approved or denied containment actions.
• B. Use the 'Send Email' action to send an email requesting approval to contain the endpoint, and use the 'Wait For Thread Reply' action to receive the result. The analyst manually contains the endpoint.
• C. Set the containment action to 'Manual' and assign the action to the appropriate tier. Contact the user by email to request approval. The analyst chooses to execute or skip the containment action.
• D. Set the containment action to 'Manual' and assign the action to the user to execute or skip the containment action.