You work for a large international company that has several Compute Engine instances running in production. You need to configure monitoring and alerting for Compute Engine instances tagged with compliance-pci that have an external IP address assigned. What should you do?

• A. Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance-pci tag exists on the instances.
• B. Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance-pci tag.
• C. Create a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance-pci tag is assigned an external IP address.
• D. Deploy the compute.vmExternallpAccess organization policy constraint to prevent specific projects or folders with the compliance-pci tag from creating Compute Engine instances with external IP addresses.

You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

• A. Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
• B. Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.
• C. Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
• D. Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

• A. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
• B. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
• C. Generate a report in SOAR Reports, and schedule delivery of the report.
• D. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.

A phishing campaign successfully convinces users to grant OAuth permissions to a malicious third-party application. Which control failure MOST likely allowed this?

• A. Missing antivirus signatures
• B. Missing email sandboxing
• C. Weak endpoint protection
• D. Lack of monitoring and restriction on OAuth consent grants

You have identified a new threat actor group that has several IOCs in Google Threat Intelligence. You want to use some of these IOCs in several detection rules in Google Security Operations (SecOps) to help identify suspicious activity. You want to use the most effective approach. What should you do?

• A. Add the IOCs to a new or existing reference list, and update the YARA-L logic of detection rules to include the reference list.
• B. Configure a new data feed in Google SecOps that includes the IOCS. Update the YARA-L logic to reference the new IOCS against applicable UDM fields.
• C. Save the IOCs in a new collection in Google Threat Intelligence. Share this list with other members of the security team to facilitate their searches and rule creation.
• D. Identify the detection rules that apply to the new IOCS, and update the YARA-L logic to reference the threat actor group.