During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of
30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?

• A. Update the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.
• B. Change the default case assignment logic to route all phishing alerts to the Tier 2 team.
• C. Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.
• D. Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• B. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
• C. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
• D. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• E. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?

• A. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
• B. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
• C. Run a UDM search, and review aggregations for relevant process-related UDM fields.
• D. Use the UDM lookup feature to identify relevant process-related UDM fields and values.

You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool.
You must recommend a tool to your leadership team as quickly as possible. What should you do?
(Choose two.)

• A. Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.
• B. Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.
• C. Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
• D. Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
• E. Review the architecture of the tool to identify the cloud provider that hosts the tool.

You are a member of the incident response team working in a global enterprise. You need to identify all potential Google Threat Intelligence IOCs within your organization's data using Google Security Operations (SecOps). What should you do?

• A. Create YARA-L rules to detect and alert when Google Threat Intelligence identifies potential threats.
• B. Use Gemini to perform a search for potential cybersecurity threats against your organization's data.
• C. Use the Cases page in Google SecOps.
• D. Use the Alerts & IOCs page in Google SecOps.