You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:
- Receive a notification when data sources go silent within 15 minutes.
- Visualize ingestion throughput and parsing errors.
What should you do?

• A. Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.
• B. Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring.
  Create a Cloud Monitoring dashboard to visualize data ingestion metrics.
• C. Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.
• D. Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane.
  Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next
24 hours. What should you do?

• A. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
• B. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
• C. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
• D. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts. Specifically, you need to detect when a user account downloads an unusually large volume of data compared to the user's established baseline activity. You want to detect this anomalous data access behavior using the least amount of effort. What should you do?

• A. Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.
• B. Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.
• C. Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.
• D. Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.

You are a security analyst at an organization that uses Google Security Operations (SecOps).
Google SecOps triggered a medium severity alert of Unusual Cloud Storage Access - High Volume Download for [email protected] from the internal-project-code-repository bucket. This user is a senior developer within your organization who has legitimate access, but their download volume is unusually high and occurs outside working hours. You need to investigate this alert. What should you do first?

• A. Enrich the bucket entity with sensitivity labels and access control list (ACL) data.
• B. Run a Google SecOps SOAR playbook to suspend user1's bucket access, and review their user timeline.
• C. Review user1's timeline in Google SecOps, focusing on network events and resource access immediately preceding the download anomaly.
• D. Create a default detection rule in Google SecOps to monitor future high-volume downloads from the bucket, and add user1 to a high-risk watchlist.