You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?

• A. Create a case for each identified user with the user designated as the entity.
• B. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
• C. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
• D. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.

You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?

• A. Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).
• B. Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).
• C. Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.
• D. Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.

You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)

• A. Filter for RDP connections with non-standard ports.
• B. Group events by user identity and time to identify repeated access patterns.
• C. Use a saved search to identify all events with the LATERAL MOVEMENT tag over the past 30 days.
• D. Filter for events using protocol-level attributes that indicate RDP connections.
• E. Correlate events based on the asset role or classification such as database or user workstation.

You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?

• A. Cloud IDS logs
• B. VPC Flow Logs
• C. Cloud Audit Logs
• D. Security Command Center Premium (SCCP) findings

Which approach BEST improves detection of compromised service accounts in Google Cloud?

• A. Disabling all service accounts You are managing the integration of Security Command Center (SCC) with downstream tooling.
• B. Baseline service account behavior and alert on deviations
• C. Monitoring VM uptime
• D. Alerting on login failures only