Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?

• A. Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
• B. Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
• C. Revoke additional role access from Tier 1 and Tier 2 analysts.
• D. Assign the cases to a user in the Tier 3 role.

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

• A. Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
• B. Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
• C. Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
• D. Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.

You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?

• A. Implement a parser extension on top of the prebuilt parser.
• B. Apply any pending updates to the prebuilt parser.
• C. Design and develop a custom parser.
• D. Implement middleware to modify the underlying data structure.

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on- premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

• A. Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
• B. Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
• C. Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
• D. Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• B. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
• C. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
• D. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• E. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.