Which Google Cloud security feature MOST helps enforce the principle of least privilege at scale?

• A. Cloud NAT
• B. Binary Authorization
• C. VPC Firewall Rules
• D. IAM predefined roles and conditional IAM policies

You are an incident responder at your organization using Google Security Operations (SecOps) for monitonng and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?

• A. Use the EDR integration to quarantine the compromised asset.
• B. Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
• C. Deploy emergency patches, and reboot the server to remove malicious persistence.
• D. Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.

You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps).
You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR's features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?

• A. Use the filters and visualizations in the Management - SOC Status report in SOAR Reports to extract case-specific performance data.
• B. Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.
• C. Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.
• D. Use the ROI - Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?

• A. Ingest logs from Windows PowerShell.
• B. Ingest logs from Windows Sysmon.
• C. Ingest logs from Windows Procmon.
• D. Ingest logs from Microsoft Entra I

You need to ingest audit logs from your organization's entire Google Cloud environment into Google Security Operations (SecOps). This process must include Cloud NAT logs for workloads within a designated folder. You need to configure this ingestion while minimizing integration complexity. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next?

• A. Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps.
• B. Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps.
• C. Create a custom filter to export the folder-level Cloud NAT logs.
• D. Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder.