Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

• A. Generate a report in SOAR Reports, and schedule delivery of the report.
• B. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
• C. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
• D. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

• A. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
• B. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
• C. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
• D. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Add an exception in the detection rule to exclude matches originating from specific asset groups.
• B. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
• C. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• D. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.

You work for a telecommunications company that wants to monitor their multi-region 5G network logs in Google Security Operations (SecOps). The logs are currently only available on- premises and are stored in a standalone network-attached storage (NAS) located in four different regions.
You need to ingest the logs into Google SecOps and tag each NAS as a specific log source to avoid IP address aliasing. What should you do?

• A. Configure a Bindplane agent that collects Syslog from each log's location, and configure a namespace for each log source.
• B. Configure feed management to pull data from each log's location, and configure an ingestion label for each log source.
• C. Configure feed management to pull data from each log's location, and configure a namespace for each log source.
• D. Configure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source.

You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?

• A. Write a YARA-L 2.0 detection rule that searches for events with the IP address.
• B. Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.
• C. Run raw log searches using the IP address as a search term.
• D. On the Alerts & IOCS page, review results and entries where the IP address appears.