You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

• A. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
• B. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
• C. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
• D. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.

An organization detects a successful login to a Google Cloud IAM user from an unfamiliar country, followed by the creation of multiple new service account keys within minutes. No malware alerts are triggered. What is the MOST appropriate immediate action?

• A. Disable the service accounts and continue monitorin
• B. Wait for evidence of data access
• C. Revoke active credentials, disable the compromised identity, and initiate an incident response
• D. Rotate only the affected user's password

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift. This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?

• A. Navigate to the underlying Security Health Analytics (SHA) finding for PUBLIC_IP_ADDRESSon the VM, and mark this finding as fixed.
• B. Enable and enforce theconstraints/compute.vmExternallpAccess organization policy constraint at the project level for the project where the VM resides.
• C. Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.
• D. Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

• A. Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
• B. Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
• C. Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
• D. Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.

Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag. What should you do?

• A. Ask Cloud Customer Care to add a custom filter to the dashboard.
• B. Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps.
• C. Add a custom filter to the dashboard.
• D. Copy an existing dashboard and add a custom filter.