You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:
- Receive a notification when data sources go silent within 15 minutes.
- Visualize ingestion throughput and parsing errors.
What should you do?

• A. Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane.
  Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).
• B. Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring.
  Create a Cloud Monitoring dashboard to visualize data ingestion metrics.
• C. Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.
• D. Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.

During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of
30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?

• A. Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.
• B. Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.
• C. Update the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.
• D. Change the default case assignment logic to route all phishing alerts to the Tier 2 team.

You are reviewing the security analyst team's playbook action process. Currently, security analysts navigate to the Playbooks tab in Google Security Operations (SecOps) for each alert and manually run steps assigned to a user. You need to present all actions from alerts awaiting user input in one location for the analyst to execute. What should you do?

• A. Enable approval links in the manual action and display them as clickable links to the user in a HTML widget in the Default Case View tab.
• B. Create an Alert View with the playbook that incorporates the Pending Actions widget.
• C. Add a general insight in your playbook to display manual action details to the user.
• D. Use the Pending Actions widget in the Default Case View in settings.

Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?

• A. Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
• B. Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
• C. Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic.
  Configure a trigger to send an email alert when new events are sent to this feed.
• D. Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.