Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
• B. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• C. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• D. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
• E. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

• A. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
• B. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
• C. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.
• D. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

• A. Modify the detection rule in the SIEM to include the query results as part of the detection.
• B. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
• C. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
• D. Add an action to the playbook that runs the SIEM query and returns the results.

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

• A. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
• B. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
• C. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
• D. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
• E. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.