During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

• A. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
• B. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
• C. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
• D. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• B. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
• C. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
• D. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

• A. Create a widget that translates the JSON output to a severity score.
• B. Verify that the response is accurate by manually checking the URL in VirusTotal
• C. Use the number of detections from the response JSON in a conditional statement to set the severity.
• D. Use a conditional statement to determine whether to treat the URL as suspicious or benign.
• E. Pass the response back to the SIEM.

You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?

• A. Create an outcome variable in the rule to assign the network name.
• B. Enrich the IP address entities as the initial step of the playbook.
• C. Configure each network in the Google SecOps SOAR settings.
• D. Modify the entity attribute in the alert overview.

A business unit in your organization plans to use Vertex AI to develop models within Google Cloud. The security team needs to implement detective and preventative guardrails to ensure that the environment meets internal security control requirements. How should you secure this environment?

• A. Create a posture consisting of predefined and custom organization policies and predefined and Security Health Analytics (SHA) custom modules. Scope this posture to the business unit folder.
• B. Create a policy bundle representing the control requirements using Rego. Implement these policies using Workload Manager. Scope this scan to the business unit folder.
• C. Implement Assured Workloads by creating a folder for the business unit and assigning the relevant control package.
• D. Implement preconfigured and custom organization policies to meet the control requirements.
  Apply these policies to the business unit folder.