You are a security engineer at a financial technology company. You need to create a centralized dashboard to provide security posture visibility for your leadership team. The dashboard must meet these requirements:
- Provide insights from Security Command Center (SCC) findings and security-related events captured in Cloud Logging.
- Support large volumes of historical data.
- Be able to join SCC findings and audit logs.
You want to use the most effective visualization solution that uses Google Cloud managed services. What should you do?

• A. Ingest the SCC findings and Cloud Audit Logs into a Cloud Storage bucket. Write a Python script that reads the data and uses Matplotlib to create the visualizations.
• B. Create custom metrics in Cloud Monitoring based on the SCC findings, and configure log-based metrics for security-related events. Build Cloud Monitoring dashboards to visualize these custom and log-based metrics.
• C. Use the built-in SCC dashboard to visualize the SCC finding, and extract log counts for specific log events from Cloud Audit Logs.
• D. Export SCC findings and Cloud Audit Logs to BigQuery. Connect Looker Studio to the BigQuery datasets, and create the visualizations and filters.

Your team hunts for threats in a large multinational corporation. You have subscriptions to threat intelligence feeds from third-party sources. You want to implement a solution to continuously compare DNS calls on endpoints to your threat intelligence feeds. What should you do?

• A. Use custom modules in Event Threat Detection in Security Command Center (SCC) to correlate feed data with Google Cloud logs.
• B. Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the VirusTotal table in the entity graph.
• C. Push endpoint logs to BigQuery and use scripts to compare entries to Google Threat intelligence by using a Google Threat Intelligence API key.
• D. Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the entity graph.

You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

• A. Enable default curated detections to automatically block suspicious IP addresses.
• B. Use UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.
• C. Remove user accounts that have repeated invalid login attempts.
• D. Look for correlations across impacted users in the Risk Analytics dashboard.

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• B. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
• C. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
• D. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.