Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?

• A. Use the UDM lookup feature to identify relevant process- related UDM fields and values.
• B. Run a UDM search, and review aggregations for relevant process-related UDM fields.
• C. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
• D. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift. This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?

• A. Enable and enforce theconstraints/compute.vmExternallpAccess organization policy constraint at the project level for the project where the VM resides.
• B. Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.
• C. Navigate to the underlying Security Health Analytics (SHA) finding for PUBLIC_IP_ADDRESSon the VM, and mark this finding as fixed.
• D. Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

• A. Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
• B. Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
• C. Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
• D. Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.

An organization detects a successful login to a Google Cloud IAM user from an unfamiliar country, followed by the creation of multiple new service account keys within minutes. No malware alerts are triggered. What is the MOST appropriate immediate action?

• A. Revoke active credentials, disable the compromised identity, and initiate an incident response
• B. Wait for evidence of data access
• C. Rotate only the affected user's password
• D. Disable the service accounts and continue monitorin