You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

• A. Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
• B. Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.
• C. Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
• D. Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.

You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps).
You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR's features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?

• A. Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.
• B. Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.
• C. Use the filters and visualizations in the Management - SOC Status report in SOAR Reports to extract case-specific performance data.
• D. Use the ROI - Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.

Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?

• A. Configure a rule exclusion for the target.domain field.
• B. Configure a rule exclusion for the principal.ip field.
• C. Configure a rule exclusion for the network.asset.ip field.
• D. Configure a rule exclusion for the target.ip field.

You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCS in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?

• A. Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC- Score) is between 60% and 80%.
• B. Implement curated detections instead of custom YARA-L rules.
• C. Configure alert grouping for the most repetitive alerts.
• D. Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.

You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCS and would like to include external signals for this capability to ensure broad detection coverage. What should you do?

• A. Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
• B. Create an Event Threat Detection custom module using the "Configurable Bad IP" template.
• C. Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
• D. Create a Security Health Analytics (SHA) custom module using the compute address resource.