You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?

• A. Security Command Center Premium (SCCP) findings
• B. Cloud Audit Logs
• C. Cloud IDS logs
• D. VPC Flow Logs

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• B. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
• C. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
• D. Add an exception in the detection rule to exclude matches originating from specific asset groups.

You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?

• A. Create a Google SecOps SOAR dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.
• B. Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.
• C. Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.
• D. Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

• A. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
• B. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
• C. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
• D. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

• A. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
• B. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
• C. Configure the Windows server to send an email notification if there is an error in the Bindplane process.
• D. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.