You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?

• A. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
• B. Create a case for each identified user with the user designated as the entity.
• C. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
• D. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

• A. Verify that the response is accurate by manually checking the URL in VirusTotal
• B. Use a conditional statement to determine whether to treat the URL as suspicious or benign.
• C. Use the number of detections from the response JSON in a conditional statement to set the severity.
• D. Pass the response back to the SIEM.
• E. Create a widget that translates the JSON output to a severity score.

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?

• A. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
• B. Use the UDM lookup feature to identify relevant process- related UDM fields and values.
• C. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
• D. Run a UDM search, and review aggregations for relevant process-related UDM fields.

Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SO You want to automate the response process and integrate with the existing SOW ticketing system. How should you implement this functionality?

• A. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system.
• B. Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.
• C. Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.
• D. Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.