Free SECURITY-OPERATIONS-ENGINEER Practice Test Questions and Answers (2026) Practice Questions

The most appropriate solution is to use the Advanced Reports feature within Google SecOps SOAR. This feature is specifically designed to create highly customized reports based on case data, including metrics like resolution status and Service Level Agreement (SLA) performance. Advanced Reports allow for precise filtering by case severity (high and critical) and time range (past week). The platform's scheduling capabilities enable automated generation and delivery of these reports via email on a recurring basis, such as every Monday. The output can be configured as a zipped CSV file, meeting all the compliance team's requirements directly within the SOAR platform without needing complex workarounds.

A. While generating a report in SOAR Reports is the correct general area, "Advanced Report" is more specific and necessary for the custom metrics (SLA, resolutions) required by compliance.

B. Detection rules are used to identify threats from UDM event data, not to generate retrospective reports on case management metrics. This is the wrong tool for this task.

D. The statistics feature in UDM Search is used for analyzing raw security telemetry (events), not for reporting on metadata and lifecycle attributes of SOAR cases like resolution or SLA.

1. Google Cloud Documentation - Google SecOps - Create and manage reports: "Advanced reports let you create custom reports using custom queries. You can use advanced reports to create reports that are not available in the default reports." This supports the need for custom metrics like specific SLA and resolution data.

2. Google Cloud Documentation - Google SecOps - Schedule a report: "You can schedule a report to be generated and delivered on a recurring basis... You can configure the report to be sent as an email attachment... You can select the format of the report

such as PDF

CSV

or HTML. You can also choose to have the report compressed in a zip file." This directly confirms the scheduling

formatting (CSV)

compression (zipped)

and delivery (email) capabilities required by the scenario.

The most appropriate initial response to a security alert involves a combination of procedural and technical investigation steps. The first step is to understand the alert by reviewing the finding and investigating the affected resources (the pod) to gather evidence and context. Concurrently, it is crucial to research the potential attack vectors and appropriate responses for the observed activity. This covers the technical investigation (Option D).

Simultaneously, a structured incident response process must be initiated. This includes notifying the business owner of the critical workload for context and impact assessment, following a pre-defined incident response playbook to ensure consistent and effective actions, and engaging specialized teams like threat hunting for deeper analysis and root cause identification (Option C). This combination ensures a thorough, non-destructive, and organizationally-sound investigation.

A. Deleting the pod immediately destroys critical forensic evidence needed for investigation. Quarantining an entire cluster is an overly drastic containment measure before confirming the threat's scope and severity.

B. This option is partially correct but less comprehensive than option D. A complete investigation involves not just observing behavior but also reviewing the finding details, related resources, and researching the threat.

E. An unknown binary executing in a critical workload is a significant security event. Silencing the alert without a thorough investigation would be negligent and violates security best practices.

1. Google Cloud Documentation

"Remediating Container Threat Detection findings": For the Execution: Added Binary Executed finding

the recommended actions are to first "Triage the finding by investigating whether the binary is authorized" and then "investigate how the container was compromised." This directly supports the investigation-first approach outlined in option D and contradicts the destructive actions in option A. The document emphasizes analysis before remediation. (Source: Google Cloud

Security Command Center Documentation

Remediating Container Threat Detection findings).

2. Google Cloud Security Foundations Guide

"Incident response": This guide outlines a formal incident response process. The "Respond" phase includes Triage and Investigation. It emphasizes the need for an incident response plan (playbook) and clear communication channels (notifying owners)

which aligns with option C. The guide states

"The goal of the investigation is to determine the root cause of the incident...by collecting and analyzing evidence

" which supports the non-destructive investigation in option D. (Source: Google Cloud

Security Foundations Guide

Incident response section).

3. Google Cloud

"Container security": This documentation emphasizes a defense-in-depth strategy. A key part of responding to a potential breach (identified by Container Threat Detection) is to "investigate the incident to determine the scope and impact" before taking corrective action. This supports the analytical approach of options C and D. (Source: Google Cloud

Security

Container security overview).

Security Command Center Enterprise (SCCE) includes Google Security Operations (SecOps) SOAR, a platform designed specifically for Security Orchestration, Automation, and Response. The most efficient and intended method for automating responses to SCC findings is to use SOAR playbooks. A playbook can be triggered by an SCC finding, and one of its automated steps can be to interact with a third-party ticketing system's API to create a ticket. This leverages the built-in, integrated capabilities of the SCCE platform for a streamlined, low-code automation workflow, directly addressing the need for an efficient, automated solution.

A. This approach introduces an unnecessary intermediate system (SIEM) for a task that Google SecOps SOAR can handle directly, making it less efficient than the integrated SOAR solution.

B. This describes a completely manual process, which contradicts the core requirement to automate the response and is inherently inefficient.

D. This proposes a complex, custom-coded solution using Cloud Storage and Dataflow. It is significantly less efficient to build and maintain compared to using the purpose-built SOAR functionality within SCCE.

1. Google Cloud Documentation

"Security Command Center tiers": This document confirms that the Enterprise tier includes the full Google Security Operations platform

which contains both SIEM and SOAR capabilities. Under the "Enterprise tier" section

it lists "Security orchestration

automation

and response (SOAR)" as a key feature. This supports the premise that SOAR is the available and intended tool.

2. Google Cloud Documentation

"Google SecOps SOAR overview": This document states

"Google SecOps SOAR enables security teams to respond to threats faster

with more accuracy and at scale... It provides playbooks to automate response procedures." This establishes playbooks as the primary mechanism for automation.

3. Google Cloud Documentation

"Integrations" (Google SecOps SOAR): This documentation details the extensive list of integrations available for Google SecOps SOAR

including numerous ticketing and case management systems like Jira

ServiceNow

and Zendesk. The "Case Management" category explicitly lists these integrations

confirming that a playbook step can directly create a ticket in an existing SOC system.

The most effective first action is to use the Endpoint Detection and Response (EDR) integration to quarantine the compromised asset. This immediately isolates the server from the network, preventing the threat from spreading (lateral movement) or communicating with external command-and-control (C2) servers. Crucially, quarantining preserves the server's current state, including volatile memory and disk artifacts, which are essential for a thorough forensic investigation to understand the full scope of the breach and identify persistence mechanisms. This single action achieves both immediate containment and data preservation.

A. Blocking a single IP address is an incomplete containment strategy; the compromised server could still attack internal systems or communicate with other malicious IPs.

B. Rebooting the server is a destructive action that erases critical volatile evidence (e.g., running processes, network connections, memory contents), violating the forensic preservation requirement.

D. Blocking a single domain is insufficient containment, as attackers often use multiple domains, IP addresses, or other protocols for C2 communication.

1. Google Cloud Documentation

Chronicle SOAR Integrations: Chronicle SOAR integrates with numerous EDR solutions (e.g.

CrowdStrike

SentinelOne

Microsoft Defender for Endpoint). These integrations explicitly provide response actions such as "Network Contain" or "Quarantine Host

" which allow an analyst to isolate a machine directly from the Google SecOps interface. This is a core function of a modern Security Orchestration

Automation

and Response (SOAR) platform. (Reference: See specific EDR integration documentation within the Google Cloud Chronicle documentation

such as the "CrowdStrike Falcon" or "SentinelOne" integration guides which list available actions).

2. NIST Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide": This foundational guide outlines the incident response lifecycle. Section 3.3.2

"Containment

" emphasizes that containment is critical for preventing further damage and that a major decision is whether to "disconnect it from a network." EDR quarantine is the modern

forensically-sound method of achieving this disconnection without powering down the system and losing volatile data.

3. Google Cloud Security Foundations Guide

"Incident response": In the section on "Containment strategies" (Page 10)

the guide lists "Isolate the affected systems" as a primary technique. It states

"You can isolate the affected systems from the rest of your environment by using firewall rules or other network access control mechanisms." EDR quarantine is a sophisticated and rapid form of this network isolation.

The most effective and intended method within Google SecOps is to use a YARA-L rule to directly join live event data with threat intelligence context. This rule would correlate the external IP address from a network connection event (UDM event) with Google's Applied Threat Intelligence Fusion Feed (graph.threat entity). By joining on the IP address, the rule can then filter for specific attributes within the Fusion Feed's graph data, such as a threat.threatname of "APT41" or other linked indicators. This approach leverages the core capability of the detection engine to perform real-time enrichment and correlation, providing a highly contextual and efficient detection.

A. This uses a static, manually managed list, failing to leverage the dynamic and comprehensive Applied Threat Intelligence Fusion Feed as required by the question.

C. This condition is too broad. It would trigger on any high-confidence threat, not specifically on indicators associated with the APT41 threat group.

D. This separates detection from enrichment. The question asks for the YARA-L rule to perform the identification, not to delegate the intelligence query to a SOAR playbook.

1. Google Cloud Documentation

"Use threat intelligence in rules": This document explicitly describes how to join UDM events with the graph.threat entity to enrich detections. It provides examples of filtering on threat attributes like threat.threatname

which directly supports the methodology in the correct answer. (See section: "Example: Detect connections to known malicious IP addresses").

2. Google Cloud Documentation

"YARA-L 2.0 language syntax": The match section of a YARA-L rule is designed to define joins between different data sets

such as events and threat intelligence entities. This document outlines the syntax for performing such joins

which is the core mechanism described in option B. (See section: "Match section").

3. Google Cloud Documentation

"Unified Data Model field list": This reference details the fields available for rule creation. A network connection rule would use fields like principal.ip (internal host) and target.ip (external IP). The join would be between udm.target.ip and the IP address indicator in the graph.threat entity. (See fields: principal.ip

target.ip).

Event Threat Detection (ETD) relies on Cloud Audit Logs to identify threats like data exfiltration. Specifically, to detect attempts to read and exfiltrate data from Cloud Storage or BigQuery, ETD requires Data Access audit logs of the "data read" type. The question emphasizes two key constraints: targeting only designated sensitive resources and minimizing logging costs. Enabling "data read" logs specifically and only for the sensitive buckets and datasets directly fulfills the detection requirement while being the most cost-effective approach, as Data Access logs can generate significant volume and cost if enabled broadly.

B: Including "data write" logs is unnecessary for detecting data exfiltration (a read activity) and would increase logging volume and costs, violating the minimization constraint.

C: Enabling logs for all resources is overly broad, directly contradicting the requirements to target only sensitive data and minimize costs.

D: VPC Flow Logs track network traffic but lack the application-layer context (e.g., user identity, specific data object) that ETD uses for its BigQuery and Cloud Storage exfiltration detectors.

1. Google Cloud Documentation

"Event Threat Detection detectors": Under the "Exfiltration" module

detectors like Exfiltration: BigQuery Read Rows Limit Exceeded and Exfiltration: Cloud Storage Egress Traffic explicitly list "Data Access audit logs" as the required log source. This confirms the necessity of these logs for the specified detection goal.

Source: Google Cloud

Security Command Center Documentation

"Event Threat Detection detectors"

section on "Exfiltration".

2. Google Cloud Documentation

"Cloud Audit Logs Overview": This document explains that Data Access audit logs "contain API calls that read the configuration or metadata of resources

as well as user-driven API calls that create

modify

or read user-provided resource data." It also states

"Because Data Access audit logs can be quite large

they are disabled by default". This supports the need to enable them selectively to minimize costs.

Source: Google Cloud

Cloud Logging Documentation

"Overview of Cloud Audit Logs"

section on "Data Access audit logs".

3. Google Cloud Documentation

"Configuring Data Access audit logs": This guide provides instructions on how to enable Data Access audit logs for specific services and resources

which is the action required by the correct answer. It demonstrates that logging can be configured granularly to meet security needs without enabling it organization-wide.

Source: Google Cloud

Cloud Logging Documentation

"Configuring Data Access audit logs"

section "Configure Data Access audit logs with the Google Cloud console".

This solution proposes using a Google SecOps SOAR job to automate the rule management lifecycle. The SOAR job would periodically fetch the list of currently restricted users, filtering out those whose five-day restriction has expired. It would then construct the YARA-L rule text with the updated user list and use the Chronicle API to deploy this new version of the rule. This approach centralizes the entire logic—data fetching, time-to-live (TTL) management, and rule deployment—into a single, maintainable automated workflow. While frequent rule deployment is not ideal for performance, it is a technically feasible and self-contained solution among the given options.

A. Detection rules, which run in the Chronicle SIEM component, cannot directly access or query data stored in Google SecOps SOAR global context values. This makes the proposed architecture non-functional.

C. This option is incorrect because Chronicle reference lists (referred to as data tables) do not support a multi-column structure with native time-to-live (TTL) functionality as described. The feature as stated does not exist.

D. Storing all users in a single, pipe-delimited row of a regex table is an improper and highly inefficient use of reference lists, which are designed to store one entry per row for optimal matching.

1. Chronicle Detection Engine API: The feasibility of option B is supported by the existence of the Chronicle Detection Engine API

which allows for programmatic creation and management of rules. A SOAR job can call this API to deploy updated rule versions.

Source: Google Cloud Documentation

"Chronicle Detection Engine API overview". See the section on the Rules service

which includes methods like CreateRule and DeleteRule.

2. Google SecOps SOAR Playbook Automation: SOAR playbooks can execute actions

including making HTTP requests to external APIs. This capability enables the SOAR job in option B to interact with the Chronicle API.

Source: Google Cloud Documentation

"Google SecOps SOAR overview". The documentation describes how playbooks automate security workflows by integrating various tools

which includes making API calls.

3. Chronicle Reference Lists (for disproving C): The structure of reference lists in Chronicle is a simple list of strings

CIDRs

or regular expressions

not a multi-column table. This confirms that the feature described in option C is not available.

Source: Google Cloud Documentation

"YARA-L 2.0 language syntax". The section on "Reference tables" describes them as a "list of values" and provides syntax like $event.field in %listname

which operates on a single list of items.

The roles/chronicle.viewer IAM role provides comprehensive read-only access to all Google SecOps features, which explicitly includes the ability to view detection engine rules. The organization uses Cloud Identity, making Google Groups the appropriate and standard mechanism for managing permissions for a collection of users. Granting the roles/chronicle.viewer role to a Google Group on the project containing the SecOps instance correctly fulfills all requirements of the scenario.

B. The roles/chronicle.limitedViewer role is incorrect because it specifically restricts access and does not permit users to view detection engine rules, which is a key requirement.

C. This is incorrect for two reasons: it uses a workforce identity pool, which is for external identity providers (not Cloud Identity), and it grants the editor role, which violates the read-only requirement.

D. This is incorrect because workforce identity pools are used to federate external identities, not for users managed within Cloud Identity, which is the organization's specified IdP.

1. Google Cloud Documentation

Google SecOps

"Control access with IAM": This document details the predefined IAM roles for Google SecOps.

Section: Predefined roles: It states

"Chronicle API Viewer (roles/chronicle.viewer): Provides read-only access to all Chronicle features." It also specifies

"Chronicle API Limited Viewer (roles/chronicle.limitedViewer): Provides read-only access to a limited set of Chronicle features. For example

users with this role cannot view rules." This directly supports why option A is correct and B is incorrect.

2. Google Cloud Documentation

Identity and Access Management

"Overview of IAM": This document explains the fundamental concepts of Google Cloud IAM.

Section: Principals: It describes how principals

including Google Groups

can be granted access to resources. This supports the use of a Google Group as the correct method for managing permissions for multiple users from Cloud Identity.

3. Google Cloud Documentation

Identity and Access Management

"Workforce identity federation": This document explains the purpose of workforce identity pools.

Section: Overview: It states

"Workforce identity federation lets you use an external identity provider (IdP) to authenticate and authorize a workforce...so that they can access Google Cloud services." This confirms that workforce pools are not the correct tool when Cloud Identity is the IdP

invalidating options C and D.

The most effective strategy is to leverage all available intelligence while accounting for data quality issues. The process hash is unreliable, but the C2 domain is a reliable indicator present in DNS logs. Creating a reference list (referred to as a data table) containing both the hash and the domain allows a single YARA-L rule to search for either indicator. A high-frequency rule is suitable for near real-time detection against high-volume data like DNS logs. This approach provides resilient coverage by detecting C2 activity via DNS lookups even when the process hash is missing, making it the most robust solution.

A. Searching for rundll32.exe is too broad and will generate excessive false positives, as it is a common and legitimate system process.

B. This approach is unreliable because the scenario explicitly states that process hashes are not consistently captured across all endpoints.

C. This rule still depends on the unreliable process hash, meaning it would fail to detect activity on many misconfigured endpoints.

1. Use reference lists in rules: Official Google Cloud documentation explains that reference lists are used to store and match against a large set of values

such as known malicious domains or file hashes

within a detection rule. This directly supports the creation of a data table (reference list) for the IOCs.

Source: Google Cloud Documentation

Chronicle SIEM

"Use reference lists in rules".

2. YARA-L 2.0 language syntax: The syntax for YARA-L rules allows for complex logic

including checking fields against reference lists. A rule can be written to match a DNS query to the C2 domain list or a process hash to the hash list.

Source: Google Cloud Documentation

Chronicle SIEM

"YARA-L 2.0 language syntax"

Section: "Language overview".

3. How Detection Engine works: This document describes the different types of rules

including high-frequency rules designed for near real-time detection on high-volume log sources like DNS

which aligns with the proposed solution of using the C2 domain for alerting.

Source: Google Cloud Documentation

Chronicle SIEM

"How Detection Engine works"

Section: "Rule execution".

The most effective method to reduce false positives from a threat intelligence-based rule is to increase its specificity. Threat intelligence feeds often contain indicators with varying confidence and severity levels. By modifying the YARA-L rule to only trigger on indicators where the Unified Data Model (UDM) field graph.metadata.threat.severity is marked as "critical" or "high," you filter out lower-confidence or informational indicators that are common sources of noise. This directly addresses the issue of excessive false positives while retaining the core function of using high-fidelity threat intelligence for alerting.

A. Converting the rule to a dashboard does not reduce false positives; it only changes the output from an alert to a visualization, failing to solve the underlying issue of the noisy rule logic.

C. The riskscore is typically an outcome of a detection, contributing to an entity's overall risk. Using it as a primary filter within the rule itself is not the standard or most direct way to tune the rule's event-matching logic.

D. Increasing the match window from 2 minutes to 24 hours would likely increase, not decrease, the number of false positives by expanding the pool of events for correlation.

1. Google Cloud Documentation

Unified Data Model field list: The graph.metadata.threat.severity field is defined as part of the UDM schema to represent the severity of a threat associated with an indicator. This confirms the field's existence and intended use for filtering.

Source: Google Cloud

Chronicle Security Operations

"Unified Data Model field list"

Section on Threat.

2. Google Cloud Documentation

YARA-L 2.0 language syntax: The syntax for YARA-L rules allows for conditions in the events section to filter events based on the values of specific UDM fields. A condition like $event.graph.metadata.threat.severity = "CRITICAL" is a standard implementation.

Source: Google Cloud

Chronicle Security Operations

"YARA-L 2.0 language syntax"

Section: "Events section".

3. Google Cloud Documentation

Detection engine best practices: Official guidance on reducing false positives in rules emphasizes adding more specific criteria to the rule logic. Filtering on threat severity is a primary example of making a rule more specific and reducing noise from lower-priority intelligence.

Source: Google Cloud

Chronicle Security Operations

"Best practices for rules and detections"

Section: "Reduce false positives".

The most effective way to detect a "silent source" is to monitor for the absence of expected data. A Cloud Monitoring metric-absence alerting policy is specifically designed for this scenario. It triggers an alert when no data points are received for a particular metric time series (identified here by collectorid) within a specified duration. By setting this duration to five minutes, you create a proactive and automated notification system that precisely meets the requirement of detecting silent forwarders or agents in a timely manner.

A. An alert on total log count might not trigger if a forwarder goes offline completely and stops sending metrics altogether, including a metric with a zero value. Metric-absence detects the lack of the metric itself.

C. A Looker dashboard is a passive visualization tool. It requires manual observation to detect an issue and does not provide the proactive, automated alerting required by the scenario.

D. Similar to a Looker dashboard, the native Google SecOps dashboard is for visualization and investigation, not for creating automated, time-sensitive alerts based on the absence of data.

1. Google Cloud Documentation

"Alerting on metric absence": This document explicitly states

"You can use a metric-absence alerting policy to notify you when a resource stops sending data... For example

if you have a process that is expected to write a data point to a time series every minute

you can create a policy that notifies you if you don't see a data point for five minutes." This directly maps to the question's scenario.

Source: Google Cloud Documentation

Cloud Monitoring

"Alerting on metric absence".

2. Google Cloud Documentation

"Create metric-absence alerting policies (UI)": This guide details the configuration steps. In the "Configure alert trigger" section

it shows how to set the "Alert trigger" to "Metric Absence" and configure the "Absence duration" (e.g.

5 minutes)

confirming the technical feasibility of the correct answer.

Source: Google Cloud Documentation

Cloud Monitoring

"Create metric-absence alerting policies (UI)".

3. Google Cloud Documentation

"Chronicle ingestion metrics": This page lists the metrics available for monitoring Google SecOps ingestion

such as chronicle.googleapis.com/ingestion/logentrycount. It also specifies the available metric labels

including collectorid

which allows for creating distinct time series for each forwarder or agent

as required by the question.

Source: Google Cloud Documentation

Chronicle

"Chronicle ingestion metrics".

Event Threat Detection (ETD) is the Security Command Center (SCC) service designed to detect threats by analyzing platform and project logs. ETD custom modules provide the capability to create user-defined detection rules that augment the built-in detectors. The "Configurable Bad IP" template is a predefined module specifically for ingesting a list of known Indicators of Compromise (IoCs)—in this case, malicious IP addresses—as an external signal. When logs, such as VPC Flow Logs, show traffic to or from an IP on this list, the custom module generates a finding in SCC, fulfilling the exact requirements of the scenario.

A. Custom postures are used to define and monitor compliance against a desired security state by grouping existing detectors; they do not create new detectors based on external IoCs.

B. Security Health Analytics (SHA) custom modules are for detecting misconfigurations in Google Cloud resource properties (posture management), not for detecting threats from activity logs using external IoCs.

D. Creating a custom log sink and using the SCC API is a complex, manual approach. ETD custom modules offer a native, fully integrated, and more efficient solution for this specific use case.

1. Google Cloud Documentation

Security Command Center

"Overview of Event Threat Detection custom modules": This document explicitly states

"Event Threat Detection custom modules let you create your own detection rules to complement Google Cloud's built-in Event Threat Detection detectors... To create a custom module

you can use a module template that Google Cloud provides." It lists CONFIGURABLEBADIP as a supported template.

2. Google Cloud Documentation

Security Command Center

"Create and manage Event Threat Detection custom modules": Under the section "Module templates

" the CONFIGURABLEBADIP template is described. It specifies that this template detects connections from a list of IP addresses that you provide

using sources like VPC Flow Logs. This directly supports using external IoC lists for detection.

3. Google Cloud Documentation

Security Command Center

"Create and manage custom modules for Security Health Analytics": This page clarifies the purpose of SHA custom modules: "With custom modules for Security Health Analytics

you can define your own detection policies for your Google Cloud resources... A custom module checks the properties of the resources that you specify in the module." This confirms its role in configuration checking

not threat detection from logs.

In Google Security Operations (SecOps) SOAR, a playbook automates response workflows. When an integration like VirusTotal returns data, the playbook must process it to make decisions. A conditional statement (e.g., an if/else block) is the fundamental playbook component for this.

First, a conditional statement is used to evaluate the VirusTotal output (e.g., malicious detections > 0) to make a recommendation and classify the URL as suspicious or benign (A). Second, based on the specific number of malicious detections returned in the JSON response, another conditional statement can be used to programmatically set the alert's severity to an appropriate level, such as Low, Medium, High, or Critical (E). These two actions directly fulfill the requirements using standard SOAR automation logic.

B. Pass the response back to the SIEM.

This action doesn't involve processing or decision-making within the playbook itself; it merely forwards raw data without making a recommendation or setting severity.

C. Verify that the response is accurate by manually checking the URL in VirusTotal.

This contradicts the primary purpose of SOAR, which is to automate repetitive tasks. A playbook should not require manual intervention for a routine data enrichment step.

D. Create a widget that translates the JSON output to a severity score.

Widgets in Google SecOps are for data visualization and presentation within the case view, not for implementing the core automation logic that sets an alert's properties.

1. Google Cloud Documentation

Chronicle SOAR

"Use conditional statements": This document explains how to use conditional branches (If

Else If

Else) to control the flow of a playbook based on the outputs of previous steps

such as an integration's JSON response. This directly supports using conditionals to evaluate VirusTotal results and take actions like setting severity. (See section: "Configure the If branch").

2. Google Cloud Documentation

Chronicle SOAR

"Playbook overview": This document outlines the purpose of playbooks

which is to "automate the security response workflow by codifying security processes." This includes enrichment (VirusTotal lookup)

logic (conditionals)

and response (setting severity)

confirming that options A and E are core playbook functions

while C (manual steps) is an anti-pattern.

3. Google Cloud Documentation

Chronicle SOAR

"Marketplace and integrations": This page describes how integrations like VirusTotal are used within playbooks to provide data that informs subsequent actions. The output

typically JSON

is parsed and used as input for other playbook blocks

such as conditional statements and actions to modify alert fields. (See section: "Use an integration in a playbook").

The recommended Google-native approach is to deploy the Google Cloud Ops Agent in the on-premises environment. The Ops Agent can be configured with a Syslog receiver to listen for logs from the firewalls on a specified port. The agent then forwards these logs to Google Cloud Logging. From Cloud Logging, a log sink can be configured to route the firewall logs directly to your Google Security Operations instance. This creates a fully supported and integrated data pipeline using Google Cloud components for ingestion, routing, and analysis.

B. Pull the firewall logs by using a Google SecOps feed integration.

Syslog is a push-based protocol where devices send logs to a collector. A pull-based feed integration is the incorrect mechanism for this protocol.

C. Deploy a third-party agent (e.g., Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.

While technically a valid method, using the Google Ops Agent (Option A) provides a more integrated, native solution within the Google Cloud ecosystem, which is the preferred approach.

D. Set the Google SecOps URL instance as the Syslog destination.

Google SecOps does not ingest data via a direct, unauthenticated Syslog URL. Ingestion requires a properly configured forwarder or API client that handles authentication and data formatting.

1. Google Cloud Documentation

Ops Agent Configuration: The official documentation details how to configure the Ops Agent to receive logs using the Syslog protocol. See the receivers section in the configuration example.

Source: Google Cloud

"Ops Agent configuration"

logging-receiver-syslog section. Available at: https://cloud.google.com/logging/docs/agent/ops-agent/configuration#syslog-receiver

2. Google Cloud Documentation

Routing Logs to Chronicle: This document explicitly describes the process of creating a log sink in Cloud Logging to forward logs to a Google SecOps (Chronicle) instance

which is the second part of the solution described in the correct answer.

Source: Google Cloud

"Route logs to Chronicle". Available at: https://cloud.google.com/logging/docs/export/configure-export-chronicle (See "Before you begin" and "Create a sink" sections).

3. Google Cloud Documentation

Ingesting On-Premises Data: The overview of data ingestion for Google SecOps describes using forwarders on-premises to collect data

which aligns with the architectural pattern of using an agent as a Syslog destination. The Ops Agent serves this function in the Google-native workflow.

Source: Google Cloud

"Ingest Google Cloud data to Chronicle". Available at: https://cloud.google.com/chronicle/docs/data-ingestion/ingest-gcp-data (This page describes the Cloud Logging to Chronicle path as a primary method for GCP services

a pattern extended to on-premises via the Ops Agent).

The most effective and streamlined approach is to leverage the AI capabilities within Google Security Operations. Gemini can generate a relevant playbook from a natural language description of the incident (remote shell) and the desired objectives. This accelerates the initial creation process significantly. The generated playbook serves as a strong foundation that can then be customized with environment-specific details and integrations. Finally, testing the playbook against a simulated alert ensures it is functional and ready for junior analysts to execute, meeting the core requirements of speed and usability.

A. This option incorrectly merges the act of playbook creation with a specific response action (filtering IPs). The primary task is to create the playbook, not execute a single step from it.

B. This describes a slow, manual process that relies on a senior analyst and does not leverage the advanced, time-saving tools available in Google Security Operations as specified in the prompt.

D. This is a generic, manual approach that fails to utilize the specific Google Security Operations tools (like Gemini) that the question explicitly requires for streamlining the creation process.

1. Google Cloud Documentation

"Use Gemini for Security Operations": In the section "Generate a playbook

" the documentation states

"Gemini can generate a new playbook from a natural language description. You can then customize the playbook in the playbook editor." This directly supports the process outlined in option C.

2. Google Cloud Blog

"Introducing Gemini in Security Operations: A new era of AI-powered security" (April 9

2024): This official announcement highlights the capability for analysts to "simply describe the workflow they want to automate in natural language

and Gemini will generate the recommended playbook in minutes." This confirms the speed and methodology central to the correct answer.

3. Google Cloud Documentation

"Chronicle SOAR playbooks overview": This document establishes the context for playbooks as "a set of defined steps and actions that are taken in response to a security alert." The process of creating

customizing

and testing a playbook

as described in option C

is fundamental to the Chronicle SOAR platform's operation.