Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead. What should you do?

• A. Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
• B. Create a Cron Scheduled Connector for this use case Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.
• C. Use a VM to host a script that runs a playbook via an API call.
• D. Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
• B. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• C. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
• D. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)

• A. Correlate events based on the asset role or classification such as database or user workstation.
• B. Filter for events using protocol-level attributes that indicate RDP connections.
• C. Filter for RDP connections with non-standard ports.
• D. Use a saved search to identify all events with the LATERAL_MOVEMENT tag over the past 30 days.
• E. Group events by user identity and time to identify repeated access patterns.

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process.
Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

• A. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
• B. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
• C. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.
• D. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.

You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?

• A. In Google SecOps Playbooks, create a playbook for each customer.
• B. In Google SecOps SOAR settings, create a permissions group for each customer.
• C. In Google SecOps SOAR settings, create a role for each customer.
• D. In Google SecOps SOAR settings, create a new environment for each customer.