Questions

 

When writing regular expressions in Google SecOps it is best to combine multiple regex statements into one, when possible and to use built-in functions instead of building your own patterns. Which of the following is a built-in function to YARA-L?

 

• net.ip_range_in_cidr
• uint.cc_number
• text.hash_id
• number.postal_code

 

 

UDM has two major types of data, one is Event data and the other is Entity data. What are the 3 types of Entity Sources?

 

• Time Context, Device Context, Domain Context
• Entity Context, Derived Context, Global Context
• Name Context, IP Context, Hash Context
• Local Context, Inferred Context, Universal Context

 

 

Playbook Views in Google SecOps can do several things, but which of the following are NOT one a feature of Playbook Views?

 

• Run a playbook
• Display HTML widgets
• Display highlighted entities
• Customizable by user role

 

 

A commonly used set of actions can be saved as a block. In addition to saving the operator time and reproducibility, which of the following is a benefit of using blocks?

 

• A block can merge playbooks
• Custom python code must be contained in a block
• Additional functions are accessible in a block
• Updating a block, updates it everywhere.

 

 

When creating a Playbook in Google SecOps, it is important to understand how playbooks will be triggered. How is a playbook triggered?

 

• Manual Intervention
• Cases
• Rules
• Alerts

 

 

There are two methods that can be used to manage Google SecOps parsers (CBNs), what are they?

 

• Parser Management UI, CLI Tool
• Parser Extension UI, gcloud parser terminal
• CBN Parser API Extension, logstash graph interface
• Parser Management UI, grok TUI