Questions

 

According to the SecOps Technical Overview & Architecture what API can be used to provision the SIEM component of a SecOps deployment?

 

• Customer Management API
• Chronicle Provisioning API v1
• Backstory Deployment API
• SecOps Management API

 

 

Which Google SecOps capability reduces operator toil and MTTR?

 

• Telemetry Collection
• Analytics & Detection
• Alert Triage & Automated Response
• Applied Threat Intel & ML

 

 

What three components make up the Google SecOps Entity Context Graph (ECG).

 

• Entity Context, Derived Context, Global Context
• Entity Context, Asset Context, Time Domain Context
• Host Context, Process Context, Time Domain Context
• Entity Context, Global Context, Local Context

 

 

In the SecOps Technical Overview & Architecture what programming interface allows you to connect to the APIs without constructing your own tooling?

 

• SecOps Template System (SOTS)
• SecOps CLI
• Google SecOps Swagger Interface
• SecOps Notebook

 

 

The rule language in Google SecOps was designed for what purpose?

 

• Metric Visualization
• Threat Detection
• Data Analytics
• Business Intelligence

 

 

Simulating a case in Google SecOps is a powerful way to develop and test various objects SOAR, most notably Playbooks. Which of the following actions CANNOT be taken by the analyst using a simulation?

 

• All of these actions are possible.
• Ingest a simulated case as a Test case
• Assign a simulated case
• Choose the environment in which the simulation takes place