Questions

What are the two search modes available in Chronicle Security Information and Event Management (SIEM)?

 

Select one that applies, and then click Submit.

• Regex and field query
• Unified Data Model (UDM) Search and grep regex
• Unified Data Model (UDM) Search and Raw Log Scan
• Unified Data Model (UDM) Search and YARA-L

 

What are the extract functions used in Google’s Configuration-based Normalization?

 

Select one that applies, and then click Submit.

• JSON, XML, KV, GROK, and CSV
• JSON, TSV, KV, and CSV
• XML, KV, CSV, TSV, and SQL
• XML, KV, and CSV

 

When considering parsing in Chronicle Security Information and Event Management (SIEM), a data source must always be associated with what?

 

Select one that applies, and then click Submit.

• Metadata event type
• Data Application Programming Interface (API)
• Metadata path
• Data label

 

What string function can be used to decode encoded command lines, especially in PowerShell?

 

Select one that applies, and then click Submit.

• strings.decode
• strings.base64_decode
• strings.hashmatch
• strings.encode

 

What two operators in YARA-L create a sliding window of time that will match events in a specific order?

 

Select one that applies, and then click Submit.

• until, after
• before, gt
• lt, gt
• before, after

 

What is the maximum time range for a match section of a multi-event rule in YARA-L?

 

Select one that applies, and then click Submit.

• 1 day
• 1 week
• 48 hours
• 72 hours