You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool.
You must recommend a tool to your leadership team as quickly as possible. What should you do? (Choose two.)

• A. Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
• B. Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.
• C. Review the architecture of the tool to identify the cloud provider that hosts the tool.
• D. Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
• E. Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Add an exception in the detection rule to exclude matches originating from specific asset groups.
• B. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
• C. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• D. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

• A. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
• B. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
• C. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
• D. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

• A. Closing all related alerts
• B. Adding more analysts
• C. Increasing log retention
• D. Updating detections, playbooks, and IAM controls based on lessons learned