You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCS in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?

• A. Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC- Score) is between 60% and 80%.
• B. Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
• C. Configure alert grouping for the most repetitive alerts.
• D. Implement curated detections instead of custom YARA-L rules.

You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?

• A. Run raw log searches using the IP address as a search term.
• B. On the Alerts & IOCS page, review results and entries where the IP address appears.
• C. Write a YARA-L 2.0 detection rule that searches for events with the IP address.
• D. Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.

You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?

• A. Design and develop a custom parser.
• B. Implement middleware to modify the underlying data structure.
• C. Apply any pending updates to the prebuilt parser.
• D. Implement a parser extension on top of the prebuilt parser.

You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

• A. Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
• B. Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
• C. Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
• D. Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

• A. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
• B. Add an exception in the detection rule to exclude matches originating from specific asset groups.
• C. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
• D. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.