Data management (14%): Log ingestion and normalization, establishing baselines for security telemetry, prioritizing and triaging log data, configuring data retention and access controls, and using Cloud Logging and Audit Logs for investigation.

Threat hunting (19%): Proactive threat hunting using YARA‑L language, leveraging threat intelligence feeds, behavioral analytics and anomaly detection, developing hunting hypotheses and playbooks, and validating findings against security posture.

Detection engineering (22%): Writing detection rules in YARA‑L, implementing detection mechanisms across SecOps and SCC, testing and tuning detection rules for false positives, mapping detections to MITRE ATT&CK techniques, and automating response actions for detections.

Incident response (21%): Containment strategies for cloud incidents, investigation workflow using Security Command Center, developing and executing incident response playbooks, coordinating response automation and orchestration, and post‑incident analysis and lessons learned.

Observability (10%): Designing dashboards for security monitoring, configuring alerts and notifications, monitoring key security metrics and KPIs, integrating observability data with incident response, and using Cloud Monitoring and Logging for visibility.

B) Write a YARA-L rule analyzing target.user fields in Cloud Audit Logs to identify any API calls containing "serviceAccountKeyAdmin".

C) Write a YARA-L rule using metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS" filtering for the specific role addition in the Cloud Audit Logs (Admin Activity).

D) Configure a Cloud Monitoring alert that triggers whenever the IAM API quota utilization spikes abruptly.

E) Develop a YARA-L rule that triggers on any USER_LOGIN event originating from an IP address outside your corporate network.

F) Write a YARA-L rule that monitors Google Workspace logs for password resets on administrator accounts.

Correct Answer: C

Overall Explanation: Admin Activity Cloud Audit Logs capture API calls that modify resource configurations or metadata, including IAM policy changes. YARA-L is specifically designed to parse these structured logs in Google SecOps.

Explanation B (Incorrect): Searching for string matches without specifying the event type or context is inefficient and will likely result in a massive amount of false positives.

Explanation C (Correct): This accurately targets the specific audit event type (USER_RESOURCE_UPDATE_PERMISSIONS) generated when IAM policies change, ensuring high-fidelity detection.

Explanation D (Incorrect): Quota utilization spikes do not provide context on what specific roles were granted; they only show API usage volume.

Explanation E (Incorrect): A remote login event does not indicate that a privilege escalation or IAM role change has occurred.

Explanation F (Incorrect): Google Workspace password resets do not track Google Cloud IAM role assignments.

B) Restart the Compute Engine instance to terminate the active malicious processes.

C) Apply a restrictive VPC firewall rule to the instance's network tag that blocks all egress and ingress traffic except for forensic access.

D) Disable the Cloud Billing account associated with the project to freeze all resource activity.

E) Export the instance's Cloud Audit Logs to a Cloud Storage bucket and then suspend the project.

F) Change the compromised instance's machine type to an f1-micro to limit the computational power available for mining.

Correct Answer: C

Overall Explanation: Incident containment aims to stop the immediate threat from spreading or communicating while preserving the state of the compromised machine for root cause analysis and forensic investigation.

Explanation B (Incorrect): Restarting clears the RAM, destroying running malicious processes and vital forensic data, and the malware may just run again on boot.

Explanation C (Correct): Isolating the instance using strict firewall rules immediately stops the C2 communication while keeping the instance running for forensic memory capture and disk imaging.

Explanation D (Incorrect): Disabling billing impacts all resources in the project, causing a massive, unnecessary denial of service for legitimate workloads.

Explanation E (Incorrect): Suspending the entire project impacts all other operational instances and services, not just the compromised one.

Explanation F (Incorrect): Changing the machine type requires a reboot (destroying evidence) and does not stop the network communication with the C2 server.

B) VPC Flow Logs and Google Kubernetes Engine (GKE) container stdout logs.

C) Cloud Audit Logs (Admin Activity and Data Access) and Google Cloud Identity logs.

D) Compute Engine serial console logs and Cloud SQL slow query logs.

E) App Engine application logs and Cloud Functions execution logs.

F) Cloud CDN cache hit logs and Cloud Armor WAF rule evaluation logs.

Correct Answer: C

Overall Explanation: For security operations, establishing identity behavior and administrative actions is the highest priority for detecting unauthorized access, lateral movement, and privilege escalation.

Explanation B (Incorrect): stdout logs contain application data, and VPC Flow logs are network-centric; neither provides the rich identity context needed as a primary baseline.

Explanation C (Correct): Admin Activity logs track all infrastructure changes, Data Access logs track who accessed what data, and Cloud Identity logs provide authentication context. These are critical for mapping user behavior.

Explanation D (Incorrect): Serial console and slow query logs are operational/troubleshooting logs, not foundational security telemetry sources.

Explanation E (Incorrect): Application and execution logs are developer-focused and lack the centralized IAM and resource modification context needed for a SOC baseline.

Explanation F (Incorrect): CDN and WAF logs are edge-focused. They are important for perimeter defense but do not establish internal behavioral baselines.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app