You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)

• A. Use a saved search to identify all events with the LATERAL MOVEMENT tag over the past 30 days.
• B. Filter for events using protocol-level attributes that indicate RDP connections.
• C. Group events by user identity and time to identify repeated access patterns.
• D. Correlate events based on the asset role or classification such as database or user workstation.
• E. Filter for RDP connections with non-standard ports.

Which Google Cloud log source is MOST critical for detecting unauthorized IAM role changes?

• A. Cloud Audit Logs - Admin Activity
• B. Firewall Rules logs
• C. Cloud DNS logs
• D. VPC Flow Logs

Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?

• A. Use Gemini to generate YARA-L rules for multi-cloud use cases.
• B. Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.
• C. Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.
• D. Use curated detections from the Cloud Threats category to monitor your cloud environment.

You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCS from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?

• A. Create a list in Google Security Operations (SecOps), and grant the required access to the other teams.
• B. Create a new threat graph in Google Threat Intelligence, and share the graph with the other teams.
• C. Export the IOCS from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams.
• D. Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams.

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

• A. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
• B. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.
• C. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
• D. Configure the Windows server to send an email notification if there is an error in the Bindplane process.