Incident response Questions
Practice questions for Incident response topic in Google Professional Security Operations Engineer. 42 questions covering this domain.
In a Security Command Center Enterprise environment integrated with a ticketing system, who is responsible for remediating findings by default?
In the documented threat-finding flow for Security Command Center Enterprise, which module groups and enriches alerts into cases?
In Security Command Center Enterprise, what is the primary purpose of a case?
A SOC wants findings from the same Google Cloud project to be grouped into the same case even when their severities differ. Which grouping change best...
By default, which attributes are used by the Security Command Center Enterprise grouping mechanism to place findings into cases?
A SOAR analyst wants a single place to review assigned work, pending actions, and cases. Which Google SecOps SOAR area is designed for that?
A muted finding in a Security Command Center Enterprise case has severity Critical, while all other findings are High. What priority does the case hav...
An organization wants findings with missing inherited tags or Essential Contacts to still group correctly into cases under the right owner. What shoul...
What happens to an alert that is linked to a case when the case is closed after investigation?
A team has integrated a ticketing system and expects threat cases to get tickets automatically. Which statement is correct by default?
A SOC wants to ensure that no playbook action accidentally targets production assets during testing. Which approach is recommended?
Which Google SecOps SOAR construct represents the automated workflow that runs in response to an alert or case?
A SOC wants playbooks to automatically isolate compromised endpoints in an EDR solution when a high-severity alert fires. Which approach should be use...
Which SOAR component automatically updates a case with collected information and findings during playbook execution?
Which Google SecOps SOAR feature lets analysts collaborate with subject-matter experts inside a case context?
An IR team wants Security Command Center Enterprise to automatically open SOAR cases for new high-severity findings and assign them to the cloud asset...
Which Google SecOps SOAR feature lets administrators define which actions can be executed automatically vs. require human approval, based on risk?
A team wants playbooks to extract values from alert data to drive subsequent actions automatically. Which SOAR feature provides this?
A SOAR playbook must wait for a manager's approval before performing a destructive action. Which playbook construct supports this?
An incident responder needs to track tasks, owners, and SLA timers for an active incident. Which SOAR capability is recommended?
Sign in to see all 42 questions
Create a free account to browse all questions — completely free during our launch phase.