You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?

• A. Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.
• B. Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
• C. Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.
• D. Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.

You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

• A. Remove user accounts that have repeated invalid login attempts.
• B. Enable default curated detections to automatically block suspicious IP addresses.
• C. Look for correlations across impacted users in the Risk Analytics dashboard.
• D. Use UDM Search to query historical logs for recent IOCS associated with the suspicious login attempts.

A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?

• A. Increase alert thresholds globally
• B. Disable medium-severity rules
• C. Limit alerts to business hours
• D. Apply risk-based alert scoring and entity correlation

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on- premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

• A. Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
• B. Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
• C. Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
• D. Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.