Your organization requires the SOC director to be notified by email of escalated incidents and their results before a case is closed. You need to create a process that automatically sends the email when an escalated case is closed. You need to ensure the email is reliably sent for the appropriate cases. What process should you use?

• A. Write a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director.
• B. Create a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email.
• C. Navigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director Use the Close Case action in the UI to close the case.
• D. Use the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director.

Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?

• A. Configure and deploy a Google SecOps forwarder.
• B. Configure and deploy a Bindplane collection agent.
• C. Configure direct ingestion from your Google Cloud organization.
• D. Configure a third-party API feed in Google SecOps.

Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

• A. Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.
• B. In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
• C. Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
• D. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.

Your Google Security Operations (SecOps) SOAR integration with Security Command Center (SCC) uses a service account that currently has read access to the findings at the organization level. Google SecOps SOAR successfully reads SCC finding data, but actions attempting to update the finding states consistently fail with a permission denied error. You need to resolve this error while following the principle of least privilege. What should you do?

• A. Regenerate the service account key, and update the credentials in Google SecOps SOAR.
• B. Grant the service account the roles/iam.serviceAccountUser IAM role to itself.
• C. Grant the service account the roles/securitycenter.findingsBulkMuteEditor IAM role at the organization level.
• D. Grant the service account the roles/securitycenter.findingsEditor IAM role at the organization level.