Exam Security-Operations-Engineer Topic 1 Question 128 Discussion

Actual exam question for Google's Security-Operations-Engineer exam
Question #: 128
Topic #: 1

Your organization requires the SOC director to be notified by email of escalated incidents and their results before a case is closed. You need to create a process that automatically sends the email when an escalated case is closed. You need to ensure the email is reliably sent for the appropriate cases. What process should you use?

A. Create a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email. B. Use the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director. C. Write a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director. D. Navigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director. Use the Close Case action in the UI to close the case.

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business