Exam Security-Operations-Engineer Topic 3 Question 13 Discussion
Actual exam question for Google's Security-Operations-Engineer exam
Question #: 13
Topic #: 3
Question #: 13
Topic #: 3
Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps.
How should you achieve this?
How should you achieve this?
Suggested Answer: D Vote an answer
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
To enforce a specific categorization requirement at the time of case closure, you must customize the Close Case dialog. This feature in Google SecOps SOAR allows administrators to mandate specific fields that analysts must complete before a case can be resolved.
The documentation on Case Management states: "You can customize the Close Case dialog box to require analysts to provide specific information before closing a case... You can add custom fields, such as Root Cause, and define the values that populate the list." By adding the "five DLP event types" as options in the Root Cause dropdown within the Close Case settings, you ensure that analysts cannot close a DLP case without selecting one of these defined types. Options A, B, and C relate to tagging or naming during the active investigation phase and do not enforce the data entry requirement strictly "when the case is closed" as requested.
References: Google Security Operations Documentation > Case Management > Customize the Close Case dialog
To enforce a specific categorization requirement at the time of case closure, you must customize the Close Case dialog. This feature in Google SecOps SOAR allows administrators to mandate specific fields that analysts must complete before a case can be resolved.
The documentation on Case Management states: "You can customize the Close Case dialog box to require analysts to provide specific information before closing a case... You can add custom fields, such as Root Cause, and define the values that populate the list." By adding the "five DLP event types" as options in the Root Cause dropdown within the Close Case settings, you ensure that analysts cannot close a DLP case without selecting one of these defined types. Options A, B, and C relate to tagging or naming during the active investigation phase and do not enforce the data entry requirement strictly "when the case is closed" as requested.
References: Google Security Operations Documentation > Case Management > Customize the Close Case dialog
by Sylvia at Feb 13, 2026, 10:30 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).