PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #44
Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response…
The correct answer is C. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to. The correct solution is to configure the SCC notifications feed to Pub/Sub and then use a Cloud Run function triggered by new events in the topic to call the SOC ticketing system's API. This automates ticket creation for findings, integrates seamlessly with the existing SOC…
Question
Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process and integrate with the existing SOW ticketing system. How should you implement this functionality?
Options
- AEvaluate each event within the SCC console. Create a ticket for each finding in the ticketing
- BUse the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant
- CConfigure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to
- DDisable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and
How the community answered
(19 responses)- A11% (2)
- B5% (1)
- C79% (15)
- D5% (1)
Explanation
The correct solution is to configure the SCC notifications feed to Pub/Sub and then use a Cloud Run function triggered by new events in the topic to call the SOC ticketing system's API. This automates ticket creation for findings, integrates seamlessly with the existing SOC process, and minimizes manual intervention while ensuring timely response.
Topics
Community Discussion
No community discussion yet for this question.