メインコンテンツへスキップ

ホーム Google Cloud

コース

Detect, Respond, and Recover from Cloud Cybersecurity Attacks

中級スキルレベル

更新日 2026/07

In this course, you’ll focus on developing capabilities in logging, security, and alert monitoring, along with techniques for mitigating attacks.

コースを無料で開始

Google CloudCloud

26時間15分

50 ビデオ

197 演習

10,050 XP

修了証明書

何千もの企業の従業員が支持

チームのトレーニングを担当していますか？

Businessをお試しください

コース説明

This is the fourth of five courses in the Google Cloud Cybersecurity Certificate. In this course, you’ll focus on developing capabilities in logging, security, and alert monitoring, along with techniques for mitigating attacks. You'll gain valuable knowledge in customizing threat feeds, managing incidents, handling crisis communications, conducting root cause analysis, and mastering incident response and post-event communications. Using Google Cloud tools, you'll learn to identify indicators of compromise and prepare for business continuity and disaster recovery. Alongside these technical skills, you'll continue updating your resume and practicing interview techniques.

前提条件

このコースに受講要件はありません

1

Detection foundations

In this module, you’ll delve into crucial topics for detecting security activities, focusing on log retention policies, intrusion detection and prevention systems, and the intricacies of monitoring and alerts. You'll learn about incident management and attack mitigation strategies. Additionally, the section will guide you through logging fundamentals and monitoring best practices, equipping you with the knowledge to effectively manage and respond to security incidents.

Introduction to course 4

Course 4 overview

Seline: Make an impact in cloud security

Helpful resources and tips

Lab technical tips

Explore your course 4 scenario: Cymbal Bank

Welcome to module 1

SecOps and its components

Essential SecOps skills

Vulnerability management techniques

Vulnerability scanning, penetration testing, and tabletop exercises

AI in SecOps: Red teams

Test your knowledge: Security operations foundations — Question 1

Test your knowledge: Security operations foundations — Question 2

Test your knowledge: Security operations foundations — Question 3

Test your knowledge: Security operations foundations — Question 4

Incident detection basics

Phases of incident response and management

Incident response plans

More about incident response phases

Intrusion detection systems

Signature and anomaly-based detection

Test your knowledge: Incident management foundations — Question 1

Test your knowledge: Incident management foundations — Question 2

Test your knowledge: Incident management foundations — Question 3

Test your knowledge: Incident management foundations — Question 4

Logs for analysis and monitoring

Log types: A breakdown

Log management: The skills needed for success

Test your knowledge: Logging and log retention fundamentals — Question 1

Test your knowledge: Logging and log retention fundamentals — Question 2

Test your knowledge: Logging and log retention fundamentals — Question 3

Test your knowledge: Logging and log retention fundamentals — Question 4

Alerts and notifications

Alert search techniques

Alert and log optimization

Guide to event threat detection

Determine the difference between normal activity and an incident

Test your knowledge: Alerts, notifications, and log optimization — Question 1

Test your knowledge: Alerts, notifications, and log optimization — Question 2

Test your knowledge: Alerts, notifications, and log optimization — Question 3

Test your knowledge: Alerts, notifications, and log optimization — Question 4

Glossary terms from module 1

Module 1 challenge — Question 1

Module 1 challenge — Question 2

Module 1 challenge — Question 3

Module 1 challenge — Question 4

Module 1 challenge — Question 5

Module 1 challenge — Question 6

Module 1 challenge — Question 7

Module 1 challenge — Question 8

Module 1 challenge — Question 9

Module 1 challenge — Question 10

チャプターを開始

2

Detection in practice

In this module, you’ll delve into the intrusion kill chain, false positive analysis, and threat hunting techniques through the lens of incident management and attack mitigation. You’ll also learn how to create detection rules, use query tools to analyze logs and identify indicators of compromise (IoC).

Welcome to module 2

Introduction to Lockheed Martin’s Cyber Kill Chain®

False positive analysis

Lockheed Martin’s Cyber Kill Chain® in practice

Guide to false positive analysis

Explore false positives through incident detection

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 1

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 2

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 3

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 4

Introduction to security monitoring

Tim: Analytical skills for detection and response

Security monitoring key concepts

Tools for proactive security monitoring

Test your knowledge: Proactive security monitoring and alerting — Question 1

Test your knowledge: Proactive security monitoring and alerting — Question 2

Test your knowledge: Proactive security monitoring and alerting — Question 3

Test your knowledge: Proactive security monitoring and alerting — Question 4

Indicators of compromise (IOCS)

Essentials of threat hunting

IOCs for threat detection

Aggregations and correlations

Introduction to query tools

Query tools: RegEx and YARA-L

Test your knowledge: Threat hunting and indicators of compromise — Question 1

Test your knowledge: Threat hunting and indicators of compromise — Question 2

Test your knowledge: Threat hunting and indicators of compromise — Question 3

Test your knowledge: Threat hunting and indicators of compromise — Question 4

Glossary terms from module 2

Module 2 challenge — Question 1

Module 2 challenge — Question 2

Module 2 challenge — Question 3

Module 2 challenge — Question 4

Module 2 challenge — Question 5

Module 2 challenge — Question 6

Module 2 challenge — Question 7

Module 2 challenge — Question 8

Module 2 challenge — Question 9

Module 2 challenge — Question 10

チャプターを開始

3

Incident response management and attack mitigation

In this module, you'll explore the entire incident response process. Additionally, you’ll gain essential skills in documenting information for various stakeholders, defining and conducting post-mortem analyses, and developing and executing automated playbooks. By the end of this course, you'll have a comprehensive understanding of the importance of automation in SecOps and be equipped with the necessary tools and knowledge to thrive in your chosen cloud security role.

Welcome to module 3

The importance of evidence preservation

Digital evidence preservation: Techniques and best practices

How security teams preserve evidence

Test your knowledge: Evidence preservation — Question 1

Test your knowledge: Evidence preservation — Question 2

Test your knowledge: Evidence preservation — Question 3

Test your knowledge: Evidence preservation — Question 4

Incident response in Google Cloud

Incident response best practices with Chronicle SOAR

Incident identification

Coordination for incident response

Guide to log queries, exports, and analysis

Analyze audit logs using BigQuery

Test your knowledge: Incident management — Question 1

Test your knowledge: Incident management — Question 2

Test your knowledge: Incident management — Question 3

Test your knowledge: Incident management — Question 4

Documentation fundamentals

Elements of successful documentation

Documentation in practice

Activity: Document a timeline of events

Activity Quiz: Document a timeline of events — Question 1

Activity Quiz: Document a timeline of events — Question 2

Activity Quiz: Document a timeline of events — Question 3

Activity Quiz: Document a timeline of events — Question 4

Activity Exemplar: Document a timeline of events

Test your knowledge: Documentation — Question 1

Test your knowledge: Documentation — Question 2

Test your knowledge: Documentation — Question 3

Test your knowledge: Documentation — Question 4

Actionable alert identification

Incident response partners

Security orchestration with playbooks

Incident response orchestration versus automation

Playbooks' role in incident response

Fatima: A day in the life of a detection and response team manager

Test your knowledge: Response in action using automation — Question 1

Test your knowledge: Response in action using automation — Question 2

Test your knowledge: Response in action using automation — Question 3

Test your knowledge: Response in action using automation — Question 4

Test your knowledge: Response in action using automation — Question 5

Glossary terms from module 3

Module 3 challenge — Question 1

Module 3 challenge — Question 2

Module 3 challenge — Question 3

Module 3 challenge — Question 4

Module 3 challenge — Question 5

Module 3 challenge — Question 6

Module 3 challenge — Question 7

Module 3 challenge — Question 8

Module 3 challenge — Question 9

Module 3 challenge — Question 10

チャプターを開始

4

Incident recovery

In this module, you'll acquire a thorough understanding of disaster recovery planning and business continuity in the Google Cloud environment, ensuring data integrity and maintaining operations during a disaster, focusing on swift response strategies. This module will also guide you through the role of automation in detecting and responding to cyberattacks, the use of the business continuity and disaster recovery (BCDR) tool, and the criticality of recovery as a last resort.

Welcome to module 4

Recovery plans in action

Information recovery and system restoration

System recovery steps and scenarios

Test your knowledge: Recovery plans and system restoration — Question 1

Test your knowledge: Recovery plans and system restoration — Question 2

Test your knowledge: Recovery plans and system restoration — Question 3

Test your knowledge: Recovery plans and system restoration — Question 4

Business continuity and disaster recovery (BCDR) basics

The role of BCDR tools

BCDR in Google Cloud

Guide to backups and VM recovery

Recover VMs with Google Backup and DR Service

Test your knowledge: Business continuity and disaster recovery — Question 1

Test your knowledge: Business continuity and disaster recovery — Question 2

Test your knowledge: Business continuity and disaster recovery — Question 3

Test your knowledge: Business continuity and disaster recovery — Question 4

Recovery options and measures of success

Components of a disaster recovery plan (DRP)

Disaster recovery planning in Google Cloud: Build a DRP

Disaster recovery planning in Google Cloud: Implement a DRP

Test your knowledge: Disaster recovery plan fundamentals — Question 1

Test your knowledge: Disaster recovery plan fundamentals — Question 2

Test your knowledge: Disaster recovery plan fundamentals — Question 3

Test your knowledge: Disaster recovery plan fundamentals — Question 4

Business continuity and disaster recovery plans

Create and manage effective BCDR plans

Disaster recovery plan stakeholders

Test your knowledge: BCDR roles and responsibilities — Question 1

Test your knowledge: BCDR roles and responsibilities — Question 2

Test your knowledge: BCDR roles and responsibilities — Question 3

Test your knowledge: BCDR roles and responsibilities — Question 4

Patrick and Pedro: Interview role play

Interview tip: End responses with positive takeaways

Glossary terms from module 4

Module 4 challenge — Question 1

Module 4 challenge — Question 2

Module 4 challenge — Question 3

Module 4 challenge — Question 4

Module 4 challenge — Question 5

Module 4 challenge — Question 6

Module 4 challenge — Question 7

Module 4 challenge — Question 8

Module 4 challenge — Question 9

Module 4 challenge — Question 10

Course wrap-up

Course 4 resources and citations

Glossary terms from course 4

チャプターを開始

Detect, Respond, and Recover from Cloud Cybersecurity Attacks

コース完了

修了証明書を取得

この修了書をLinkedInや履歴書、CVに追加しましょう
ソーシャルメディアや人事評価で共有しましょう今すぐ登録

19百万人を超える学習者と共にDetect, Respond, and Recover from Cloud Cybersecurity Attacksを始めましょう！

DataCamp for Mobileでデータスキルを磨きましょう

モバイルコースと毎日の 5 分間のコーディングチャレンジで、外出先でも進歩できます。