Google Professional Security Operations Engineer 1-10

表示モード

画像位置

文字位置

理解度の自動記録

問題幅 % 60〜100%

Q1Google Professional Security Operations Engineer

Q1. Your company is moving to a multi-cloud strategy.
You need to build a posture that can monitor threats comprehensively using Google Security Operations (SecOps).
You want to start detecting signs of threats as early as possible.
How should you respond?

A. Use Gemini to author YARA-L rules from scratch tailored to your multi-cloud use cases.
B. Use the curated detections in the Cloud Threats category to monitor your entire cloud environment.
C. Use the curated detections for Applied Threat Intelligence to monitor your cloud environment.
D. Contact Google Cloud Customer Care and ask them to provide a recommended rule set for your cloud environment.

Show answer

Correct answer: B. Use the curated detections in the Cloud Threats category to monitor your entire cloud environment.

The fastest way to begin threat monitoring in a multi-cloud environment is to enable the curated detections in the Cloud Threats category.
These are detection rules pre-built by Google that immediately cover common cloud security threats, so you can detect and respond to incidents without waiting to develop custom rules.
Option C’s Applied Threat Intelligence is centered on IOC-based matching, so for the goal of monitoring multi-cloud threats comprehensively and immediately, the Cloud Threats category is the appropriate choice.
Generating rules with Gemini (A) or contacting support (D) lack immediacy.
Google Cloud official documentation: Curated detections overview

Q2Google Professional Security Operations Engineer

Q2. You are helping a customer that has newly onboarded Google Security Operations (SecOps) set up SOC team access.
The customer’s Google SecOps administrator already has access to the instance.
The customer reports that newly added Google SecOps users authenticate successfully with the third-party identity provider (IdP) but are not granted access to the instance.
How should you remediate this situation? (Choose two.)

A. Use the Chronicle API to link Google SecOps to the relevant Google Cloud project.
B. Use Workforce Identity Federation to integrate Google SecOps with the third-party IdP.
C. In IAM, assign the appropriate data access scopes to the SOC team’s IdP group.
D. In IAM, grant the roles/chronicle.viewer role to the SOC team’s IdP group.
E. In the Google SecOps SOAR Advanced Settings screen, grant Basic permissions to the relevant IdP group.

Show answer

Correct answer: D, E

When authentication succeeds but authorization fails, permissions must be granted on both the SIEM side and the SOAR side.
Granting the roles/chronicle.viewer role to the IdP group in IAM provides the permission needed to access the Google SecOps instance.
Additionally, granting Basic permissions to the relevant IdP group in the SOAR Advanced Settings ensures correct access at the application level.
The key point is that both the IAM role on the SIEM side and the permission grant in Advanced Settings on the SOAR side are required.
Option B’s Workforce Identity Federation concerns authentication (which is already succeeding) and does not resolve the authorization problem.
Google Cloud official documentation: Configure feature access (IAM roles)

Q3Google Professional Security Operations Engineer

Q3. Your organization has deployed Google Security Operations (SecOps).
You are using Google Threat Intelligence to understand cyber threats relevant to your organization’s threat profile.
You are concerned that a cybercrime group may have been targeting you.
You need to determine whether you actually suffered any impact from an attack.
How should you proceed?

A. Configure monitors in the Digital Threat Monitoring feature to track newly leaked credentials, dark web mentions, and signs of data leakage.
B. Extract IOCs from recent reports in the Reports & Analysis feature, implement detection rules and lists in Google SecOps, and check whether they are present within your organization’s environment.
C. Use the Threat Landscape feature to identify threat groups targeting your industry, research their known MITRE ATT&CK tactics, techniques, and procedures (TTPs), and then implement detection rules in Google SecOps.
D. Use the Vulnerability Intelligence feature to identify new high- and critical-severity vulnerabilities in the products and technologies your organization uses, and prepare to apply patches.

Show answer

Correct answer: B. Extract IOCs from recent reports in the Reports & Analysis feature, implement detection rules and lists in Google SecOps, and check whether they are present within your organization’s environment.

To determine whether you have already been attacked, you need to obtain actionable intelligence (IOCs) and match it against your environment for any traces of activity.
The Reports & Analysis feature of Google Threat Intelligence provides threat reports that contain IOCs.
By extracting these IOCs and implementing detection rules and lists in Google SecOps, you can search past and present telemetry and identify whether the attack group was active in your organization’s systems.
The TTP research in option C is for designing future detections, and options A and D do not directly determine whether impact occurred.
Google Cloud official documentation: Google Threat Intelligence

Q4Google Professional Security Operations Engineer

Q4. On Google Threat Intelligence, you have identified a new threat actor group associated with multiple IOCs.
You want to use some of these IOCs across multiple detection rules within Google Security Operations (SecOps) to help identify suspicious behavior.
You want to adopt the most efficient method.
How should you respond?

A. Identify the detection rules to which the new IOCs apply, and modify the YARA-L logic to reference the threat actor group.
B. Configure a new data feed containing the IOCs in Google SecOps.
Modify the YARA-L logic to reference the new IOCs against the relevant UDM fields.
C. Add the IOCs to a new or existing reference list, and modify the YARA-L logic of the detection rules to use that reference list.
D. Save the IOCs to a new collection in Google Threat Intelligence, and share that list with other members of the security team to make searching and rule creation easier.

Show answer

Correct answer: C. Add the IOCs to a new or existing reference list, and modify the YARA-L logic of the detection rules to use that reference list.

The most effective approach is to add the IOCs to a reference list in Google SecOps and update the detection rules’ YARA-L logic to reference that reference list.
By consolidating IOCs into a reference list and referencing it from YARA-L, you can reuse the IOCs across multiple rules, simplify maintenance, and keep detection logic consistent.
This prevents duplicating IOCs in multiple places.
Referencing the threat group (A) or sharing a collection (D) are not well suited for directly applying IOCs to detection rules.
Google Cloud official documentation: Use reference lists

Q5Google Professional Security Operations Engineer

Q5. You are designing a playbook for a SOC.
In this SOC, it is a requirement that when the playbook runs for a given alert, each Google Security Operations (SecOps) role can view different information from one another.
You need to configure the playbook so that the information displayed corresponds to each Google SecOps role.
How should you respond?

A. Add a view to the playbook for each Google SecOps role.
B. Add a Case Comment action to the playbook for each Google SecOps role.
C. Add a Create Siemplify Task action (now the task creation of Google SecOps SOAR) to the playbook to assign tasks to each Google SecOps role.
D. Add an Add General Insight action to the playbook for each Google SecOps role.

Show answer

Correct answer: A. Add a view to the playbook for each Google SecOps role.

The correct approach is to add a view to the playbook for each Google SecOps role.
Views let you control the information displayed by role, so each SOC role sees only the information relevant to its responsibilities.
The Case Comment in B and the General Insight in D add information rather than controlling display by role, and the task creation in C is for assigning tasks.
Google Cloud official documentation: SOAR cases and playbook views

Q6Google Professional Security Operations Engineer

Q6. You received an alert from Container Threat Detection that an added binary was executed within a business-critical workload.
You need to investigate and respond to this incident.
How should you respond? (Choose two.)

A. Contact the workload owner.
Following the response playbook, ask the threat hunting team to identify the root cause.
B. Review the detection, investigate the affected Pod and related resources, and consider the likely attack technique and how to address it.
C. Review the detection, isolate the cluster containing the running Pod, and then delete the running Pod to prevent further compromise.
D. Because this alert is a low-severity detection, silence the alert in the Security Command Center (SCC) console.
E. Leave the cluster and Pod running and observe their behavior to determine whether the activity is malicious.

Show answer

Correct answer: A, B

The appropriate response is both to ensure coordinated incident handling by notifying the workload owner and executing the response playbook, and to review the detection while investigating the Pod and related resources to understand the attack and determine the appropriate remediation.
The key point is to run notification and playbook execution in parallel with technical investigation, without prematurely deleting or silencing important evidence.
Option C deletes the Pod that serves as evidence, and option D silences the alert, both of which are inappropriate from a forensic standpoint.
Google Cloud official documentation: Container Threat Detection overview

Q7Google Professional Security Operations Engineer

Q7. Your team is responsible for the cybersecurity of a large multinational corporation.
You are tasked with identifying unknown command-and-control (C2) nodes that may be hiding within your environment.
Within 24 hours, you need to produce a list of potential matches.
How should you respond?

A. Create a rule within Google Security Operations (SecOps) that scans past outbound network connections against the ingested threat intelligence.
Run that rule as a retrohunt across the entire tenant.
B. Ingest network records into BigQuery and identify endpoints communicating with domains that deviate more than 3 standard deviations from normal.
C. Review the Security Health Analytics (SHA) findings in Security Command Center (SCC).
D. Create a YARA-L rule in Google Security Operations (SecOps) that matches endpoint network traffic against low-frequency domains cross-referenced with recent WHOIS registration information.

Show answer

Correct answer: A. Create a rule within Google Security Operations (SecOps) that scans past outbound network connections against the ingested threat intelligence. Run that rule as a retrohunt across the entire tenant.

The fastest and most effective way to identify unknown C2 nodes within 24 hours is to create a detection rule in Google SecOps that compares past outbound connections against the ingested threat intelligence, and run it as a retrohunt across the entire tenant.
A retrohunt scans historical telemetry at scale and at high speed, so you can surface matches without waiting for new events to occur.
The statistical method in B and the WHOIS matching in D are inferior in terms of time or accuracy for exhaustively surfacing matches within the specified time frame.
Google Cloud official documentation: Manage rules and retrohunts

Q8Google Professional Security Operations Engineer

Q8. You are responsible for designing and configuring data ingestion in your organization’s Google Security Operations (SecOps).
Your organization uses a prebuilt parser to parse a complex yet stable and commonly used log source.
This parser is working without issues.
However, your organization wants to change the configuration so that additional fields can be parsed from the raw logs and mapped to UDM fields.
How should you respond?

A. Design and develop a new custom parser.
B. Apply the pending updates available for the prebuilt parser.
C. Implement a parser extension on top of the prebuilt parser.
D. Implement middleware to change the underlying data structure.

Show answer

Correct answer: C. Implement a parser extension on top of the prebuilt parser.

The recommended approach is to implement a parser extension on top of the prebuilt parser.
A parser extension lets you map additional fields from the raw logs to UDM fields without changing the existing, stable parser.
This allows you to customize new fields while retaining the original parsing logic.
Developing a new custom parser (A) requires significant effort and risks replacing a parser that is running stably.
Google Cloud official documentation: Manage parser extensions

Q9Google Professional Security Operations Engineer

Q9. As an incident responder for your organization, you use Google Security Operations (SecOps) for monitoring and investigation.
On a critical production server that processes financial transactions, you have discovered signs of unauthorized file modifications and network scans from a suspicious IP address.
You believe a persistence mechanism may have been planted.
You need to use Google SecOps to immediately contain the threat while preserving forensic data in an investigable state.
What should you do first?

A. Use the firewall integration to add the IP address to a network blocklist and cut off internet access from the affected machine.
B. Apply an emergency patch and reboot the server to remove the malicious persistence mechanism.
C. Use the EDR integration to quarantine the compromised asset.
D. Use VirusTotal to enrich the IP address to obtain domain information, and add that domain to a proxy blocklist.

Show answer

Correct answer: C. Use the EDR integration to quarantine the compromised asset.

The most effective first step to contain the threat while preserving forensic data is to use the EDR integration to quarantine the compromised asset.
Quarantine separates the server from the network to prevent further malicious activity, and because it does not wipe or reboot the server, evidence such as the persistence mechanism and the unauthorized file modifications is preserved.
Rebooting (B) risks losing volatile evidence.
The blocking in A and D remains at the network level, whereas EDR quarantine is appropriate for containing the asset itself.
Google Cloud official documentation: SOAR marketplace integrations (EDR)

Q10Google Professional Security Operations Engineer

Q10. Your organization uses Google Security Operations (SecOps).
The compliance department has asked you to export, on a weekly basis, the resolution status and SLA metrics for “High” and “Critical” severity cases from the most recent week.
The compliance department’s post-processing script needs to format this data as tabular data in CSV format, compress it into a ZIP file, and email it every Monday morning.
How should you respond?

A. Create a report in SOAR Reports and schedule its delivery.
B. Use the statistics feature of search, and configure a Google SecOps SOAR job to format and send the report.
C. Create an Advanced Report in SOAR Reports and schedule its delivery.
D. Create a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.

Show answer

Correct answer: B. Use the statistics feature of search, and configure a Google SecOps SOAR job to format and send the report.

Use the statistics feature of search to generate the required tabular metrics, and run a scheduled SOAR job to perform the CSV export, ZIP compression, and email delivery every Monday.
A configuration that builds tabular data with search statistics and uses a SOAR job to automate CSV conversion, compression, and scheduled email delivery best matches the requirements.
This meets the exact formatting and delivery requirements with minimal manual work.
SOAR Reports is intended for standardized reports, whereas a SOAR job can more flexibly satisfy the granular requirements of CSV conversion, ZIP compression, and email delivery on a specific day of the week.
Google Cloud official documentation: Schedule and run SOAR jobs

Google Professional Security Operations Engineer 1-10

Choose confidence levels to display

Q1. Your company is moving to a multi-cloud strategy.You need to build a posture that can monitor threats comprehensively using Google Security Operations (SecOps).You want to start detecting signs of threats as early as possible.How should you respond?

Q6. You received an alert from Container Threat Detection that an added binary was executed within a business-critical workload.You need to investigate and respond to this incident.How should you respond? (Choose two.)

Q7. Your team is responsible for the cybersecurity of a large multinational corporation.You are tasked with identifying unknown command-and-control (C2) nodes that may be hiding within your environment.Within 24 hours, you need to produce a list of potential matches.How should you respond?

Q1. Your company is moving to a multi-cloud strategy.
You need to build a posture that can monitor threats comprehensively using Google Security Operations (SecOps).
You want to start detecting signs of threats as early as possible.
How should you respond?

Q6. You received an alert from Container Threat Detection that an added binary was executed within a business-critical workload.
You need to investigate and respond to this incident.
How should you respond? (Choose two.)

Q7. Your team is responsible for the cybersecurity of a large multinational corporation.
You are tasked with identifying unknown command-and-control (C2) nodes that may be hiding within your environment.
Within 24 hours, you need to produce a list of potential matches.
How should you respond?