GCP-SOE-B by Google Actual Free Exam Questions And Answers

Question 1

Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?

A. Use Gemini to generate YARA-L rules for multi-cloud use cases.

B. Use curated detections from the Cloud Threats category to monitor your cloud environment.

C. Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.

D. Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.

Discussion 0

Correct Answer: B Vote an answer

Question 2

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

B. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

C. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.

D. Configure the Windows server to send an email notification if there is an error in the Bindplane process.

Discussion 0

Correct Answer: C Vote an answer

Question 3

You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?

A. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.

B. Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.

C. Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.

D. Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.

Discussion 0

Correct Answer: B Vote an answer

Question 4

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

A. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.

B. Modify the detection rule in the SIEM to include the query results as part of the detection.

C. Add an action to the playbook that runs the SIEM query and returns the results.

D. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.

Discussion 0

Correct Answer: C Vote an answer

Question 5

You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?

A. Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).

B. Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).

C. Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.

D. Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.

Discussion 0

Correct Answer: A Vote an answer

Question 6

You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:
- Receive a notification when data sources go silent within 15 minutes.
- Visualize ingestion throughput and parsing errors. What should you do?

A. Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.

B. Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane. Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).

C. Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.

D. Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring. Create a Cloud Monitoring dashboard to visualize data ingestion metrics.

Discussion 0

Correct Answer: D Vote an answer

Question 7

You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

A. Look for correlations across impacted users in the Risk Analytics dashboard.

B. Enable default curated detections to automatically block suspicious IP addresses.

C. Use UDM Search to query historical logs for recent IOCS associated with the suspicious login attempts.

D. Remove user accounts that have repeated invalid login attempts.

Discussion 0

Correct Answer: A Vote an answer

Question 8

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

A. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.

B. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.

C. Review the finding, investigate the pod and related resources, and research the related attack and response methods.

D. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.

E. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.

Discussion 0

Correct Answer: C,D Vote an answer

Question 9

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

A. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

B. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.

C. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

D. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.

Discussion 0

Correct Answer: B Vote an answer

Google Security Operations Engineer (Beta) - GCP-SOE-B Exam Practice Test

Contact Us

Useful Links

Latest Updated