GCP-SOE-B Exam Training Practice Tests (Google Security Operations Engineer (Beta))]

Question 1

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

A. Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team. B. Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly. C. Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture. D. Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.

Correct Answer: C

Question 2

A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?

A. High availability architecture B. Encryption at rest C. Global IP addressing D. Short-lived (ephemeral) resources

Correct Answer: D

Question 3

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on- premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

A. Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment. B. Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment. C. Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS. D. Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.

Correct Answer: A

Question 4

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

A. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually. B. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types. C. Customize the Case Name format to include the DLP event type. D. Customize the Close Case dialog and add the five DLP event types as root cause options.

Correct Answer: D

Question 5

You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?

A. Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses. B. Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship. C. Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed. D. Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.

Correct Answer: D

Question 6

You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?

A. Modify the UI settings to correct the time zone. B. Create a custom parser to correct the time zone. C. Modify the default parser and include a default time zone. D. Create a parser extension to correct the time zone.

Correct Answer: D

Question 7

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

A. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule. B. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting. C. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting. D. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.

Correct Answer: A

Question 8

Which approach BEST improves detection of compromised service accounts in Google Cloud?

A. Monitoring VM uptime B. Disabling all service accounts You are managing the integration of Security Command Center (SCC) with downstream tooling. C. Alerting on login failures only D. Baseline service account behavior and alert on deviations

Correct Answer: D

Question 9

You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?

A. Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified. B. Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes. C. Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics. D. Create a Google SecOps SOAR dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.

Correct Answer: B

Google Security Operations Engineer (Beta) - GCP-SOE-B Exam Practice Test