Free Google Professional-Security-Operations-Engineer Exam Questions

Question 1

Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company As security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts: do not have access to any case data originating from outside of Company A. are able to re-purpose playbooks previously developed by your organization's employees. You need to minimize effort to implement your solution. What is the first step you should take?

A : Create a Google SecOps SOAR environment for Company A.

B : Define a new SOC role for Company A.

C : Provision a new service account for Company A.

D : Acquire a second Google SecOps SOAR tenant for Company A.

Answer: A

Question 2

Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company As security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts: do not have access to any case data originating from outside of Company A. are able to re-purpose playbooks previously developed by your organization's employees. You need to minimize effort to implement your solution. What is the first step you should take?

A : Create a Google SecOps SOAR environment for Company A.

B : Define a new SOC role for Company A.

C : Provision a new service account for Company A.

D : Acquire a second Google SecOps SOAR tenant for Company A.

Answer: A

Question 3

You are part of a cybersecurity team at a large multinational corporation that uses Google Security Operations (SecOps). You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches for the unknown C2s within the next 24 hours. What should you do?

A : Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

B : Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.

C : Write a YARA-L rule in Google SecOps that scans historic network outbound connections against ingested threat intelligence. Run the rule in a retrohunt against the full tenant.

D : Write a YARA-L rule in Google SecOps that compares network traffic from endpoints to recent WHOIS registrations. Run the rule in a retrohunt against the full tenant.

Answer: D

Question 4

You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Youneed to improve your detection coverage and reduce the false positive detection ratio as quickly as possible.What should you do?

A : Enable curated detections to identify threats.

B : Ingest data from your threat intelligence platform (TIP) into Google SecOps.

C : Develop YARA-L detection rules that focus on threat intelligence.

D : Design YARA-L detection rules based on Google SecOps Marketplace use cases.

Answer: A

Question 5

You are part of a cybersecurity team at a large multinational corporation that uses Google Security Operations (SecOps). You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches for the unknown C2s within the next 24 hours. What should you do?

A : Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

B : Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.

C : Write a YARA-L rule in Google SecOps that scans historic network outbound connections against ingested threat intelligence. Run the rule in a retrohunt against the full tenant.

D : Write a YARA-L rule in Google SecOps that compares network traffic from endpoints to recent WHOIS registrations. Run the rule in a retrohunt against the full tenant.

Answer: D