Free Google Professional-Security-Operations-Engineer Exam Questions

Question 1

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A : Configure the Windows server to send an email notification if there is an error in the Bindplane process.

B : Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

C : Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

D : Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.

Answer: D

Question 2

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

A : Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

B : Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.

C : Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.

D : Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

Answer: D

Question 3

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A : Configure the Windows server to send an email notification if there is an error in the Bindplane process.

B : Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

C : Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

D : Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.

Answer: D

Question 4

You are part of a cybersecurity team at a large multinational corporation that uses Google Security Operations (SecOps). You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches for the unknown C2s within the next 24 hours. What should you do?

A : Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

B : Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.

C : Write a YARA-L rule in Google SecOps that scans historic network outbound connections against ingested threat intelligence. Run the rule in a retrohunt against the full tenant.

D : Write a YARA-L rule in Google SecOps that compares network traffic from endpoints to recent WHOIS registrations. Run the rule in a retrohunt against the full tenant.

Answer: D

Question 5

Your Google Security Operations (SecOps) case queue contains a case with IP address entities. You need to determine whether the entities are internal or external assets and ensure that internal IP address entities are marked accordingly upon ingestion into Google SecOps SOAR. What should you do?

A : Configure a feed to ingest enrichment data about the networks, and include these fields into your detection outcome.

B : Modify the connector logic to perform a secondary lookup against your CMDB and flag incoming entities as internal or external.

C : Indicate your organization's known internal CIDR ranges in the Environment Networks list in the settings.

D : Create a custom action to ping the IP address entity from your Remote Agent. If successful, the custom action designates the IP address entity as internal.

Answer: C