🔍

PSOE — questions

Page 2 of 2 · 38 total questions.

PSOE Question 21

Single page →
Topic 1 · Question 21

You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?

  • AConfigure each network in the Google SecOps SOAR settings. (correct answer)
  • BEnrich the IP address entities as the initial step of the playbook.
  • CModify the entity attribute in the alert overview.
  • DCreate an outcome variable in the rule to assign the network name.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure each network in the Google SecOps SOAR settings.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 22

Single page →
Topic 1 · Question 22

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?

  • AIngest logs from Windows Sysmon.
  • BIngest logs from Microsoft Entra ID. (correct answer)
  • CIngest logs from Windows PowerShell.
  • DIngest logs from Windows Procmon.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Ingest logs from Microsoft Entra ID. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 23

Single page →
Topic 1 · Question 23

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

  • AWrite a code snippet, and deploy it in a parser extension to map both fields to UDM. (correct answer)
  • BUse the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
  • CDeploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
  • DUse the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

Explanation

The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. A parser extension adjusts source parsing and field mappings while preserving normalized UDM output. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 24

Single page →
Topic 1 · Question 24

During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of 30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?

  • ABuild a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review. (correct answer)
  • BChange the default case assignment logic to route all phishing alerts to the Tier 2 team.
  • CConfigure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.
  • DUpdate the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.

Explanation

A SOAR playbook automates enrichment, triage, containment, notification, and case-handling steps. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 25

Single page →
Topic 1 · Question 25

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

  • ARun an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team. (correct answer)
  • BRun queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
  • CImplement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
  • DImplement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.

Explanation

Audit Manager assesses cloud environments against compliance frameworks and produces evidence-backed reports. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 26

Single page →
Topic 1 · Question 26

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

  • AAdd a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
  • BAssign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.
  • CInclude a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts. (correct answer)
  • DUpdate the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.

Explanation

YARA-L defines event-driven detection rules over normalized security telemetry in Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 27

Single page →
Topic 1 · Question 27

You are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization's environment. Alerts in Google SecOps indicate repeated PowerShell activity on a set of endpoints. Outbound connections are made to a domain that does not appear in your threat intelligence feeds. The activity occurs across multiple systems and user accounts. You need to search across impacted systems and user identities to identify the malicious user and understand the scope of the compromise. What should you do?

  • APerform a YARA-L 2.0 search to correlate activity across impacted systems and users.
  • BPerform a raw log search for the suspicious domain string, and manually pivot to related user activity.
  • CUse the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.
  • DUse the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.

Explanation

Risk Analytics prioritizes entities and behaviors by aggregating contextual risk signals and detections. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 28

Single page →
Topic 1 · Question 28

You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCs from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?

  • ACreate a list in Google Security Operations (SecOps), and grant the required access to the other teams.
  • BExport the IOCs from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams.
  • CAdd the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams. (correct answer)
  • DCreate a new threat graph in Google Threat Intelligence, and share the graph with the other teams.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 29

Single page →
Topic 1 · Question 29

You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into: User identity behavior - Lateral movement - Privilege escalation attempts - You need to determine which telemetry sources are ingested first. Which log source should you prioritize?

  • ACloud access security broker (CASB) logs
  • BEDR logs
  • CIAM logs (correct answer)
  • DNetwork firewall logs
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: IAM logs

Explanation

Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 30

Single page →
Topic 1 · Question 30

You are responsible for selecting and prioritizing potential sources of data to integrate with Google Security Operations (SecOps). Your company has recently started using several Google Cloud services to increase security in its Google Cloud organization. You need to determine which logs should be ingested into Google SecOps to reduce the effort required to write detections. What should you do?

  • AIngest Google Cloud Armor logs by using Cloud Logging.
  • BDeploy a Bindplane agent to ingest event logs from Compute Engine VMs that provide endpoint visibility.
  • CIntegrate Security Command Center (SCC) into Google SecOps to ingest logs originating from the Google Cloud services. (correct answer)
  • DUse Google Threat Intelligence to gain insight about threat group behavior and support threat hunting activities.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Integrate Security Command Center (SCC) into Google SecOps to ingest logs originating from the Google Cloud services.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. Security Command Center centralizes security findings, threats, and compliance posture. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 31

Single page →
Topic 1 · Question 31

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post-processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning. What should you do?

  • AGenerate a report in SOAR Reports, and schedule delivery of the report.
  • BUse statistics in search, and configure a Google SecOps SOAR job to format and send the report.
  • CBuild an Advanced Report in SOAR Reports, and schedule delivery of the report. (correct answer)
  • DBuild a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Build an Advanced Report in SOAR Reports, and schedule delivery of the report. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 32

Single page →
Topic 1 · Question 32

Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?

  • AConfigure a rule exclusion for the network.asset.ip field.
  • BConfigure a rule exclusion for the principal.ip field. (correct answer)
  • CConfigure a rule exclusion for the target.domain field.
  • DConfigure a rule exclusion for the target.ip field.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure a rule exclusion for the principal.ip field. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 33

Single page →
Topic 1 · Question 33

Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?

  • AConfigure a third-party API feed in Google SecOps.
  • BConfigure direct ingestion from your Google Cloud organization.
  • CConfigure and deploy a Google SecOps forwarder.
  • DConfigure and deploy a Bindplane collection agent. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure and deploy a Bindplane collection agent.

Explanation

Bindplane collects, processes, and routes telemetry from supported sources into Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 34

Single page →
Topic 1 · Question 34

You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota. Which log type should you ingest into Google SecOps?

  • AVPC Flow Logs
  • BSecurity Command Center Premium (SCCP) findings (correct answer)
  • CCloud IDS logs
  • DCloud Audit Logs
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Security Command Center Premium (SCCP) findings

Explanation

Security Command Center centralizes security findings, threats, and compliance posture. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 35

Single page →
Topic 1 · Question 35

You are a SOC analyst working a case in Google Security Operations (SecOps). The case contains a file hash that your playbooks have automatically enriched with VirusTotal context and categorized as likely malicious. You need to quickly identify devices and users in your organization who have interacted with this file. What should you do?

  • ABuild a playbook to perform a UDM search matching on the file hash in Google SecOps SIEM.
  • BBuild a playbook to query your threat intelligence platform (TIP) for the presence of the file hash.
  • CUse a manual action in Google SecOps SOAR to perform a UDM search matching on the file hash in Google SecOps SIEM. (correct answer)
  • DUse a manual action in Google SecOps SOAR to query your threat intelligence platform (TIP) for the presence of the file hash.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use a manual action in Google SecOps SOAR to perform a UDM search matching on the file hash in Google SecOps SIEM.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. UDM Search queries normalized Unified Data Model events so analysts can correlate activity consistently across log sources. The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 36

Single page →
Topic 1 · Question 36

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

  • AUse Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
  • BUse Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
  • CConduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
  • DUse Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 37

Single page →
Topic 1 · Question 37 · Select all that apply

You are helping a new Google Security Operations (SecOps) customer configure access for their SOC team. The Google SecOps administrators currently have access to the instance. The customer is reporting that new Google SecOps users are not getting authorized to access the instance, but they are able to authenticate to the third-party identity provider (IdP). How should you fix the issue? (Choose two.)

  • ALink Google SecOps to a Google Cloud project with the Chronicle API.
  • BIntegrate Google SecOps with the third-party IdP using Workforce Identity Federation.
  • CGrant the appropriate data access scope to the SOC team's IdP group in IAM. (correct answer)
  • DGrant the roles/chronicle.viewer role to the SOC team's IdP group in IAM. (correct answer)
  • EGrant the Basic permission to the appropriate IdP groups in the Google SecOps SOAR Advanced Settings.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Grant the appropriate data access scope to the SOC team's IdP group in IAM. Option D: Grant the roles/chronicle.viewer role to the SOC team's IdP group in IAM.

Explanation

Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources. This option keeps traffic private / properly secured as required. The other options (A, B, E) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 38

Single page →
Topic 1 · Question 38

You work for a telecommunications company that wants to monitor their multi-region 5G network logs in Google Security Operations (SecOps). The logs are currently only available on-premises and are stored in a standalone network-attached storage (NAS) located in four different regions. You need to ingest the logs into Google SecOps and tag each NAS as a specific log source to avoid IP address aliasing. What should you do?

  • AConfigure feed management to pull data from each log's location, and configure a namespace for each log source.
  • BConfigure feed management to pull data from each log's location, and configure an ingestion label for each log source.
  • CConfigure a Bindplane agent that collects Syslog from each log's location, and configure a namespace for each log source.
  • DConfigure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source.

Explanation

Bindplane collects, processes, and routes telemetry from supported sources into Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

Showing questions 21–38 of 38 · Page 2 of 2