GCP-SOE-B by Google Actual Free Exam Q&As

Question 1

You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?

A. Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps). B. Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps). C. Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list. D. Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.

Discussion 0

Correct Answer: A Vote an answer

Question 2

Your company's SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall installed and configured with credentials. You want to use the integration to trigger firewall rule changes directly from the Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve the requested changes prior to deployment. How should you implement the workflow for analysts to trigger on demand?

A. Create an email template for the analyst to get approval for the change from the system administrator. Have the analyst fill out the needed fields, and send the email for approval. Once approved, use a manual action to make the change to the firewall rule from any open case. B. Create an account for the system administrator in your Google SecOps instance to allow the system administrator to make the changes from Google SecOps directly. Add an escalation step to enable the analyst to assign the case to the system administrator. C. Create a playbook where the firewall rule change is a manual step, allowing the analyst to edit the firewall rule as a pending action. Have the analyst email the system administrator with the change. Once approved, the analyst lets the playbook continue. D. Create a request in the Google SecOps SOAR settings that includes a field for the firewall rule.Create a playbook that is triggered by this request. Configure the playbook step that makes the firewall rule change to send an approval request from the system administrator. The approval request must include the parameter being changed.

Discussion 0

Correct Answer: D Vote an answer

Question 3

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A. Configure the Windows server to send an email notification if there is an error in the Bindplane process. B. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname. C. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window. D. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

Discussion 0

Correct Answer: B Vote an answer

Question 4

A phishing campaign successfully convinces users to grant OAuth permissions to a malicious third-party application. Which control failure MOST likely allowed this?

A. Lack of monitoring and restriction on OAuth consent grants B. Weak endpoint protection C. Missing email sandboxing D. Missing antivirus signatures

Discussion 0

Correct Answer: A Vote an answer

Question 5

Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts. Specifically, you need to detect when a user account downloads an unusually large volume of data compared to the user's established baseline activity. You want to detect this anomalous data access behavior using the least amount of effort. What should you do?

A. Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps. B. Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps. C. Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity. D. Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.

Discussion 0

Correct Answer: C Vote an answer

Question 6

Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?

A. Assign the cases to a user in the Tier 3 role. B. Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access. C. Revoke additional role access from Tier 1 and Tier 2 analysts. D. Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.

Discussion 0

Correct Answer: B Vote an answer

Question 7

You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCS from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?

A. Create a new threat graph in Google Threat Intelligence, and share the graph with the other teams. B. Create a list in Google Security Operations (SecOps), and grant the required access to the other teams. C. Export the IOCS from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams. D. Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams.

Discussion 0

Correct Answer: B Vote an answer

Question 8

You are tasked with building a workflow in Google Security Operations (SecOps) SOAR. The documentation you are using requires a logical split that has eight different possible paths. You need to break the workflow into eight separate workflows using an automatic and efficient approach. What should you do?

A. Create a playbook that uses a Multi-Choice Question answer choices. Add instructions describing which logic to use in the instruction or question fields. Have the analyst select the appropriate answer to move the flow into the right branch. B. Create a playbook that uses a flow condition. Add four more branches to have a total of five branches and an "Else" branch. On the "Else" branch, include another flow condition. Include the remaining three branches with the logic required. C. Create eight playbooks for each workflow. Configure the triggered playbook to end on an instruction action that tells the analyst to pick a workflow from the playbooks tab and attach that workflow to the alert. D. Create eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to the alert.

Discussion 0

Correct Answer: B Vote an answer

Question 9

Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?

A. Configure a rule exclusion for the target.ip field. B. Configure a rule exclusion for the principal.ip field. C. Configure a rule exclusion for the network.asset.ip field. D. Configure a rule exclusion for the target.domain field.

Discussion 0

Correct Answer: C Vote an answer

Google Security Operations Engineer (Beta) - GCP-SOE-B Exam Practice Test