Google Security Operations Engineer (Beta) Sample Questions:

1. You are reviewing the results of a UDM search in Google Security Operations (SecOps). The UDM fields shown in the default view are not relevant to your search. You want to be able to quickly view the relevant data for your analysis. What should you do?

A) Create a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.
B) Use the columns feature to select or remove columns that are relevant to your analysis.
C) Select the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.
D) Download the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.

2. You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

A) Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
B) Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.
C) Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
D) Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.

3. You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

A) Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
B) Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
C) Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
D) Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.

4. A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?

A) Global IP addressing
B) High availability architecture
C) Encryption at rest
D) Short-lived (ephemeral) resources

5. You are tasked with building a workflow in Google Security Operations (SecOps) SOAR. The documentation you are using requires a logical split that has eight different possible paths. You need to break the workflow into eight separate workflows using an automatic and efficient approach. What should you do?

A) Create a playbook that uses a Multi-Choice Question answer choices. Add instructions describing which logic to use in the instruction or question fields. Have the analyst select the appropriate answer to move the flow into the right branch.
B) Create a playbook that uses a flow condition. Add four more branches to have a total of five branches and an "Else" branch. On the "Else" branch, include another flow condition. Include the remaining three branches with the logic required.
C) Create eight playbooks for each workflow. Configure the triggered playbook to end on an instruction action that tells the analyst to pick a workflow from the playbooks tab and attach that workflow to the alert.
D) Create eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to the alert.

Solutions: