Google SecOps Professional Engineer Practice Test

These questions are part of the practice quiz. Start practicing

• An APT actor is suspected with IOCs including a SHA256 of a malicious DLL, a C2 domain, and rundll32.exe spawning powershell.exe with obfuscated arguments. If Sysmon data is inconsistent and process hashes are unreliable, which approach is best?
• UDM search shows outbound connections from a production VM to an unfamiliar external IP over the last 48 hours. What is the quickest way to gather context and assess the IP's reputation?
• Which category provides curated detections for cloud threats across services?
• Which method would you use to identify all assets a specific user interacted with over the past seven days in Google SecOps?
• If threat actor TTPs are documented in GTI, which approach best informs your detections?
• To ingest Cloud NAT logs for workloads in a designated folder while minimizing integration complexity, what is the correct configuration?
• To generate an alert when a binary hash first appears, which approach should you implement?
• Which option would you implement to use a Bindplane agent collecting Syslog from each location and assign a namespace per log source to avoid IP aliasing?
• After a red team exercise, which action best reduces IOC noise by muting exercise-related IOC matches?
• You observe multiple distinct, low-severity suspicious activities on a single internal server; no single event is a high-confidence IOC. You want ongoing heightened scrutiny. What should you do?
• Why would a multi-event YARA-L rule be preferred over a single-event rule in SecOps detection?
• When JSON logs from a third-party system have missing fields, what should you do to parse them quickly into UDM?
• For real-time tracking of pen-test cases and clear differentiation from other incidents, which practice should you implement?
• What is the recommended first action to enable SecOps access for new users who authenticate via a third-party IdP?
• To quickly evaluate a new third-party endpoint detection tool for SecOps integration with minimal customization, which action is most appropriate?
• Which component enables a playbook to run on a regular schedule with minimal overhead by generating cases for the operator to handle?
• In SecOps, which approach would you use to identify all assets touched by a particular user within a given timeframe?
• To prevent false positives when detections trigger on 192.0.2.0/8, which YARA-L condition best fits?
• To detect when a user account downloads unusually large volumes relative to baseline with minimal effort, which approach should you implement?
• You are threat hunting for an advanced group using campaign-specific infrastructure. You want detections based on behavior to detect whether they have attacked your org. What should you do?
• You manage threat intelligence and IOC lists. You compiled IOCs from recent incidents and want to share quickly for collaboration/integration. What should you do?
• To automatically remediate dormant service account keys when a relevant finding is detected, which approach is recommended?
• When writing a detection rule using a MISP feed to filter for domain indicators in the entity graph, which condition filters for domain IOCs?
• For monitoring ingestion health with Bindplane, which steps ensure you get notified about silent sources within 15 minutes and have a clear view of throughput and parsing errors?
• In a standard set of playbooks, where an All trigger should apply if no more specific playbooks have triggered, how should you ensure the specific playbook is attached when multiple triggers match?
• To identify and alert on a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in successful login, while minimizing ingestion quota impact. Which log type should you ingest into SecOps?
• A rule that detects excessive network connections is too noisy. You want to reduce noise without reducing effectiveness. What change?
• Your SOC triages alerts one at a time using several external dashboards. You want to use SecOps case management to reduce pivoting, with minimal development effort. What should you do first?
• Which step ensures external analysts can access the SecOps environment with read-only access to all resources, including detection engine rules?
• To reduce alert noise from repetitive SecOps alerts, which configuration should you apply?
• Which setup applies an ingestion label per log source when pulling data from multiple NAS locations into SecOps?
• All DLP-related cases should include a defined root cause specific to one of five DLP event types when closed in SecOps. How would you implement this?
• To monitor audit logs related to data feeds in Google SecOps, which action should you take?
• When evaluating a new endpoint detection tool for SecOps integration, which step is most directly tied to interoperability with existing workflows?
• For a SIEM dashboard, how do you dynamically monitor assets based on a specific asset tag?
• When you need to contain a compromised production server while preserving forensic data, what should you do first?
• You received a suspicious C2 domain IOC and want to investigate whether it appeared in your environment using the most efficient approach. What should you do?
• When you need to surface relevant data quickly in a UDM search, which approach is most effective if default columns are not useful?
• Which configuration would you implement if your goal is to pull data and tag using an ingestion label per log source?
• When a medium severity alert indicates unusual cloud storage access by a senior developer outside working hours, what should you do first?
• To share IOC lists quickly for collaboration/integration, what should you do?
• If default UDM search columns are not relevant, what is an effective way to reduce false positives when a curated high-priority network indicators rule set flags issues due to on-prem proxies?
• Which SecOps component must be enabled to receive logs routed from Google Cloud Pub/Sub?
• Which Security Command Center feature helps identify misconfigurations and vulnerabilities across Google Cloud assets?
• An outbound connection from a production VM to an unfamiliar external IP is observed. Which action is the quickest to gather context and assess IP reputation?
• To receive an alert when a privileged Google Group is modified to grant public access, which configuration is most appropriate?
• When anomalous external-domain communications are detected, which action provides the best single path to assess context?
• To detect anomalous behavior by windowing and aggregating data over time and provide an interface for analysts to triage, which architecture is recommended?
• Which notification method is suitable to detect missing data from forwarders within five minutes?
• A third-party application's data is published to a Pub/Sub topic in a separate project; push attempts to SecOps fail. Which low-latency approach is robust?
• A server is added to a SecOps watchlist after suspicious activity is detected. What is the primary purpose of this action?
• To ingest on-prem MySQL logs into SecOps with minimal effort, which action is recommended?
• You are hunting for lateral movement via RDP. Which approach best informs a UDM-based query for detection?
• When building a playbook, how should you ensure that different SecOps roles see appropriate information for the alert the playbook handles?
• What is the most efficient approach to identify the most commonly occurring processes across organization servers for baselining?
• For enrichment actions where the enrichment tech is in a private data center that cannot accept inbound connections, how should you connect SecOps?
• What is the first step to fix access for new SecOps users who authenticate to SecOps via a third-party IdP?
• Which configuration is recommended for multi-region NAS log ingestion to tag each log source with an ingestion label?
• Group A requires access to all data. Which action should you take in IAM to satisfy this requirement?
• When a breach is detected, what is the fastest way to boost threat analytics?
• SOC director must be notified by email of escalated incidents and their results before a case is closed. Create a process to automatically send the email upon closing an escalated case. Ensure reliability. What process?
• Onboarding logs from a third-party DNS filtering solution, key UDM fields are missing. What should you do to enable downstream detection rules?
• To differentiate four regional NAS log sources for SecOps, which configuration assigns a unique ingestion label per log source?
• In policy terms, which constraint explains why an external identity with project-level access cannot access SecOps?
• In a SOAR playbook, after a UDM query finds users who connected to a malicious domain, how should you add those users as entities in an alert to reset passwords with minimal analyst effort?
• You have third-party threat intelligence subscriptions and want to continuously compare DNS calls on endpoints to your feeds. What should you do?
• To minimize false positives from service accounts in login alerts, which approach is most precise?
• During an incident investigation, which UDM search field best captures network activity tied to rarely seen commands?
• When investigating a malware incident in a Kubernetes workload, what should be your first action?
• When your case queue contains IP address entities, how should you determine internal vs external and mark internal IPs during ingestion into SOAR?
• You need real-time monitoring of data ingestion into SecOps and automatic notification if any data source stops ingesting, minimizing cost. What should you do?
• You want to automate responses from SCCE to an existing ticketing system. Which implementation best achieves this?
• An external identity with a highly privileged IAM role exists in a critical project. You need to determine whether actions were taken by this identity. Logs are centralized in Cloud Logging, and historical logs exported to BigQuery. What should you do?
• What language is used in Google SecOps to define complex detections with events, matches, and conditions?
• To investigate outbound and inbound traffic to a known C2 IP address, which search approach should you use in SecOps?
• What method helps monitor forwarders and collection agents and detect silent sources within five minutes?
• Upon noticing a high-volume, unusual download event from a cloud storage bucket, which action should you take first?
• Ingesting multi-region on-prem NAS logs into SecOps, which configuration ensures each NAS is tagged as a distinct log source to prevent IP aliasing?
• When designing an automated SOAR playbook to minimize dwell time in a ransomware incident with anomalous privileged service accounts, which action should be included?
• In monitoring, what is the benefit of a metric-absence alert for critical Windows server logs?
• Which configuration should be used to tag each NAS as a distinct log source to avoid IP aliasing in multi-region NAS log ingestion?
• Which change reduces false positives when a detection rule triggers on Cloud Storage enumeration by automation?
• To reduce false positives from service accounts in unusual login alerts, which is most effective?
• To identify repeated suspicious file downloads within a defined time window, which approach should you implement?
• Which configuration should be used when you want to avoid IP aliasing across four NAS regions and tag each as a log source?
• To extend parsing without rebuilding, what approach should you take?
• If you suspect anomalous outbound traffic to external domains is C2 communications, which search identifies least common network communications over the last 14 days?
• For continuous DNS comparison to threat feeds, most effective approach?
• Which strategy automatically remediates dormant service account keys when a finding is ingested into SecOps?
• If a Compute Engine instance is flagged for a high volume of outbound connections to diverse unknown IPs, what should you do to determine if it is compromised by malware?
• Your organization uses a prebuilt parser for a complex but stable log source and needs additional fields mapped to UDM. What should you do?
• Create a YARA-L detection rule to identify when an internal host initiates a network connection to an external IP that the Applied Threat Intelligence Fusion Feed associates with APT41. You must flag IP if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure?
• Which configuration uses feed management to pull data and configure an ingestion label per log source?
• Which action helps you track case stages and compute elapsed time with minimal overhead?
• PCI DSS v4.0 posture in SCC flags a Compute Engine VM in the CDE with an external IP. Immediate remediation?
• To analyze a malware sample efficiently for IOCs without alerting the threat group, which Threat Intelligence action should you take?
• You have ransomware incidents and need automated detection and containment. Which single action would most effectively achieve automated detection and containment?
• During a high-priority phishing incident, what workflow helps ensure timely escalation if analysts fail to escalate within SLA?
• For broad detection/response coverage across on-prem and cloud environments using SecOps and GTI, which single action best advances event-based integration?
• You are adopting multi-cloud and want comprehensive monitoring of threats using SecOps quickly. What should you do?
• You identify a common malware variant and need reliable IOCs and behaviors quickly to confirm infection and search for signs on other machines. What is the best first step?
• A case contains a file hash enriched with VirusTotal context and categorized as likely malicious. You need to quickly identify devices and users in your org who interacted with this file. What should you do?
• Group B requires access to all data except the 'restricted' namespace. Which data access scope design would satisfy this?
• Which option ensures each NAS log source is uniquely tagged in SecOps by applying an ingestion label?
• Which technique enables rapid identification of unknown C2 nodes by examining historic outbound connections against ingested threat intel?
• Which approach should be used to govern Vertex AI in a business unit, including predefined and custom organization policies and modules scoped to the business unit folder?
• In Cloud Identity + SecOps, external Google accounts are added to a group with project-level roles but cannot access SecOps, while internal users can. Which configuration most likely causes this?
• Your SecOps instance has roles Tier 1, Tier 2, Tier 3. New requirement: restrict access to Tier 3 cases from other tiers. What should you do?
• Which log source is needed to expand detection coverage when using curated detections and YARA-L rules on Windows endpoints?
• With SecOps Enterprise Plus but no threat intelligence feeds ingested, which approach should you take to quickly alert on an IOC of an active breach?
• In a multi-region NAS log ingestion scenario, which option uses a Bindplane agent collecting Syslog and an ingestion label per log source?
• Which action augments SCC with additional detectors using known IOCs and external signals?
• Which option provides built-in posture for the compliance framework within SCC posture?
• Detection rules triggering on internal IPs within 192.0.2.0/8 can cause false positives. Which YARA-L condition should you use to fix this?
• Which approach uses feed management to pull data and an ingestion label per log source to distinguish logs from all NAS devices?
• You want a new playbook deployable quickly by junior analysts using SecOps tools to address a remote shell alert. What should you do?
• SecOps alerts indicate repeated PowerShell activity and outbound connections to a domain not in your threat feeds across multiple systems and users. You need to search across impacted systems and identities to identify the malicious user and scope. What should you do?
• A Vertex AI deployment requires detective and preventative guardrails; how should you secure this environment?
• You run an app on a Compute Engine instance (Google-managed image) and need to ingest the app's logs into SecOps with minimal cost/time. Logs have a valid label/parser in SecOps. What should you do?
• External MSP users must list SCC findings with minimal involvement in external user lifecycle. What is the recommended approach?
• What is the recommended approach to create a centralized leadership dashboard that combines SCC findings with Cloud Audit Logs using managed services?
• When you see multiple login events with the same principal.user.userid from different countries within a short time window, you need to validate whether the account is compromised. What should you do?
• Which integration step best supports GTI-based enrichment when coordinating detection across on-prem and cloud environments?
• Which workflow supports time-windowed anomaly detection and analyst triage by using BigQuery, Cloud Run, Pub/Sub, and log-based metrics with SCC findings?
• A server hosting an internal web app was exposed to the internet for 48 hours. You want to run a UDM search to identify successful exploitations. What event field search should you use?
• To reduce alert noise by prioritizing alerts based on asset sensitivity, which data should you ingest into Google SecOps?
• To proactively identify novel/emerging attack patterns targeting Google Cloud in near real-time, which configuration should you implement? (Variant)
• Which order of steps best ensures detections reflect threat actor TTPs in GTI?
• To grant a group read-only access to all resources, including detection engine rules, which configuration is correct?
• To quickly reduce noise when detecting requests to potentially malicious domains from NDR logs, which approach is most appropriate?
• To pull SCC findings into SecOps for SOAR actions, how should you configure the connection?
• You need monitoring and alerting for Compute Engine instances tagged with compliance=pci that have an external IP. What should you do?
• A firewall parser fails to recognize fields after a patch introduces a new field and renames another. Which approach minimizes change management impact while restoring parsing capability?
• A SecOps report export to a BigQuery dataset runs successfully but the dataset remains empty. Which action should you take to fix the export with correct permissions?
• Which approach best enables low-latency ingestion of data from a Pub/Sub topic in a separate project into SecOps using a dedicated ingestion key?
• Users are restricted by a process with five-day restrictions from most recent flagging time. When ingesting SSO provider logs and on-prem appliance logs, what rule design supports quick implementation and easy maintenance to detect restricted user logins?
• You need to automate a SOAR playbook task to run once every day at a specific time with minimal overhead. What should you do?
• In Google SecOps, to identify traffic originating from the server hosting an HTTP backdoor on TCP port 5555, which event attribute should you monitor?
• For avoiding IP aliasing across NAS locations, which approach is recommended: feed management with an ingestion label per log source?
• To determine whether your organization has been victimized based on threat intel, which action provides quick coverage?
• For ETD detections focusing on data exfiltration from sensitive Cloud Storage and BigQuery, which action minimizes Cloud Logging costs?
• To ensure DLP-related changes are detectable in SecOps, which option supports capturing admin actions and supporting automated detection?
• When enriching data from a third-party DNS filter for UDM compatibility, which approach aligns with the least effort and maintainability?
• Which approach should you take to generate a list of unknown command and control (C2) nodes within 24 hours?
• How should you implement on-demand approvals for firewall changes requested by SOC analysts?
• To reduce false positives when monitoring with YARA-L, which approach is recommended?
• Compliance team requires regular reporting on compliance with standard control frameworks for a regulated business unit that continuously adds projects. You need a report including evidence of non-compliant resources. How should you generate this?
• A vendor privately reveals their web app has an XSS vulnerability exploitable; app runs on servers in cloud and on-prem. Before the CVE is released, you want to look for signs of exploitation. What should you do?
• Which approach should you use to validate a Gemini-generated playbook against a simulated remote shell alert?
• If phishing alerts feed into SecOps SOAR and you want to automatically include the SIEM query results in the case without writing code, which action should you implement?
• When leveraging a MISP feed to detect Command-and-Control domain indicators in the entity graph, which of the following entity settings should you apply to filter for domain IOCs?
• When Container Threat Detection alerts that an added binary has been executed in a business-critical workload, which two actions are most appropriate?
• To minimize the effort required to write detections when integrating Google Cloud services with SecOps, which action should you take?
• You want to reduce pivoting when triaging alerts using SecOps case management. Which approach should you take first?
• Why is it important to verify default parsers when evaluating a log source for SecOps ingestion?
• Your SecOps instance generates many alerts related to a C2 IP in a threat feed, but the queries originate from sandbox/test environments. You want to avoid alert fatigue while preserving visibility if the IOC reappears in production telemetry. What should you do?
• Which approach reduces alert fatigue by excluding known IOC matches while preserving visibility for future events?
• To capture time duration data for each case stage with minimal overhead, what should you do?
• To gain better visibility into OS risks for all VMs using Google-managed images with minimal effort, what should you do?
• To efficiently implement eight logical workflow branches in a SOAR playbook, which approach should you take?
• For MSSP onboarding, which configuration ensures separate case data by client within SecOps?
• Logs are delayed due to a time zone issue; which parser-related action is recommended?
• Which module is used to augment detectors with external IP indicators in SecOps?
• How should you configure two on-prem firewalls to forward logs to Google SecOps via Syslog?
• Which approach is NOT appropriate for sending on-prem firewall logs to Google SecOps via Syslog?
• Which configuration involves using feed management to pull data from each location and applying a label per log source?
• Which approach helps you identify all GTI threats within your data by using SecOps?
• Which setting should you configure to automatically identify internal CIDR ranges for IP addresses during ingestion into SecOps?
• In a ransomware incident, which containment action is recommended to include in an automated SOAR playbook when privileged accounts show anomalous activity?
• SHA generated a CONFIDENTIAL_COMPUTING_DISABLED finding. What is an appropriate quick remediation?
• What is the recommended approach to ensuring DLP case closures record a standardized root cause?
• Which option would you use to monitor data feed audit logs by ingesting into SecOps SIEM?
• To proactively identify novel/emerging attack patterns targeting Google Cloud in near real-time, which configuration should you implement?
• If you were to configure a Bindplane agent and an ingestion label per log source, which statement matches this setup?
• You need to calculate MTTR for cases. What should you do?
• Phishing alerts are ingested directly into SecOps SOAR from an email inbox, and analysts currently use a SIEM query; you want the query results to be automatically included in the case without writing new code. What should you do?
• You monitor critical Windows server logs via Bindplane and want immediate notification when no logs are ingested for over 30 minutes. Most efficient notification solution?
• To view previous enrichment attributes and relevant historical cases for an entity with the fewest steps, what should you do?
• MSSP onboarding to SecOps; how should you configure to logically separate cases by client?
• You need eight logical workflow paths in a SOAR playbook efficiently. What should you do?
• To automate updating IOC sources based on IC-Score thresholds, which automation construct would you implement?
• You are reviewing a UDM search result and find that the default columns are not helpful. Which action should you take to quickly surface relevant data?
• Which action best reduces IOC noise from a known exercise by muting matches?
• You use GTI to identify cyber threats and think your organization may have been targeted by a cyber crime group. What should you do to determine if your organization has been victimized?
• In the security analyst team's playbook action process, which step consolidates all actions awaiting user input in one location?
• In a SOAR playbook using VirusTotal v3 to set alert severity, which practice best informs severity?
• When developing a new YARA-L rule while minimizing impact on production, what workflow is recommended?
• SecOps SOAR integration with SCC uses a service account with read access at the org level. Actions to update finding states fail due to permission issues. Which least-privilege change should you implement?
• You identified a new malicious IP address used by a threat actor. You need to search for this IP in SecOps across all normalized logs to determine malicious activity. Which method is most effective?
• You identified a new threat actor group with several IOCs in GTI and want to use some IOCs in several SecOps detection rules. Most effective approach?
• When suspecting lateral movement from a development GKE cluster to production, which initial action helps identify IOCs and prioritize investigation before deep raw log analysis?
• In threat hunting with YARA-L, what is retrohunt used for?
• To identify all potential GTI IOCs within your organization's data using SecOps, which page should you use?
• If you previously exported AD context data and imported as watchlists in another SIEM, what should you do to improve SecOps usage?
• You are writing a SecOps SIEM rule that sends a risk score to the alert. You have GTI data via subscription. You need the threat score in detection logic to inform alert risk score and be available for future detections. What should you do?
• For ingestion health monitoring, which approach provides the best visibility into throughput and parsing errors?
• To reduce false positives from high-priority network indicators related to on-prem proxies, which exclusion is most appropriate?
• Which log source should be prioritized to gain visibility into user identity behavior, lateral movement, and privilege escalation in a cloud-heavy SecOps onboarding?
• Which change reduces false positives when a detection rule triggers on Cloud Storage object listing due to automation activity?
• You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack quickly. What action first?
• What BigQuery setting controls how long exported data remains available in a dataset for retention purposes?
• To minimize analyst effort when containing an endpoint via Gmail integration and require approval, which playbook design is most effective?
• In a cloud-first SecOps environment, which of the following is a key step to reduce detection-writing effort when integrating with Google Cloud services?
• What is the first step to enable Company A analysts to work in Google SecOps with data isolation and reuse of playbooks?
• When receiving alerts from multiple connectors in SecOps, which approach helps identify internal IP entities and assign a specific network name to trigger a playbook?
• For near real-time detection when a Cloud Run service agent modifies the IAM policy of an Artifact Registry repository, what is the recommended approach?
• For an ROI report on analyst activity in SecOps SOAR for the previous month, which option should you use?
• Which steps are required to configure the SCC integration for pulling findings into SecOps?
• What approach supports a centralized leadership dashboard that combines SCC findings with Cloud Logging security events using managed services and supports historical data and joins?
• Which option best enables consistent weekly export of high-priority case resolutions and SLA metrics as CSV attachments for distribution?