Free GCP-SOE-B Questions for Google GCP-SOE-B Exam

Question #1

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

A. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.

B. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.

C. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.

D. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.

Discussion 0

Correct Answer: D Vote an answer

Question #2

Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

A. In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.

B. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.

C. Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.

D. Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.

Discussion 0

Correct Answer: B Vote an answer

Question #3

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

A. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.

B. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.

C. Generate a report in SOAR Reports, and schedule delivery of the report.

D. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.

Discussion 0

Correct Answer: B Vote an answer

Question #4

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A. Configure the Windows server to send an email notification if there is an error in the Bindplane process.

B. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.

C. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

D. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

Discussion 0

Correct Answer: B Vote an answer

Question #5

You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps. What should you do?

A. Initiate a SIEM Search to query the entity.

B. Select the entity identifier in the Entity Highlights widget to open Entity Explorer.

C. Select View Details for the entity in the Entity Highlights widget.

D. Initiate a SOAR Search to query the entity.

Discussion 0

Correct Answer: B Vote an answer

Question #6

You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?

A. Write a YARA-L 2.0 detection rule that searches for events with the IP address.

B. Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.

C. On the Alerts & IOCS page, review results and entries where the IP address appears.

D. Run raw log searches using the IP address as a search term.

Discussion 0

Correct Answer: B Vote an answer

Question #7

Which Google Cloud security feature MOST helps enforce the principle of least privilege at scale?

A. Binary Authorization

B. IAM predefined roles and conditional IAM policies

C. VPC Firewall Rules

D. Cloud NAT

Discussion 0

Correct Answer: B Vote an answer

Question #8

Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?

A. Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.

B. Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.

C. Use Gemini to generate YARA-L rules for multi-cloud use cases.

D. Use curated detections from the Cloud Threats category to monitor your cloud environment.

Discussion 0

Correct Answer: D Vote an answer

Question #9

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

A. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.

B. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.

C. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.

D. Review the finding, investigate the pod and related resources, and research the related attack and response methods.

E. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.

Discussion 0

Correct Answer: A,D Vote an answer

Free GCP-SOE-B Questions for Google Security Operations Engineer (Beta) GCP-SOE-B Exam as PDF & Practice Test Engine

Download Free Google GCP-SOE-B Demo