실제 시험장에서 당황하지 않으려면 실전과 같은 연습이 필요합니다. Fast2test의 Security-Operations-Engineer 테스트 엔진은 Google Cloud Certified - Professional Security Operations Engineer (PSOE)의 실제 시험 환경을 그대로 재현하여, 2026년 출제 경향을 반영한 143문항을 시간 제한 안에 풀어 보실 수 있습니다.

Google Security-Operations-Engineer 시험 개요:

Google Security-Operations-Engineer 시험 요강 주제:

Security-Operations-Engineer 수험생을 위한 핵심 질문과 답변

최신 Google Cloud Certified Security-Operations-Engineer 무료샘플문제

문제 #1

You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

A. Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
B. Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
C. Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.
D. Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable

문제 #2

You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:
- Receive a notification when data sources go silent within 15 minutes.
- Visualize ingestion throughput and parsing errors.
What should you do?

A. Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane.
Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).
B. Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring.
Create a Cloud Monitoring dashboard to visualize data ingestion metrics.
C. Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.
D. Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.

문제 #3

During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of
30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?

A. Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.
B. Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.
C. Update the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.
D. Change the default case assignment logic to route all phishing alerts to the Tier 2 team.

문제 #4

You are reviewing the security analyst team's playbook action process. Currently, security analysts navigate to the Playbooks tab in Google Security Operations (SecOps) for each alert and manually run steps assigned to a user. You need to present all actions from alerts awaiting user input in one location for the analyst to execute. What should you do?

A. Enable approval links in the manual action and display them as clickable links to the user in a HTML widget in the Default Case View tab.
B. Create an Alert View with the playbook that incorporates the Pending Actions widget.
C. Add a general insight in your playbook to display manual action details to the user.
D. Use the Pending Actions widget in the Default Case View in settings.

문제 #5

Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?

A. Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
B. Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
C. Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic.
Configure a trigger to send an email alert when new events are sent to this feed.
D. Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.

질문과 대답: