[2026] Google Security Operations Engineer (Beta) - GCP-SOE-B 무료 시험 문제

문제1

You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?

A. Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.

B. Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.

C. Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.

D. Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.

정답: B

문제2

You are using a Google-managed image on a Compute Engine instance in Google Cloud to run an application. You need to ingest the application's log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time required to move this data into Google SecOps. What should you do?

A. Create a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.

B. Use the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.

C. Use the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging. Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.

D. Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.

정답: C

문제3

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

A. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.

B. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.

C. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.

D. Generate a report in SOAR Reports, and schedule delivery of the report.

정답: B

문제4

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

A. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.

B. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

C. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

D. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.

정답: A

문제5

You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?

A. VPC Flow Logs

B. Cloud IDS logs

C. Cloud Audit Logs

D. Security Command Center Premium (SCCP) findings

정답: A

문제6

You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?

A. Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.

B. Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.

C. Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.

D. Set a retention period for the BigQuery export.

정답: C

문제7

You are reviewing the results of a UDM search in Google Security Operations (SecOps). The UDM fields shown in the default view are not relevant to your search. You want to be able to quickly view the relevant data for your analysis. What should you do?

A. Use the columns feature to select or remove columns that are relevant to your analysis.

B. Select the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.

C. Download the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.

D. Create a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.

정답: A

문제8

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

A. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.

B. Customize the Case Name format to include the DLP event type.

C. Customize the Close Case dialog and add the five DLP event types as root cause options.

D. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.

정답: C

문제9

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.

B. Configure the Windows server to send an email notification if there is an error in the Bindplane process.

C. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

D. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

정답: A

Google Security Operations Engineer (Beta) - GCP-SOE-B무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트