Fast2test의 Google Security Operations Engineer (Beta) 학습 자료는 PDF, Desktop Test Engine, Online Test Engine 세 가지 형태로 제공됩니다. 인쇄하여 공부하거나 실제 시험 환경과 유사한 모의고사로 연습하는 등 GCP-SOE-B 준비 방식을 자유롭게 선택하실 수 있습니다.

Google GCP-SOE-B 시험 개요:

Google GCP-SOE-B 시험 요강 주제:

GCP-SOE-B 시험에 대해 궁금한 점을 모았습니다

최신 Google Cloud Certified GCP-SOE-B 무료샘플문제

문제 #1

You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

A. Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
B. Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
C. Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.
D. Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.

문제 #2

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

A. Create a widget that translates the JSON output to a severity score.
B. Use a conditional statement to determine whether to treat the URL as suspicious or benign.
C. Pass the response back to the SIEM.
D. Verify that the response is accurate by manually checking the URL in VirusTotal
E. Use the number of detections from the response JSON in a conditional statement to set the severity.

문제 #3

You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?

A. Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.
B. Perform a UDM search for login events, and pivot to group results by user and country of origin.
C. Run a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
D. Perform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.

문제 #4

During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

A. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
B. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
C. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
D. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.

문제 #5

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift. This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?

A. Navigate to the underlying Security Health Analytics (SHA) finding for PUBLIC_IP_ADDRESSon the VM, and mark this finding as fixed.
B. Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.
C. Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.
D. Enable and enforce theconstraints/compute.vmExternallpAccess organization policy constraint at the project level for the project where the VM resides.

질문과 대답: