Free Google Professional Security Operations Engineer practice questions

10 free Google Professional Security Operations Engineer practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 133 questions. Work through them, then open each answer to check your reasoning.

Get all 133 questions (US$39) · Download these 10 as a PDF

Question 1

You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor.

What should you do?

  1. Detect on events where network. ApplicationProtocol is HTTP.
  2. Detect on events where target.port is 5555.
  3. Detect on events where principal.port is 5555.
  4. Detect on events where network.ip_protocol is TCP.
Show answer and explanation

Correct answer: C. Detect on events where principal.port is 5555.

To identify traffic originating from the server running the backdoor, you need to detect on the source port (principal.port) being 5555. The principal represents the source of the traffic, so principal.port 5555 will capture outbound traffic from the compromised server. This is more effective than checking the application protocol or IP protocol alone, as multiple services could use HTTP or TCP, and target.port would only catch inbound traffic to that port rather than traffic originating from the backdoor server.

Why the other options are wrong

  • A. Detecting on HTTP protocol is too broad and will generate excessive false positives from legitimate HTTP traffic.
  • B. target.port represents the destination port, not the source port where the backdoor is running.
  • D. Detecting on TCP protocol alone is insufficiently specific and will capture all TCP traffic.

Question 2

You are an incident responder at your organization using Google Security Operations (SecOps) for monitonng and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation.

What should you do first?

  1. Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.
  2. Deploy emergency patches, and reboot the server to remove malicious persistence.
  3. Use the EDR integration to quarantine the compromised asset.
  4. Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
Show answer and explanation

Correct answer: C. Use the EDR integration to quarantine the compromised asset.

compromised asset. Using EDR integration to quarantine the compromised asset is the correct first action because it immediately isolates the threat while preserving forensic data on the endpoint. Quarantine prevents further lateral movement and data exfiltration while maintaining the ability to conduct forensic investigation. This approach balances containment with forensic preservation, unlike rebooting which destroys volatile memory, or blocking at the firewall which doesn't prevent local lateral movement.

Why the other options are wrong

  • A. Firewall blocking alone does not contain threats already present on the compromised system and does not prevent local network access.
  • B. Rebooting the server destroys critical forensic evidence in memory and defeats the investigation purpose.
  • D. Using VirusTotal and proxy blocking addresses only external communication and does not contain the already-compromised asset.

Question 3

Your organization uses Google Security Operations (SecOps). You discover frequent file downloads from a shared workspace within a short time window. You need to configure a rule in Google SecOps that identifies these suspicious events and assigns higher risk scores to repeated anomalies.

What should you do?

  1. Configure a rule that flags file download events with the highest risk score, regardless of time frame.
  2. Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.
  3. Configure a single-event YARA-L detection rule that assigns a risk outcome score and is triggered when a user downloads a large number of files in 24 hours.
  4. Enable default curated detections, and use automatic alerting for single file download events.
Show answer and explanation

Correct answer: B. Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.

assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame. A frequency-based YARA-L detection rule is designed to detect patterns of repeated suspicious events within a specific time window and assign risk scores accordingly. This approach identifies the anomalous behavior of multiple downloads in a short period, escalating the risk score as suspicious activity accumulates. Frequency-based detection is specifically intended for scenarios where individual events are not suspicious but repeated occurrences within a time window indicate malicious activity.

Why the other options are wrong

  • A. Flagging all file downloads with highest risk regardless of time frame generates excessive false positives.
  • C. Single-event rules cannot effectively detect frequency-based patterns across multiple events within a time window.
  • D. Default curated detections and single file download alerting do not address the need for frequency-based analysis or custom risk scoring.

Question 4

You are implementing Google Security Operations (SecOps) at your organization. You discover that the current detection rules are too noisy. Due to the high volume of alerts, some true positives might be missed. You want to ingest additional context sources to reduce false positives in your security detections and to improve the overall positive ratio of the alerts.

What should you do?

  1. Ingest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules.
  2. Ingest dark web forum handlers from your threat intelligence system to match dark web principals within the detection rules.
  3. Ingest IOCs from your threat intelligence system to validate the IP addresses, domains and hashes with the detection rules.
  4. Ingest tactics, techniques, and procedures (TTPs) from your threat intelligence system to validate the processes and tools with the detection rules.
Show answer and explanation

Correct answer: A. Ingest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules.

configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules. Ingesting high-value asset (HVA) data from the CMDB allows you to prioritize alerts based on asset sensitivity and business criticality. This contextual enrichment reduces noise by focusing analyst attention on alerts affecting critical systems while deprioritizing less important assets. This directly improves the signal-to-noise ratio and positive alert ratio by filtering alerts through business context rather than adding more indicators to match against.

Why the other options are wrong

  • B. Dark web forum handlers are not typically useful for validating detection rule matches and do not reduce false positives.
  • C. IOC matching may actually increase alert volume if not carefully tuned and doesn't prioritize based on business impact.
  • D. TTP matching is useful for threat detection but doesn't reduce false positives or improve the positive alert ratio through business context.

Question 5

You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes.

What should you do?

  1. Develop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.
  2. Use Gemini in Google SecOps to develop the rule by providing a description of the parameters and conditions, and transfer the rule into the Rules Editor.
  3. Develop the rule in the Rules Editor, define the sections the rule logic, and test the rule using the test rule feature.
  4. Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by setting it to live but not alerting. Run a YARA-L retrohunt from the rules dashboard.
Show answer and explanation

Correct answer: A. Develop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.

search output to inform changes to filters and logic, and copy the rule into the Rules Editor. Developing rule logic in the UDM search allows you to test and refine detection logic safely before creating the actual rule. The UDM search environment lets you validate your filters and logic against historical data, review the output to identify issues, and iterate on the logic. Once you have validated the approach, you copy the proven logic into the Rules Editor for production deployment. This minimizes production impact by completing validation before the rule is active.

Why the other options are wrong

  • B. Using Gemini to generate rules skips the critical validation step and may produce untested logic.
  • C. Testing rules directly in Rules Editor with the test feature provides limited visibility compared to UDM search and may impact production.
  • D. Setting rules to live without alerting and running retrohunts still introduces the rule into production systems before proper validation.

Question 6

Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company A's security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts: do not have access to any case data originating from outside of Company A. are able to re-purpose playbooks previously developed by your organization's employees.

You need to minimize effort to implement your solution.

What is the first step you should take?

  1. Acquire a second Google SecOps SOAR tenant for Company A.
  2. Provision a new service account for Company A.
  3. Define a new SOC role for Company A.
  4. Create a Google SecOps SOAR environment for Company A.
Show answer and explanation

Correct answer: C. Define a new SOC role for Company A.

Defining a new SOC role for Company A is the first step to implementing data isolation and access controls. A custom role allows you to define granular permissions that restrict Company A's analysts to only their cases and data while allowing them to reuse existing organizational playbooks. Role-based access control is the appropriate mechanism for enforcing data boundaries in a single Google SecOps environment, avoiding the overhead of separate tenants while providing necessary isolation.

Why the other options are wrong

  • A. Acquiring a second tenant is unnecessary overhead when a single environment can be properly configured with role-based access control.
  • B. A service account does not provide the interactive access control needed for human analysts.
  • D. Creating a separate SOAR environment requires more effort than using role-based access in the existing environment and doesn't align with minimizing implementation effort.

Question 7

You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group.

What should you do?

  1. Search for the threat group in Google Threat Intelligence.
  2. Upload the malware to Google Threat Intelligence by using VirusTotal.
  3. Upload the malware to Google Threat Intelligence by using Private Scanning.
  4. Calculate the file checksum for the malware, and search for the checksum in GoogleThreat Intelligence by using VirusTotal.
Show answer and explanation

Correct answer: C. Upload the malware to Google Threat Intelligence by using Private Scanning.

using Private Scanning. Private Scanning in Google Threat Intelligence allows you to upload and analyze malware without sharing the sample with public scanning services like VirusTotal. This prevents alerting the threat group that their custom malware has been detected and analyzed. Private Scanning provides analysis capabilities while maintaining operational security by keeping the malware discovery confidential.

Why the other options are wrong

  • A. Searching for the threat group does not analyze the malware or extract IOCs.
  • B. Uploading to VirusTotal publicly exposes the malware to the threat group and defeats the goal of analyzing without detection.
  • D. Calculating a checksum and searching VirusTotal still uses the public scanning platform and does not prevent alerting the threat group.

Question 8

Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules.

How should this be configured?

  1. Create a Google Group and add the required users. Grant the roles/chronicle. Viewer IAM role to the group on the project associated with your Google SecOps Instance.
  2. Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
  3. Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/ group/GROUP_ID principal set on the project associated with your Google SecOps instance.
  4. Create a workforce identity pool at the organization level Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/ group/GROUP_ID principal set on the project associated with your Google SecOps Instance.
Show answer and explanation

Correct answer: A. Create a Google Group and add the required users. Grant the roles/chronicle. Viewer IAM role to the group on the project associated with your Google SecOps Instance.

Grant the roles/chronicle. Viewer IAM role to the group on the project associated with your Google SecOps Instance. Creating a Google Group through Cloud Identity and granting the roles/chronicle.viewer IAM role provides read-only access to all Google SecOps resources including detection rules. This approach leverages the existing Cloud Identity IdP for seamless user management and applies the appropriate viewer role that grants comprehensive read-only permissions. The group-based assignment simplifies administration while maintaining access control.

Why the other options are wrong

  • B. The limitedViewer role restricts access and does not provide access to detection engine rules as required.
  • C. The editor role grants write access, not the read-only access required by the specification.
  • D. Using a workforce identity pool adds unnecessary complexity when Cloud Identity groups are already available, and the limitedViewer role doesn't grant access to detection rules.

Question 9

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours.

What should you do?

  1. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
  2. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
  3. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
  4. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
Show answer and explanation

Correct answer: A. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.

that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant. Writing a rule in Google Security Operations that scans historic network outbound connections against ingested threat intelligence and running it in a retrohunt is the most direct and efficient approach for identifying unknown C2 nodes within 24 hours. This method leverages existing threat intelligence feeds to match against historical data across the entire tenant, providing comprehensive coverage. Option B requires manual statistical analysis rather than automated threat matching. Option C reviews different types of findings unrelated to network C2 detection. Option D focuses on newly registered domains, which may miss established C2 infrastructure already active in the environment.

Why the other options are wrong

  • B. Statistical deviation analysis requires establishing baselines first and is less effective than threat intelligence matching for known C2 indicators.
  • C. Security Health Analytics findings focus on configuration issues, not active network- based C2 communication.
  • D. Filtering for low prevalence domains against recent WHOIS registrations misses established C2s and is unnecessarily restrictive.

Question 10

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident.

What should you do? (Choose two.)

  1. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
  2. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
  3. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
  4. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
  5. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
Show answer and explanation

Correct answer: A, B

A. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident. B. Review the finding, investigate the pod and related resources, and research the related attack and response methods. When responding to a Container Threat Detection alert about an executed binary, the correct approach is to first review and investigate the finding along with related resources to understand the threat (Option B), while simultaneously notifying stakeholders and following established response procedures (Option A). Option C incorrectly quarantines and deletes without investigation, destroying evidence and context needed for root cause analysis. Option D silencing a critical workload alert is inappropriate. Option E delays response unnecessarily by passively observing; active investigation and stakeholder notification are required for a business-critical workload.

Why the other options are wrong

  • C. Quarantining and deleting the pod without investigation destroys forensic evidence and assumes guilt without analysis of the binary's nature or origin.
  • D. Silencing an alert on a business-critical workload is negligent; the finding requires proper investigation regardless of severity level.
  • E. Passive observation without notifying owners or following response procedures violates incident response best practices and wastes critical response time.

That was 10 of 133.

The full Google Professional Security Operations Engineer pack has all 133 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack