2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free Google Professional Security Operations Engineer Practice Questions

33 free Google Professional Security Operations Engineer practice questions from the CertStash pack of 133, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 33 free here, all 133 in the pack, and each step includes the one before it.

Get all 133 questions (US$39) · Download the first 10 as a PDF

Question 1

You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor.

What should you do?

  1. Detect on events where network.application_protocol is HTTP.
  2. Detect on events where target.port is 5555.
  3. Detect on events where principal.port is 5555.
  4. Detect on events where network.ip_protocol is TCP.
Show answer and explanation

Correct answer: C. Detect on events where principal.port is 5555.

In the Unified Data Model (UDM), the principal noun describes the entity that originates an activity, and the target noun describes the entity receiving it. A backdoor listening on TCP port 5555 sends its responses from that port, so traffic originating from the compromised server carries 5555 as its source port. Filtering on principal.port equal to 5555 therefore isolates outbound traffic from the backdoor host precisely, which is what the investigation requires. Generic filters on protocol or application layer would return enormous volumes of unrelated events and would not single out the server running the backdoor.

Why the other options are wrong

  • A. Filtering on HTTP as the application protocol matches all web traffic in the environment and does not isolate the backdoor host.
  • B. The target.port field describes the destination port, which captures connections sent to the server rather than traffic originating from it.
  • D. Filtering on TCP alone matches almost all network traffic and provides no meaningful scoping to the backdoor.

Question 2

You are an incident responder at your organization using Google Security Operations (SecOps) for monitoring and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation.

What should you do first?

  1. Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.
  2. Deploy emergency patches, and reboot the server to remove malicious persistence.
  3. Use the EDR integration to quarantine the compromised asset.
  4. Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
Show answer and explanation

Correct answer: C. Use the EDR integration to quarantine the compromised asset.

Quarantining the compromised asset through an EDR integration in Google SecOps SOAR isolates the server from the network immediately, cutting off attacker access and lateral movement, while leaving the host running with its disk, memory and installed persistence mechanisms intact for forensic analysis. This addresses both requirements at once: rapid containment and preservation of evidence. Host isolation through EDR is also more complete than blocking a single IP address, because an attacker with persistence can switch to other infrastructure.

Why the other options are wrong

  • A. Blocking one IP address leaves the host reachable through other attacker infrastructure and does not contain installed persistence mechanisms.
  • B. Patching and rebooting destroys volatile forensic evidence and does not reliably remove persistence.
  • D. Enrichment and a proxy block on one domain are slow, partial measures that do not isolate the compromised server.

Question 3

Your organization uses Google Security Operations (SecOps). You discover frequent file downloads from a shared workspace within a short time window. You need to configure a rule in Google SecOps that identifies these suspicious events and assigns higher risk scores to repeated anomalies.

What should you do?

  1. Configure a rule that flags file download events with the highest risk score, regardless of time frame.
  2. Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.
  3. Configure a single-event YARA-L detection rule that assigns a risk outcome score and is triggered when a user downloads a large number of files in 24 hours.
  4. Enable default curated detections, and use automatic alerting for single file download events.
Show answer and explanation

Correct answer: B. Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.

A frequency-based, multi-event YARA-L 2.0 rule correlates download events by a match variable such as the user over a defined time window and fires only when the count exceeds a threshold in the condition section. The outcome section can calculate a risk score, so repeated anomalous activity produces higher-risk detections that are easier to prioritize. This directly models frequent downloads in a short window, rather than treating each download in isolation, and gives the team control over both the threshold and the scoring logic.

Why the other options are wrong

  • A. Assigning the highest risk score to every download regardless of timing floods analysts with noise and ignores the frequency pattern.
  • C. A single-event rule evaluates each event independently and cannot count downloads across a time window.
  • D. Alerting on every single file download event produces excessive noise and does not detect bursts of activity.

Question 4

You are implementing Google Security Operations (SecOps) at your organization. You discover that the current detection rules are too noisy. Due to the high volume of alerts, some true positives might be missed. You want to ingest additional context sources to reduce false positives in your security detections and to improve the overall positive ratio of the alerts.

What should you do?

  1. Ingest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules.
  2. Ingest dark web forum handles from your threat intelligence system to match dark web principals within the detection rules.
  3. Ingest IOCs from your threat intelligence system to validate the IP addresses, domains and hashes with the detection rules.
  4. Ingest tactics, techniques, and procedures (TTPs) from your threat intelligence system to validate the processes and tools with the detection rules.
Show answer and explanation

Correct answer: A. Ingest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules.

Ingesting high-value asset data from a configuration management database adds entity context to Google SecOps, so detection rules can factor in the business criticality and sensitivity of the assets involved. Rules can then raise priority or risk for alerts on sensitive assets and filter or deprioritize activity on low-value systems, which reduces noise and improves the ratio of meaningful alerts. Asset context addresses the core problem of noisy detections by giving each alert business relevance, rather than adding more indicators to match against.

Why the other options are wrong

  • B. Dark web forum handles rarely map to principals in enterprise telemetry and do nothing to reduce noise from existing rules.
  • C. Adding IOC matching creates additional detections rather than providing the asset context needed to reduce false positives.
  • D. TTP descriptions are not structured context that rules can join against to suppress false positives in existing detections.

Question 5

You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes.

What should you do?

  1. Develop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.
  2. Use Gemini in Google SecOps to develop the rule by providing a description of the parameters and conditions, and transfer the rule into the Rules Editor.
  3. Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule using the test rule feature.
  4. Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by setting it to live but not alerting. Run a YARA-L retrohunt from the rules dashboard.
Show answer and explanation

Correct answer: C. Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule using the test rule feature.

The Rules Editor in Google SecOps supports writing a full YARA-L 2.0 rule, including the events, match and condition sections, and provides a test rule feature that runs the rule against historical data over a chosen time range. The results show which events and detections the logic would produce without enabling the rule, generating alerts or affecting production detection processing. Analysts can iterate on the logic until the detections are accurate and only then enable the rule, which satisfies the requirement to validate before production with minimal impact.

Why the other options are wrong

  • A. UDM search does not evaluate the rule's match and condition sections, so it cannot validate the complete rule logic.
  • B. Generating a rule with Gemini in Security Operations still leaves the rule untested before production.
  • D. Setting the rule to live puts it into production detection processing, which is what the requirement aims to avoid.

Question 6

Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company A's security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts:

• do not have access to any case data originating from outside of Company A.

• are able to re-purpose playbooks previously developed by your organization's employees.

You need to minimize effort to implement your solution.

What is the first step you should take?

  1. Acquire a second Google SecOps SOAR tenant for Company A.
  2. Provision a new service account for Company A.
  3. Define a new SOC role for Company A.
  4. Create a Google SecOps SOAR environment for Company A.
Show answer and explanation

Correct answer: D. Create a Google SecOps SOAR environment for Company A.

Environments in Google SecOps SOAR are logical containers for data segregation that can represent separate networks, customers or business units. Cases, ingestion and other modules are separated by environment, and analysts associated only with a specific environment see only its cases. Creating an environment for Company A and associating its analysts with it therefore isolates their case data within the existing instance. Because everything remains in the same platform, playbooks built by your organization's employees can be configured for multiple environments and reused, which keeps implementation effort low.

Why the other options are wrong

  • A. A second SOAR tenant adds cost and effort and separates Company A from the existing playbooks it needs to reuse.
  • B. A service account is a machine identity and does not segregate case data for human analysts.
  • C. A SOC role governs case assignment and responsibilities but does not segregate case data between business units.

Question 7

You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group.

What should you do?

  1. Search for the threat group in Google Threat Intelligence.
  2. Upload the malware to Google Threat Intelligence by using VirusTotal.
  3. Upload the malware to Google Threat Intelligence by using Private Scanning.
  4. Calculate the file checksum for the malware, and search for the checksum in Google Threat Intelligence by using VirusTotal.
Show answer and explanation

Correct answer: C. Upload the malware to Google Threat Intelligence by using Private Scanning.

Private Scanning in Google Threat Intelligence analyzes a submitted file with static, dynamic, network and similarity analysis, although without the multi-antivirus verdicts of a public submission, and the sample and its results are not shared with the VirusTotal community. Threat actors are known to monitor public submissions for their custom malware to learn whether they have been detected, so private analysis lets the team extract IOCs such as network indicators and behaviors quickly without tipping off the group. This balances speed of analysis with operational security.

Why the other options are wrong

  • A. Searching for the threat group provides background intelligence but does not analyze the new sample or extract its IOCs.
  • B. A standard VirusTotal upload makes the sample visible to others, which can alert the threat group that it has been discovered.
  • D. A custom-built sample is unlikely to have an existing hash match, so a checksum search yields no IOCs.

Question 8

Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer. You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules.

How should this be configured?

  1. Create a Google Group and add the required users. Grant the roles/chronicle.viewer IAM role to the group on the project associated with your Google SecOps Instance.
  2. Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
  3. Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
  4. Create a workforce identity pool at the organization level. Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps Instance.
Show answer and explanation

Correct answer: A. Create a Google Group and add the required users. Grant the roles/chronicle.viewer IAM role to the group on the project associated with your Google SecOps Instance.

Because the organization uses Cloud Identity, users and Google Groups are already Google identities, so access can be granted directly through IAM without Workforce Identity Federation. The predefined Chronicle API Viewer role, roles/chronicle.viewer, provides read-only access to Google SecOps resources, including detection engine rules. Granting it to a Google Group on the project bound to the Google SecOps instance gives every member consistent read-only access and simplifies ongoing management through group membership.

Why the other options are wrong

  • B. The limited viewer role excludes access to detection engine rules, which the group requires.
  • C. A workforce identity pool is only needed for a third-party IdP, and the editor role grants write access.
  • D. A workforce identity pool is unnecessary with Cloud Identity, and the limited viewer role excludes detection engine rules.

Question 9

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours.

What should you do?

  1. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence. Run the rule in a retrohunt against the full tenant.
  2. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
  3. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
  4. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
Show answer and explanation

Correct answer: A. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence. Run the rule in a retrohunt against the full tenant.

Threat intelligence feeds ingested into Google Security Operations regularly add newly identified command and control infrastructure that has never been seen in your own environment. A rule that matches historic outbound network connections against that ingested intelligence, run as a retrohunt across the full tenant, applies the detection logic to past events. The retrohunt returns every matching connection along with the hosts and users involved, which produces a concrete list of potential C2 matches well within the 24-hour deadline and with no custom data pipeline to build.

Why the other options are wrong

  • B. Loading network records into BigQuery and building a custom statistical model is a separate engineering project that is slower to deliver than a retrohunt in Google SecOps.
  • C. Security Health Analytics reports misconfigurations and vulnerabilities in Google Cloud resources, not command and control communication.
  • D. A prevalence and WHOIS heuristic rule needs design and tuning to separate C2 servers from benign new domains, which is less suited to producing a reliable list within 24 hours than a retrohunt against ingested threat intelligence.

Question 10

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident.

What should you do? (Choose two.)

  1. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
  2. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
  3. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
  4. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
  5. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
Show answer and explanation

Correct answer: A, B. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident; Review the finding, investigate the pod and related resources, and research the related attack and response methods.

An Added Binary Executed finding from Container Threat Detection indicates that a binary not present in the original container image was run, which can signal an attacker's tooling. Reviewing the finding, investigating the affected pod and related resources, and researching the associated attack technique and response methods establishes the scope and nature of the activity. For a business-critical workload, the workload owner must also be notified so that response follows the organization's playbook and the threat hunting team can determine the root cause, ensuring a coordinated response that avoids unnecessary disruption.

Why the other options are wrong

  • C. Quarantining the whole cluster and deleting the pod before investigation disrupts a critical workload and destroys forensic evidence.
  • D. An added binary execution can indicate compromise and must be investigated, not silenced.
  • E. Leaving a potentially compromised pod running without engaging the owner or following the response process allows the threat to continue.

What people say about the full Professional Security Operations Engineer pack 5.0 from 1

You Cert Stash guys make my dream come true. Thank you for the dump Google Cloud Certified - Professional Security Operations Engineer
AbelProfessional Security Operations Engineer

Question 11

You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes.

What should you do?

  1. Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.
  2. Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.
  3. Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
  4. Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.
Show answer and explanation

Correct answer: A. Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.

Google SecOps exports ingestion metrics to Cloud Monitoring, where alerting policies can notify on ingestion health. A metric-absence condition fires when a time series stops reporting data for a configured duration, which is exactly how a silent source appears. Basing the policy on the provided sample and grouping by collector_id produces a notification when any individual forwarder or collection agent stops sending logs, and the absence window can be set to meet the five-minute requirement.

Why the other options are wrong

  • B. A dashboard requires someone to watch it and does not send proactive notifications when a source goes silent.
  • C. A notification based on the total ingested log count, without a metric-absence condition, is not designed to detect a series that stops reporting entirely.
  • D. A Looker dashboard over exported data has added latency and provides no automatic alerting.

Question 12

Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog.

What should you do?

  1. Pull the firewall logs by using a Google SecOps feed integration.
  2. Set the Google SecOps URL instance as the Syslog destination.
  3. Deploy a third-party agent (e.g., Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
  4. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
Show answer and explanation

Correct answer: C. Deploy a third-party agent (e.g., Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.

Google SecOps does not accept Syslog directly from on-premises devices, so an agent must run in your environment to receive the Syslog stream and forward it to Google SecOps. A collection agent such as Bindplane, deployed on premises and set as the Syslog destination on both firewalls, listens for the messages, batches them and sends them securely to your Google SecOps instance for parsing into UDM.

Why the other options are wrong

  • A. Feeds pull data from cloud storage or APIs, or accept HTTPS push sources such as webhooks, and cannot receive Syslog from on-premises firewalls.
  • B. The Google SecOps instance URL is not a Syslog listener that firewalls can send to directly.
  • D. The Ops Agent sends telemetry to Cloud Logging and Cloud Monitoring, not to Google SecOps as a Syslog collector.

Question 13

Your company works with an external Managed Service Provider (MSP) that requires its users to have the ability to list findings from Security Command Center (SCC) using the Google Cloud SDK. You need to configure the required access for the managed service provider while minimizing your involvement in their external user lifecycle management processes.

What should you do?

  1. Create a user account in your Cloud Identity instance using a subdomain indicating they are external to your organization. Grant this user account the appropriate IAM role at the organization level.
  2. Create a service account in a SCC project. Grant the MSP user permission to impersonate this account. Grant this service account the appropriate IAM role at the organization level.
  3. Create a workload identity pool in a SCC project. Grant the MSP user the permission to impersonate a service account from this pool, and grant the service account the appropriate IAM role at the organization level.
  4. Create a workforce identity pool and federate with the identity provider (IdP) of the managed service provider. Grant users of the MSP the appropriate IAM role at the organization level.
Show answer and explanation

Correct answer: D. Create a workforce identity pool and federate with the identity provider (IdP) of the managed service provider. Grant users of the MSP the appropriate IAM role at the organization level.

Workforce Identity Federation lets users from an external identity provider access Google Cloud with their own credentials, without accounts being created or synchronized in your Cloud Identity. By creating a workforce identity pool federated with the managed service provider's IdP and granting the appropriate Security Command Center role to those users at the organization level, the MSP's users can list findings with the Google Cloud SDK. The MSP continues to manage joiners, movers, and leavers in its own IdP, minimizing your involvement in their user lifecycle.

Why the other options are wrong

  • A. Creating accounts in your Cloud Identity makes you responsible for the external users' lifecycle.
  • B. A shared impersonated service account still requires you to manage individual user grants and weakens accountability.
  • C. Workload identity pools are for workloads and applications, not for human users from an external organization.

Question 14

You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Your organization recently faced a cybersecurity breach. You need to increase the threat analytics as quickly as possible.

What should you do?

  1. Enable curated detections to identify threats.
  2. Design YARA-L detection rules based on Google SecOps Marketplace use cases.
  3. Develop YARA-L detection rules that focus on threat intelligence.
  4. Ingest data from a threat intelligence platform (TIP) into Google SecOps.
Show answer and explanation

Correct answer: A. Enable curated detections to identify threats.

Curated detections are rule sets built and maintained by Google's threat research teams that cover common attack techniques across cloud, Windows, network, and other data. They can be enabled from the console immediately and start generating detections against your existing telemetry without any rule authoring. After a breach, enabling them is the fastest way to expand threat analytics coverage, while Google keeps the rules updated as new threats emerge.

Why the other options are wrong

  • B. Designing custom YARA-L rules takes time to write, test, and tune, so it is not the quickest option.
  • C. Developing new threat intelligence rules also requires authoring and tuning effort before coverage improves.
  • D. Ingesting a TIP feed adds indicators but does not by itself provide detection logic or analytics.

Question 15

You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules.

What should you add to the YARA-L detection rules?

  1. net.ip_in_range_cidr(all $e.principal.ip, "192.0.2.0/8")
  2. net.ip_in_range_cidr(any $e.principal.ip, "192.0.2.0/8")
  3. not net.ip_in_range_cidr(all $e.principal.ip, "192.0.2.0/8")
  4. not net.ip_in_range_cidr(any $e.principal.ip, "192.0.2.0/8")
Show answer and explanation

Correct answer: D. not net.ip_in_range_cidr(any $e.principal.ip, "192.0.2.0/8")

The principal.ip field is repeated, so the any or all keyword, placed before the field inside the function, controls whether one or every IP address must satisfy the check. The expression net.ip_in_range_cidr(any $e.principal.ip, "192.0.2.0/8") is true if any principal IP falls within the internal range, and negating it with not keeps only events where none of the principal IP addresses are internal. Adding this condition to the events section excludes the internal addresses that are generating false positives.

Why the other options are wrong

  • A. Without negation, the condition restricts the rule to events whose principal addresses are all internal, so it keeps only the false positives instead of removing them.
  • B. Without negation, the rule matches only events that contain an internal address, the opposite of the goal.
  • C. Negating all only excludes events where every principal IP is internal, so events with a mix of addresses still trigger.

Question 16

Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead.

What should you do?

  1. Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
  2. Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.
  3. Create a Cron Scheduled Connector for this use case. Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.
  4. Use a VM to host a script that runs a playbook via an API call.
Show answer and explanation

Correct answer: C. Create a Cron Scheduled Connector for this use case. Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.

Playbooks in Google SecOps SOAR run in response to alerts that enter the platform. A Cron Scheduled Connector creates an alert on a defined schedule, such as once a day at a set time, and a playbook trigger that matches those alerts runs the existing playbook actions automatically. This reuses the playbook as is and relies only on built-in components, which keeps maintenance overhead low.

Why the other options are wrong

  • A. Rewriting the playbook logic as custom job code creates duplicate code that must be maintained separately.
  • B. A user request depends on someone manually starting the process each day.
  • D. Hosting a script on a VM adds infrastructure to patch, secure and maintain.

Question 17

Your company wants to enhance its detection capabilities to prevent insider threat incidents. You need to be alerted when a privileged Google Group is modified to allow access to the general public. You need to identify and enable the optimal log source, and configure the alert.

What should you do?

  1. Enable Google Drive log events. Create a reporting rule that triggers when a file sharing event occurs with the visibility set to anyone with the link.
  2. Enable VPC Flow Logs for the default VPC network. Configure a log-based alert in Cloud Logging to detect anomalous traffic patterns associated with Google Groups API endpoints.
  3. Enable IAM Admin Activity audit logs, and export the logs to Google Security Operations (SecOps). Write a YARA-L rule in Google SecOps to capture any changes to relevant IAM policies.
  4. Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.
Show answer and explanation

Correct answer: D. Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.

Changes to Google Group settings are recorded in Google Workspace Admin Audit logs, not in Cloud IAM or network logs. When you share Google Workspace log data with Google Cloud, Event Threat Detection in Security Command Center can analyze those logs and includes a built-in detector, Privilege Escalation: Privileged Group Opened To Public, that generates a finding when a group holding sensitive roles or permissions is changed to be accessible to the general public. This uses the correct log source and a managed detection, so no custom rule logic has to be written or maintained to receive the alert.

Why the other options are wrong

  • A. Drive file sharing events describe document visibility, not changes to Google Group membership settings.
  • B. VPC Flow Logs capture network metadata and cannot show configuration changes to a Google Group.
  • C. IAM Admin Activity logs record IAM policy changes, not Workspace group settings that open membership to the public.

Question 18

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach.

What should you do?

  1. Use the UDM lookup feature to identify relevant process-related UDM fields and values.
  2. Run a UDM search, and review aggregations for relevant process-related UDM fields.
  3. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
  4. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
Show answer and explanation

Correct answer: B. Run a UDM search, and review aggregations for relevant process-related UDM fields.

UDM search in Google SecOps returns matching events along with aggregations that summarize the distinct values of each UDM field and how often they occur. Running a search for process launch activity across servers and reviewing the aggregations for process-related fields, such as process names and file paths, immediately reveals the most common processes and applications. This approach requires no additional development and can be rerun on a regular basis to refresh baselines and exclusion lists.

Why the other options are wrong

  • A. UDM lookup helps identify which fields hold a value but does not show how frequently processes occur across the environment.
  • C. Alerts marked as false positives cover only processes that triggered rules, not the most common processes across all servers.
  • D. Building and maintaining a dashboard is more effort than reviewing the aggregations that UDM search already provides.

Question 19

You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool. You must recommend a tool to your leadership team as quickly as possible.

What should you do? (Choose two.)

  1. Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.
  2. Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
  3. Review the architecture of the tool to identify the cloud provider that hosts the tool.
  4. Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.
  5. Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
Show answer and explanation

Correct answer: D, E. Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested; Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.

Two quick checks confirm support with minimal customization. On the SIEM side, reviewing the documentation of supported log types and default parsers shows whether the tool's logs can be ingested and normalized into UDM without custom parsing work. On the SOAR side, finding the tool in the Google SecOps Marketplace and confirming that its integration includes the actions your workflows need shows whether response orchestration works out of the box. Together these establish SIEM and SOAR support quickly, so you can make a recommendation to leadership without building anything.

Why the other options are wrong

  • A. Developing a custom integration is the opposite of minimizing customization and takes the most time.
  • B. Building a custom Pub/Sub pipeline and custom rules adds customization and does not verify existing support.
  • C. The cloud provider hosting the tool has no bearing on whether Google SecOps supports its logs and actions.

Question 20

During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role.

You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment.

What should you do?

  1. Use Policy Analyzer to identify the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
  2. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
  3. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
  4. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs where the principal email matches the external identity.
Show answer and explanation

Correct answer: D. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs where the principal email matches the external identity.

Cloud Audit Logs record the identity that performed each action in the principal email field of the authentication information. Because all logs are routed to a centralized organization-level bucket and historical logs are in BigQuery, querying both for entries where the principal email matches the external identity reveals every action it took across the environment, over the full retained period. This directly answers whether the identity was used and what it did.

Why the other options are wrong

  • A. Policy Analyzer shows potential access, and reviewing per-resource logs is slower and can miss actions elsewhere.
  • B. VPC Flow Logs do not record API actions or identities, so they cannot show what the identity did.
  • C. Recommender insights and findings do not provide a complete record of the actions an identity performed.

Question 21

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:

• A SHA256 hash for a malicious DLL

• A known command and control (C2) domain

• A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments

Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities.

What should you do?

  1. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
  2. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
  3. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
  4. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
Show answer and explanation

Correct answer: A. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

Because process hashes are not captured consistently, a detection that relies only on the file hash would miss activity on many endpoints. A multi-event YARA-L rule can correlate the behavior pattern, rundll32.exe spawning powershell.exe with obfuscated arguments, together with the hash where it exists, so the behavioral link can still fire when the hash is absent, provided the rule does not require the hash to match. Running a retrohunt with that rule searches historical telemetry, which is essential for determining whether the actor already operated in the environment undetected.

Why the other options are wrong

  • B. A reference list of the hash and domain ignores the behavioral pattern and still depends on unreliable hash data.
  • C. A single-event rule on the file hash misses every endpoint where the hash is not recorded.
  • D. A manual search and asset tagging is a one-time investigation, not a detection mechanism.

Question 22

You are reviewing the security analyst team's playbook action process. Currently, security analysts navigate to the Playbooks tab in Google Security Operations (SecOps) for each alert and manually run steps assigned to a user. You need to present all actions from alerts awaiting user input in one location for the analyst to execute.

What should you do?

  1. Enable approval links in the manual action and display them as clickable links to the user in a HTML widget in the Default Case View tab.
  2. Add a general insight in your playbook to display manual action details to the user.
  3. Use the Pending Actions widget in the Default Case View in settings.
  4. Create an Alert View with the playbook that incorporates the Pending Actions widget.
Show answer and explanation

Correct answer: C. Use the Pending Actions widget in the Default Case View in settings.

The Pending Actions widget lists the manual playbook actions that are waiting for user input, and analysts can execute them directly from the widget. Adding it to the Default Case View in settings presents pending actions from all alerts in a case in one place, so analysts no longer need to open the Playbooks tab for each alert individually. Because the Default Case View applies across cases, the change benefits every analyst without per-playbook configuration.

Why the other options are wrong

  • A. Approval links in an HTML widget are a workaround that does not consolidate all pending manual actions for execution.
  • B. A general insight only displays information and does not let analysts execute the pending actions.
  • D. An Alert View is scoped to a single alert, so it does not gather actions from all alerts in one location.

Question 23

Your organization recently acquired a Google Security Operations (SecOps) Enterprise Plus license. Your organization is already ingesting Cloud Audit Logs, firewall logs, proxy logs and endpoint logs, but there are no threat intelligence feeds being ingested into your Google SecOps environment. You need to design and deploy a solution that alerts your team quickly if an IOC of an active breach is observed in your environment.

What should you do?

  1. Write, enable, and configure alerting on a custom multi-event rule.
  2. Write, enable, and configure alerting on a custom single-event rule.
  3. Enable and configure alerting for relevant curated detection rule sets.
  4. Create and schedule a dashboard to send periodic summaries of the active breach IOCs and their associated events.
Show answer and explanation

Correct answer: C. Enable and configure alerting for relevant curated detection rule sets.

A Google SecOps Enterprise Plus license includes Applied Threat Intelligence, which provides curated detection rule sets driven by Google Threat Intelligence and Mandiant indicators, including indicators observed in active breach investigations. These curated detections match that intelligence against the telemetry you already ingest without requiring you to set up separate threat intelligence feeds or write rules. Enabling the relevant rule sets and turning on alerting is the fastest way to be notified when an active breach indicator appears in your environment.

Why the other options are wrong

  • A. A custom multi-event rule still needs an indicator source, and none is being ingested.
  • B. A custom single-event rule has no threat intelligence feed to match against and requires ongoing maintenance.
  • D. Scheduled dashboard summaries are periodic reports, not timely alerts on an observed indicator.

Question 24

You work for a large international company that has several Compute Engine instances running in production. You need to configure monitoring and alerting for Compute Engine instances tagged with compliance=pci that have an external IP address assigned.

What should you do?

  1. Create a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance=pci tag is assigned an external IP address.
  2. Deploy the compute.vmExternalIpAccess organization policy constraint to prevent specific projects or folders with the compliance=pci tag from creating Compute Engine instances with external IP addresses.
  3. Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and search for the compliance=pci tag.
  4. Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance=pci tag exists on the instances.
Show answer and explanation

Correct answer: D. Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance=pci tag exists on the instances.

Security Health Analytics includes a built-in PUBLIC_IP_ADDRESS detector that produces a finding for every Compute Engine instance with an external IP address. Because the detector is already part of Security Command Center, it starts monitoring immediately and generates findings that can drive notifications and alerting with no custom logic to write or maintain. Checking whether each flagged instance carries the compliance=pci tag then narrows the findings to the in-scope PCI workloads, which meets the requirement with the least configuration effort.

Why the other options are wrong

  • A. Event Threat Detection analyzes log events for threats and is not the service for evaluating resource configuration such as an assigned external IP address.
  • B. An organization policy constraint prevents the configuration but does not provide the requested monitoring and alerting.
  • C. A custom Security Health Analytics module requires writing, testing and maintaining your own detection logic when a built-in detector already identifies instances with external IP addresses.

Question 25

Your company recently started pulling JSON logs from a third-party system into Google Security Operations (SecOps). You noticed that some fields are missing, and you want to parse them into UDM fields as quickly as possible.

What should you do?

  1. Configure auto extraction to add the additional fields.
  2. Create parser extensions using the no-code approach.
  3. Create parser extensions using the code snippet approach.
  4. Submit a parser improvement request to Cloud Customer Care.
Show answer and explanation

Correct answer: B. Create parser extensions using the no-code approach.

Parser extensions let you add mappings on top of an existing parser without replacing it. For logs in native JSON, XML, or CSV format, the no-code (Map data fields) approach is the fastest option: you select the raw log source fields and map each one to the destination UDM field in the user interface, with no parser code to write or debug. Because the third-party logs are JSON and the goal is simply to populate UDM fields that are currently missing, the no-code approach delivers the result in the least time.

Why the other options are wrong

  • A. Auto extraction stores key-value pairs in the separate extracted map field rather than mapping them into the proper UDM fields.
  • C. The code snippet approach works but requires writing parser syntax, which is slower than mapping fields without code for simple JSON logs.
  • D. Waiting for Cloud Customer Care to update the parser is the slowest path and outside your control.

25 questions in. Want the rest? The first half of the pack, free by email · The full pack

Question 26

You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise, Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI). You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time.

What should you do?

  1. Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.
  2. Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.
  3. Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.
  4. Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.
Show answer and explanation

Correct answer: B. Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.

The Applied Threat Intelligence Fusion Feed brings Google Threat Intelligence and Mandiant indicators, including intelligence about novel and emerging campaigns, into Google SecOps. YARA-L detection rules can reference this feed and match it against ingested Google Cloud telemetry as data arrives, giving near real-time detection of activity tied to current threat patterns. This combines curated threat intelligence with your own hunting logic, which is what proactive threat hunting in the Google Cloud environment requires.

Why the other options are wrong

  • A. Event Threat Detection relies on Google-managed detectors and template-based custom modules, so it does not support proactive hunting with your own rules against Google Threat Intelligence.
  • C. Scheduled BigQuery queries with open-source feeds are not near real-time and lack Google Threat Intelligence.
  • D. Cloud Armor protects web applications at the edge and is not a threat hunting capability.

Question 27

Your organization recently conducted a penetration test on their environment. You have been tasked with identifying a successful attack chain.

The required log sources have been ingested into Google Security Operations (SecOps). You discover anomalous outbound traffic to external domains. You suspect that the finding is a communication to a command and control (C2) infrastructure. You need to identify the least common network communications over the last 14 days.

What should you do?

  1. Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for target domains over the last 14 days.
  2. Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for principal domains over the last 14 days.
  3. Perform a Google SecOps SOAR search that looks for cases with low rolling prevalence of NETWORK_CONNECTION or NETWORK_HTTP events over the last 14 days.
  4. Perform a Google SecOps SIEM raw log search that looks for low rolling prevalence domains with NETWORK_CONNECTION or NETWORK_HTTP in the firewall and proxy logs over the last 14 days.
Show answer and explanation

Correct answer: A. Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for target domains over the last 14 days.

Command and control traffic is characterized by outbound connections to destinations that few or no other assets in the environment contact. A UDM search over NETWORK_CONNECTION and NETWORK_HTTP events, filtered for target domains with low rolling prevalence across the last 14 days, surfaces exactly those rare external destinations. The target side of the UDM event represents the external domain being contacted, and prevalence data from the entity graph quantifies how uncommon that domain is in your organization, making this the most direct way to find the least common network communications.

Why the other options are wrong

  • B. The principal is the internal initiating host, so prevalence of principal domains does not identify rare external destinations.
  • C. SOAR case search works on cases and alerts, not on prevalence of network telemetry.
  • D. Raw log search matches strings in unparsed logs and cannot use UDM event types or prevalence values.

Question 28

You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization.

What should you do?

  1. Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.
  2. Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).
  3. Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.
  4. Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).
Show answer and explanation

Correct answer: D. Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).

A group that builds new infrastructure for each campaign makes indicator-based detection ineffective, because its IP addresses, domains and hashes change constantly. Its tactics, techniques and procedures change far less often. Reviewing the threat actor's profile and TTPs in Google Threat Intelligence and building Google SecOps detections around those behaviors lets you identify the group's activity even when it uses infrastructure that has never been seen before.

Why the other options are wrong

  • A. Focusing on exposed technologies is vulnerability-driven and not based on the group's known behaviors.
  • B. Reviewing scattered intelligence reports is less direct than using the actor's documented TTPs in Google Threat Intelligence.
  • C. Exported IOCs quickly go stale for a group that uses campaign-specific infrastructure.

Question 29

Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts.

How should you build this capability?

  1. Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic. Configure a trigger to send an email alert when new events are sent to this feed.
  2. Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.
  3. Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
  4. Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
Show answer and explanation

Correct answer: B. Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.

Windowing and aggregating data over time with advanced calculations requires an analytical store, and BigQuery handles this at the scale of thousands of projects through an aggregated log sink. Cloud Run functions can run periodic queries and publish normalized results to Pub/Sub, while log-based metrics cover simpler event-driven detections. Writing the results as findings through the Security Command Center API places them alongside built-in findings, giving analysts a single interface to triage alerts without adopting Google SecOps.

Why the other options are wrong

  • A. Cloud SQL is not suited to large-scale log analytics, and email alerts provide no triage interface.
  • C. Log-based metrics cannot perform complex windowed aggregations, and email alerts give analysts no triage interface.
  • D. Writing JSON files to Cloud Storage provides neither windowed analysis nor a triage interface for analysts.

Question 30

Your organization is conducting a penetration test. The CISO has asked you to implement a real-time method to track cases that originate from the penetration test, and clearly differentiate these cases from other security incidents. You need to recommend the most effective and efficient approach to achieve this goal in Google Security Operations (SecOps).

What should you do?

  1. Implement case tagging within Google SecOps and apply a unique tag (e.g., PenTest) to all cases related to the penetration test entities. Use this tag for filtering and monitoring.
  2. Create a dashboard that is connected to the Google SecOps data lake. Use prebuilt templates to visualize case status based on the penetration testing IP address range.
  3. Create a custom Google SecOps SOAR playbook that automatically extracts case metadata, including key findings and risk scores, and sends an email summary to the CISO.
  4. Configure a custom alert rule that triggers a high-severity alert for all activity originating from the penetration testing team's source IP addresses and sends a notification for potential critical vulnerabilities. Verify that these alerts are immediately visible in the alert queue.
Show answer and explanation

Correct answer: A. Implement case tagging within Google SecOps and apply a unique tag (e.g., PenTest) to all cases related to the penetration test entities. Use this tag for filtering and monitoring.

Tags in Google SecOps SOAR are designed for classifying cases. Applying a unique tag such as PenTest to cases tied to the penetration test entities marks them the moment they are created or updated, and the tag can be used to filter the case queue and to build monitoring views. This gives real-time tracking and a clear separation from genuine incidents with minimal configuration, which makes it the most effective and efficient approach.

Why the other options are wrong

  • B. Visualizing by IP address range in a data lake dashboard is indirect, not real time, and does not mark the cases themselves.
  • C. An email summary playbook reports on cases but does not differentiate them inside the case queue.
  • D. A new high-severity alert rule adds noise and creates more alerts instead of labeling the existing penetration test cases.

Question 31

Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process and integrate with the existing SOC ticketing system.

How should you implement this functionality?

  1. Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.
  2. Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.
  3. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system.
  4. Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.
Show answer and explanation

Correct answer: C. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system.

Security Command Center notification configurations publish findings to a Pub/Sub topic as soon as they are created or updated. A Cloud Run function triggered by messages on that topic can read each finding and call the API endpoint of the SOC's existing ticketing system to open a ticket automatically. This event-driven design works with any ticketing system that exposes an API, so it integrates with the organization's current tool without depending on a prebuilt connector, and it removes manual steps from the response process.

Why the other options are wrong

  • A. Reviewing each finding in the console and creating tickets by hand is manual and does not automate the response.
  • B. Ingesting findings into the SIEM through Pub/Sub makes them searchable but does not create tickets in the ticketing system.
  • D. Swapping SOAR posture playbooks relies on a playbook built for a specific supported ticketing product, which is less suited to integrating an arbitrary existing ticketing system than a direct API call.

Question 32

A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts. The rule was designed to detect suspicious Cloud Storage enumeration by triggering an alert whenever the storage.objects.list API operation is called using the api.operation UDM field.

However, a legitimate backup automation tool uses the same API, causing the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while still detecting potentially malicious usage.

How should you modify the rule to improve its accuracy?

  1. Add principal.user.email != "backup-bot@foobaa.com" to the rule condition to exclude the automation account.
  2. Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
  3. Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
  4. Adjust the rule severity to LOW to deprioritize alerts from automation tools.
Show answer and explanation

Correct answer: A. Add principal.user.email != "backup-bot@foobaa.com" to the rule condition to exclude the automation account.

The false positives come from one known, trusted identity, so the precise fix is to exclude that identity from the rule's logic. Adding a filter that requires principal.user.email to differ from the backup automation account suppresses detections caused by the backup tool while the rule continues to fire for any other principal that calls storage.objects.list. This preserves detection coverage for potentially malicious enumeration and removes only the known benign source.

Why the other options are wrong

  • B. Matching on the Cloud Storage service name broadens the rule to all storage API calls and increases false positives.
  • C. A backup tool typically makes repeated calls across many buckets, so a multi-event rule would likely still fire for it.
  • D. Lowering severity leaves the false positives in place and also deprioritizes genuine malicious activity.

Question 33

You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst.

What should you do?

  1. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
  2. Create a case for each identified user with the user designated as the entity.
  3. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
  4. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
Show answer and explanation

Correct answer: A. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.

The Create Entity action in the Siemplify integration adds entities to the current alert. Using the Expression Builder, you can build a placeholder that pulls the usernames from the UDM query action's JSON results and pass it to the Entities Identifier parameter. The playbook then creates the user entities automatically and can continue to the password reset step, so the SOC analyst does not need to take any manual action.

Why the other options are wrong

  • B. Creating a separate case for each user fragments the investigation and does not add the users to the existing alert.
  • C. An Instruction action relies on the analyst to add entities manually, increasing effort.
  • D. A manual action requires the analyst to enter the identifiers, which does not minimize analyst effort.

That was 33 of 133.

The full Google Professional Security Operations Engineer pack has all 133 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 66 free as one PDF by email. Get the Half Pack →