Google Security Operations Engineer (Beta) Sample Questions:

1. Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

A) Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
B) Add an exception in the detection rule to exclude matches originating from specific asset groups.
C) Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
D) Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.

2. You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool.
You must recommend a tool to your leadership team as quickly as possible. What should you do? (Choose two.)

A) Review the architecture of the tool to identify the cloud provider that hosts the tool.
B) Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.
C) Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.
D) Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
E) Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.

3. You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

A) Modify the detection rule in the SIEM to include the query results as part of the detection.
B) Add an action to the playbook that runs the SIEM query and returns the results.
C) Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
D) Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.

4. You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

A) Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
B) Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
C) Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
D) Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.

5. You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

A) Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
B) Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
C) Review the finding, investigate the pod and related resources, and research the related attack and response methods.
D) Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
E) Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.

Solutions: