Google Security Operations Engineer (Beta) - GCP-SOE-B FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

You are tasked with building a workflow in Google Security Operations (SecOps) SOAR. The documentation you are using requires a logical split that has eight different possible paths. You need to break the workflow into eight separate workflows using an automatic and efficient approach. What should you do?

A. Create a playbook that uses a flow condition. Add four more branches to have a total of five branches and an "Else" branch. On the "Else" branch, include another flow condition. Include the remaining three branches with the logic required. B. Create eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to the alert. C. Create a playbook that uses a Multi-Choice Question answer choices. Add instructions describing which logic to use in the instruction or question fields. Have the analyst select the appropriate answer to move the flow into the right branch. D. Create eight playbooks for each workflow. Configure the triggered playbook to end on an instruction action that tells the analyst to pick a workflow from the playbooks tab and attach that workflow to the alert.

Discussion 0

Correct Answer: A Vote an answer

Question 2

Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?

A. Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output. B. Use a custom parser that outputs all fields as raw JSON for detection. C. Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser. D. Enable asset enrichment for the log source to infer missing fields based on correlated host activity.

Discussion 0

Correct Answer: C Vote an answer

Question 3

Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SO You want to automate the response process and integrate with the existing SOW ticketing system. How should you implement this functionality?

A. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system. B. Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector. C. Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps. D. Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.

Discussion 0

Correct Answer: A Vote an answer

Question 4

Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?

A. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key. B. Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName: "google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key. C. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key. D. Generate a YARA-L rule in Google SecOps that detects when a service account key is created. Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.

Discussion 0

Correct Answer: A Vote an answer

Question 5

You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?

A. Perform a UDM search for login events, and pivot to group results by user and country of origin. B. Run a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts. C. Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts. D. Perform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.

Discussion 0

Correct Answer: A Vote an answer

Question 6

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

A. Customize the Case Name format to include the DLP event type. B. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually. C. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types. D. Customize the Close Case dialog and add the five DLP event types as root cause options.

Discussion 0

Correct Answer: D Vote an answer

Question 7

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

A. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days. B. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days. C. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days. D. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days. E. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.

Discussion 0

Correct Answer: A,D Vote an answer

Question 8

You need to ingest audit logs from your organization's entire Google Cloud environment into Google Security Operations (SecOps). This process must include Cloud NAT logs for workloads within a designated folder. You need to configure this ingestion while minimizing integration complexity. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next?

A. Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps. B. Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps. C. Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder. D. Create a custom filter to export the folder-level Cloud NAT logs.

Discussion 0

Correct Answer: A Vote an answer

Question 9

Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag. What should you do?

A. Add a custom filter to the dashboard. B. Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps. C. Copy an existing dashboard and add a custom filter. D. Ask Cloud Customer Care to add a custom filter to the dashboard.

Discussion 0

Correct Answer: A Vote an answer