Google : GCP-SOE-B Questions & Answers

Google GCP-SOE-B Exam Syllabus Topics:

Google Security Operations Engineer (Beta) Sample Questions:

Question 1

You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?

A. net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
B. net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
C. not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
D. not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")

Question 2

You work for a large international company that has several Compute Engine instances running in production. You need to configure monitoring and alerting for Compute Engine instances tagged with compliance-pci that have an external IP address assigned. What should you do?

A. Create a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance-pci tag is assigned an external IP address.
B. Deploy the compute.vmExternallpAccess organization policy constraint to prevent specific projects or folders with the compliance-pci tag from creating Compute Engine instances with external IP addresses.
C. Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance-pci tag.
D. Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance-pci tag exists on the instances.

Question 3

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

A. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
B. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
C. Generate a report in SOAR Reports, and schedule delivery of the report.
D. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.

Question 4

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on- premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

A. Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
B. Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
C. Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
D. Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.

Question 5

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

A. Create a widget that translates the JSON output to a severity score.
B. Use a conditional statement to determine whether to treat the URL as suspicious or benign.
C. Pass the response back to the SIEM.
D. Verify that the response is accurate by manually checking the URL in VirusTotal
E. Use the number of detections from the response JSON in a conditional statement to set the severity.

Solutions: