Google Security-Operations-Engineer Actual PDF : Google Cloud Certified - Professional Security Operations Engineer (PSOE) Exam

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

• A. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
• B. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
• C. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
• D. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.

Your organization uses Security Command Center (SCC) and relies on Compute Engine instances to run business-critical workloads. SCC has flagged a particular instance for exhibiting a high volume of outbound network connections to geographically diverse and unknown IP addresses. You need to determine whether the instance has been compromised by malware.
What should you do?

• A. Disable and re-enable the instances' network interface and determine whether the unusual network behavior is resolved.
• B. Examine the IAM roles assigned to the service account that are associated with the instance.
  Revoke any permissions that could have facilitated malware installation.
• C. Review the Google Cloud Service Health dashboard to identify any ongoing Google Cloud platform incidents that could be causing unusual network traffic from the instance.
• D. Analyze Event Threat Detection findings. Review the events and the outbound network connections associated with the instance.

You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

• A. Remove user accounts that have repeated invalid login attempts.
• B. Use UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.
• C. Enable default curated detections to automatically block suspicious IP addresses.
• D. Look for correlations across impacted users in the Risk Analytics dashboard.

Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?

• A. Generate a YARA-L rule in Google SecOps that detects when a service account key is created.
  Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.
• B. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
• C. Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.
• D. Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName:
  "google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.

Your third-party application data is published in a Pub/Sub topic located in a separate Google Cloud project from your Google Security Operations (SecOps) instance. Your attempts to push data from the Pub/Sub topic to Google SecOps have failed. You need to send this data into Google SecOps in a low-latency, robust way. What should you do?

• A. Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.
• B. Push the data to Cloud Logging, and modify the export filter in direct ingestion.
• C. Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.
• D. Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.