support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. Google
  4. Security-Operations-Engineer

Google Security-Operations-Engineer Exam Actual Questions
Professional Security Operations Engineer (Page 3 )

Updated On: 17-Jul-2026
Page 3 of 28
PDF with 133 Questions

Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company A's security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts:

do not have access to any case data originating from outside of Company A.

are able to re-purpose playbooks previously developed by your organization's employees.

You need to minimize effort to implement your solution.
What is the first step you should take?

  1. Acquire a second Google SecOps SOAR tenant for Company
  2. Provision a new service account for Company A.
  3. Define a new SOC role for Company A.
  4. Create a Google SecOps SOAR environment for Company A.

Answer(s): C

Explanation:

The correct first step is to define a new SOC role for Company A within Google SecOps. By assigning appropriate role-based access controls, you can ensure Company A's analysts only see case data originating from their own telemetry, while still being able to reuse existing playbooks from your organization. This approach minimizes effort compared to acquiring or creating new environments or tenants.



You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group.
What should you do?

  1. Search for the threat group in Google Threat Intelligence.
  2. Upload the malware to Google Threat Intelligence by using VirusTotal.
  3. Upload the malware to Google Threat Intelligence by using Private Scanning.
  4. Calculate the file checksum for the malware, and search for the checksum in GoogleThreat Intelligence by using VirusTotal.

Answer(s): C

Explanation:

The correct action is to upload the malware to Google Threat Intelligence using Private Scanning. Private Scanning allows you to analyze malware safely and extract IOCs without sharing the sample publicly. This prevents alerting the threat group while still enabling rapid and detailed intelligence gathering.



Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?

  1. Create a Google Group and add the required users. Grant the roles/chronicle.Viewer IAM role to the group on the project associated with your Google SecOps Instance.
  2. Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
  3. Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/ group/GROUP_ID principal set on the project associated with your Google SecOps instance.
  4. Create a workforce identity pool at the organization level Grant the roles/chronicle.limitedViewer

    IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/ POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps Instance.

Answer(s): A

Explanation:

To grant read-only access to all Google SecOps resources, including detection engine rules, you assign the roles/chronicle.Viewer IAM role. The correct method is to create a Google Group, add the required users, and grant this role to the group at the project level tied to your Google SecOps instance. This ensures consistent, least-privilege access management through Cloud Identity.



Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours.
What should you do?

  1. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
  2. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
  3. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
  4. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

Answer(s): A

Explanation:

The fastest and most effective way to identify unknown C2 nodes within 24 hours is to write a detection rule in Google SecOps that compares historic outbound connections against ingested threat intelligence, then run it as a retrohunt across the full tenant. Retrohunt enables rapid scanning of past telemetry at scale to surface potential matches without waiting for new events to occur.



You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident.
What should you do? (Choose two.)

  1. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
  2. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
  3. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
  4. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
  5. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.

Answer(s): A,B

Explanation:

The correct response involves both notifying the workload owner and following the response playbook to ensure coordinated incident handling, and reviewing the finding while investigating the pod and related resources to understand the attack and determine the appropriate remediation. This approach ensures proper communication, structured incident response, and thorough technical investigation without prematurely deleting or silencing critical evidence.



  PDF
Viewing page 3 of 28
Viewing questions 11 - 15 out of 133 questions


Post your Comments and Discuss Google Security-Operations-Engineer exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!