Google GCP-SOE-B Certification Exam Dumps with 87 Practice Test Questions [Q47-Q65]

Rate this post

Google GCP-SOE-B Certification Exam Dumps with 87 Practice Test Questions

New GCP-SOE-B Exam Dumps with High Passing Rate

Google GCP-SOE-B Exam Syllabus Topics:

Section	Weight	Objectives
Detection Engineering	20%	– Develop and maintain detection rules (YARA-L, Sigma) – Integrate detections with alerting and case management – Validate and tune detection logic to reduce false positives – Implement automated detection workflows
Data Management	22%	– Normalize and map data to Unified Data Model (UDM) – Optimize log and event data for analysis – Manage data retention, storage, and access policies – Plan and implement data ingestion pipelines
Incident Response	18%	– Conduct forensic analysis and root cause determination – Orchestrate and automate response actions – Triage, prioritize, and investigate security alerts – Document incidents and support remediation
Observability and Reporting	8%	– Generate compliance and operational reports – Build dashboards and metrics for security posture – Monitor platform health and performance
Platform Operations	14%	– Administer Google Threat Intelligence (GTI) integrations – Manage Google Security Operations (SecOps) platform settings – Configure and manage Security Command Center (SCC) resources
Threat Hunting	18%	– Document and report hunting findings – Design and execute threat-hunting methodologies – Leverage threat intelligence to identify anomalies and threats – Use UDM search and query languages effectively

NO.47 During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.

Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.

Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.

Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.

NO.48 You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC). You want to follow the Google-recommended approach.
What should you do?

Create a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories for IAM policy changes. When a change is detected identify the principal that made the change.

Configure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a custom dashboard in SCC to visualize the data.

Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects when a specified principal calls a method against a resource.

Implement a Cloud Run function that is triggered by IAM policy changes within the project and sends an alert to SCC using the Security Command Center API.

NO.49 You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?

Use the entity graph to correlate the user’s risk score with linked assets, and review any active alerts.

Perform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.

Perform a UDM search for login events, and pivot to group results by user and country of origin.

Run a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.

NO.50 You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?

Configure each network in the Google SecOps SOAR settings.

Enrich the IP address entities as the initial step of the playbook.

Modify the entity attribute in the alert overview.

Create an outcome variable in the rule to assign the network name.

NO.51 Your company’s SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall installed and configured with credentials. You want to use the integration to trigger firewall rule changes directly from the Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve the requested changes prior to deployment. How should you implement the workflow for analysts to trigger on demand?

Create an email template for the analyst to get approval for the change from the system administrator. Have the analyst fill out the needed fields, and send the email for approval. Once approved, use a manual action to make the change to the firewall rule from any open case.

Create an account for the system administrator in your Google SecOps instance to allow the system administrator to make the changes from Google SecOps directly. Add an escalation step to enable the analyst to assign the case to the system administrator.

Create a playbook where the firewall rule change is a manual step, allowing the analyst to edit the firewall rule as a pending action. Have the analyst email the system administrator with the change. Once approved, the analyst lets the playbook continue.

Create a request in the Google SecOps SOAR settings that includes a field for the firewall rule.Create a playbook that is triggered by this request. Configure the playbook step that makes the firewall rule change to send an approval request from the system administrator. The approval request must include the parameter being changed.

NO.52 Your company’s analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead. What should you do?

Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.

Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.

Create a Cron Scheduled Connector for this use case Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.

Use a VM to host a script that runs a playbook via an API call.

NO.53 You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

Enable “data read” and “data write” audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.

Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.

Enable “data read” audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.

Enable “data read” and “data write” audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.

NO.54 You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.

Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.

Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.

Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.

NO.55 You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

Enable default curated detections to automatically block suspicious IP addresses.

Use UDM Search to query historical logs for recent IOCS associated with the suspicious login attempts.

Remove user accounts that have repeated invalid login attempts.

Look for correlations across impacted users in the Risk Analytics dashboard.

NO.56 A phishing campaign successfully convinces users to grant OAuth permissions to a malicious third-party application. Which control failure MOST likely allowed this?

Weak endpoint protection

Missing email sandboxing

Lack of monitoring and restriction on OAuth consent grants

Missing antivirus signatures

NO.57 You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?

Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data.

Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious.

Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time.

Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.

NO.58 You need to ingest audit logs from your organization’s entire Google Cloud environment into Google Security Operations (SecOps). This process must include Cloud NAT logs for workloads within a designated folder. You need to configure this ingestion while minimizing integration complexity. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next?

Create a custom filter to export the folder-level Cloud NAT logs.

Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder.

Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps.

Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps.

NO.59 You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?

Design and develop a custom parser.

Apply any pending updates to the prebuilt parser.

Implement a parser extension on top of the prebuilt parser.

Implement middleware to modify the underlying data structure.

NO.60 You observe several distinct, low-severity suspicious activities associated with a single internal server. You determine that no single event is a high-confidence IO You need to create a solution that ensures ongoing and heightened scrutiny for this server. What should you do?

Schedule a daily Google Security Operations (SecOps) report detailing all activity on this server.

Develop a YARA-L detection rule specific to this server.

Add the server to a Google Security Operations (SecOps) watchlist, and monitor the watchlist closely for the next few weeks.

Create a case, isolate the server from the network, and escalate the case for forensic investigation.

NO.61 Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization’s environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.

Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.

Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

NO.62 You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group’s behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?

Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.

Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).

Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.

Search for the threat actor in Google Threat Intelligence, review the threat actor’s tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).

NO.63 Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?

Generate a YARA-L rule in Google SecOps that detects when a service account key is created. Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.

Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.

Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName: “google.iam.admin.v1.CreateServiceAccountKey” field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.

Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.

NO.64 You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps).
You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR’s features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?

Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.

Use the ROI – Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.

Use the filters and visualizations in the Management – SOC Status report in SOAR Reports to extract case-specific performance data.

Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.

NO.65 You are investigating whether an advanced persistent threat (APT) actor has operated in your organization’s environment undetected. You have received threat intelligence that includes:
– A SHA256 hash for a malicious DLL
– A known command and control (C2) domain
– A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.

Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.

Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.