Study with Google : GCP-SOE-B Exam Torrent as your best preparation materials

Google GCP-SOE-B Exam Overview:

Google GCP-SOE-B Exam Syllabus Topics:

Google Security Operations Engineer (Beta) Sample Questions:

1. You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

A) Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
B) Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
C) Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
D) Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.

2. Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

A) Generate a report in SOAR Reports, and schedule delivery of the report.
B) Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
C) Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
D) Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.

3. You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

A) Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
B) Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
C) Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
D) Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
E) Review the finding, investigate the pod and related resources, and research the related attack and response methods.

4. You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?

A) Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.
B) Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data.
C) Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time.
D) Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious.

5. After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

A) Increasing log retention
B) Updating detections, playbooks, and IAM controls based on lessons learned
C) Closing all related alerts
D) Adding more analysts

Solutions: