Professional Security Operations Engineer Practice Test

Professional Security Operations Engineer Practice Test practice questions, page 4 of 6, with answer review and explanations.

Question 16

Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?

  1. Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic. Configure a trigger to send an email alert when new events are sent to this feed.
  2. Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.
  3. Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
  4. Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.

Question 17

Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag. What should you do?

  1. Ask Cloud Customer Care to add a custom filter to the dashboard.
  2. Add a custom filter to the dashboard.
  3. Copy an existing dashboard and add a custom filter.
  4. Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps.

Question 18

A business unit in your organization plans to use Vertex AI to develop models within Google Cloud. The security team needs to implement detective and preventative guardrails to ensure that the environment meets internal security control requirements. How should you secure this environment?

  1. Implement Assured Workloads by creating a folder for the business unit and assigning the relevant control package.
  2. Implement preconfigured and custom organization policies to meet the control requirements. Apply these policies to the business unit folder.
  3. Create a policy bundle representing the control requirements using Rego. Implement these policies using Workload Manager. Scope this scan to the business unit folder.
  4. Create a posture consisting of predefined and custom organization policies and predefined and Security Health Analytics (SHA) custom modules. Scope this posture to the business unit folder.

Question 19

You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?

  1. Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.
  2. Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.
  3. Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
  4. Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.

Question 20

A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts. The rule was designed to detect suspicious Cloud Storage enumeration by triggering an alert whenever the storage.objects.list API operation is called using the api.operation UDM field. However, a legitimate backup automation tool that uses the same API, causing the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while still detecting potentially malicious usage. How should you modify the rule to improve its accuracy?

  1. Add principal.user.email != "backup-bot@foobaa.com" to the rule condition to exclude the automation account.
  2. Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
  3. Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
  4. Adjust the rule severity to LOW to deprioritize alerts from automation tools.