New Year Sale 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

ExamsBrite Dumps

Google Cloud Certified - Professional Security Operations Engineer (PSOE) Exam Question and Answers

Google Cloud Certified - Professional Security Operations Engineer (PSOE) Exam

Last Update Jan 14, 2026
Total Questions : 60

We are offering FREE Security-Operations-Engineer Google exam questions. All you do is to just go and sign up. Give your details, prepare Security-Operations-Engineer free exam questions and then go for complete pool of Google Cloud Certified - Professional Security Operations Engineer (PSOE) Exam test questions that will help you more.

Security-Operations-Engineer pdf

Security-Operations-Engineer PDF

$36.75  $104.99
 Add to Cart
Security-Operations-Engineer Engine

Security-Operations-Engineer Testing Engine

$43.75  $124.99
 Add to Cart
Security-Operations-Engineer PDF + Engine

Security-Operations-Engineer PDF + Testing Engine

$57.75  $164.99
 Add to Cart
Questions 1

You are developing a security strategy for your organization. You are planning to use Google Security Operations (SecOps) and Google Threat Intelligence (GTI). You need to enhance the detection and response across multi-cloud and on-premises systems. How should you integrate these products?

Choose 2 answers

Options:

A.  

Ingest GTI IOCs into Google SecOps as security events.

B.  

Ingest on-premises and cloud security logs into Google SecOps SIEM as events.

C.  

Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.

D.  

Use Google SecOps SOAR integrations with GTI for event enrichment.

E.  

Use Google SecOps SOAR integrations with GTI for entity enrichment.

Discussion 0
Questions 2

You are managing the integration of Security Command Center (SCC) with downstream tooling. You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps.

Options:

A.  

Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.

B.  

Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.

C.  

Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.

D.  

Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.

Discussion 0
Questions 3

Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?

Options:

A.  

Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.

B.  

Pull the firewall logs by using a Google SecOps feed integration.

C.  

Deploy a third-party agent (e.g., Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.

D.  

Set the Google SecOps URL instance as the Syslog destination.

Discussion 0
Questions 4

You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?

Options:

A.  

In Google SecOps SOAR settings, create a role for each customer.

B.  

In Google SecOps Playbooks, create a playbook for each customer.

C.  

In Google SecOps SOAR settings, create a permissions group for each customer.

D.  

In Google SecOps SOAR settings, create a new environment for each customer.

Discussion 0
Questions 5

Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want to use the most efficient solution that minimizes maintenance overhead.

Options:

A.  

Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.

B.  

Create a Cron Scheduled Connector for this use case. Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.

C.  

Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.

D.  

Use a VM to host a script that runs a playbook via an API call.

Discussion 0
Questions 6

Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?

Options:

A.  

Configure and deploy a Bindplane collection agent

B.  

Configure a third-party API feed in Google SecOps.

C.  

Configure direct ingestion from your Google Cloud organization.

D.  

Configure and deploy a Google SecOps forwarder.

Discussion 0
Questions 7

You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool. You must recommend a tool to your leadership team as quickly as possible. What should you do?

Choose 2 answers

Options:

A.  

Review the architecture of the tool to identify the cloud provider that hosts the tool.

B.  

Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.

C.  

Identify the tool in the Google SecOps Marketplace, and verify support for the necessary actions in the workflow.

D.  

Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.

E.  

Configure a Pub/Sub topic to ingest raw logs from the third-party tool, and build custom YARA-L rules in Google SecOps to extract relevant security events.

Discussion 0
Questions 8

You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

Options:

A.  

Use Gemini to generate a playbook based on a template from a standard incident response plan, and implement automated scripts to filter network traffic based on known malicious IP addresses.

B.  

Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.

C.  

Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.

D.  

Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.

Discussion 0
Questions 9

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift.1 This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?

Options:

A.  

Enable and enforce the constraints/compute.vmExternalIpAccess organization policy constraint at the project level for the project where the VM resides.

B.  

Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.

C.  

Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.

D.  

Navigate to the underlying Security Health Analytics (SHA) finding for public_ip_address on the VM. and mark this finding as fixed.

Discussion 0
Questions 10

Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

Options:

A.  

Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.

B.  

Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.

C.  

Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.

D.  

Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

Discussion 0
Questions 11

Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?

Options:

A.  

Use Gemini to generate YARA-L rules for multi-cloud use cases.

B.  

Use curated detections from the Cloud Threats category to monitor your cloud environment.

C.  

Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.

D.  

Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.

Discussion 0
Questions 12

Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?

Options:

A.  

Configure a rule exclusion for the target.ip field.

B.  

Configure a rule exclusion for the principal.ip field.

C.  

Configure a rule exclusion for the network.asset.ip field.

D.  

Configure a rule exclusion for the target.domain field.

Discussion 0
Questions 13

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process. Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained.

What should you do?

Options:

A.  

Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time-to-live values.

B.  

Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.

C.  

Store the flagged users in a data table column with their corresponding time-to-live values in a second column. Use row-based comparisons in the detection rule.

D.  

Create a regex data table to store each user and the corresponding time-to-live value in a single row, pipe-delimited, and use an "in" keyword in your detection rule.

Discussion 0
Questions 14

You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:

• Receive a notification when data sources go silent within 15 minutes.

• Visualize ingestion throughput and parsing errors.

What should you do?

Options:

A.  

Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.

B.  

Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.

C.  

Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane. Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).

D.  

Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring. Create a Cloud Monitoring dashboard to visualize data ingestion metrics.

Discussion 0
Questions 15

Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer. You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?

Options:

A.  

Create a Google Group and add the required users. Grant the roles/chronicle.viewer IAM role to the group on the project associated with your Google SecOps instance.

B.  

Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.

C.  

Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.

D.  

Create a workforce identity pool at the organization level. Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.

Discussion 0
Questions 16

You manage a large fleet of Compute Engine instances. Security Command Center (SCC) has generated a large number of CONFIDENTIAL_COMPUTING_DISABLED findings. You need to quickly tune these findings.

What should you do?

Options:

A.  

Manually mark the findings as inactive.

B.  

Disable Event Threat Detection (ETD)

C.  

Create a mute rule for the finding.

D.  

Disable the Security Health Analytics detector (SHA).

Discussion 0
Questions 17

You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?

Options:

A.  

Create a Google SecOps dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.

B.  

Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.

C.  

Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.

D.  

Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.

Discussion 0
Questions 18

You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions:

    Send an email to users who do not have a Google Security Operations (SecOps) account to request approval for endpoint containment.

    Automatically continue executing its logic after the user responds.

You plan to implement this process in the playbook by using the Gmail integration. You want to minimize the effort required by the SOC analyst. What should you do?

Options:

A.  

Set the containment action to 'Manual' and assign the action to the user to execute or skip the containment action.

B.  

Set the containment action to 'Manual' and assign the action to the appropriate tier. Contact the user by email to request approval. The analyst chooses to execute or skip the containment action.

C.  

Use the 'Send Email' action to send an email requesting approval to contain the endpoint, and use the 'Wait For Thread Reply' action to receive the result. The analyst manually contains the endpoint.

D.  

Generate an approval link for the containment action and include the placeholder in the body of the 'Send Email' action. Configure additional playbook logic to manage approved or denied containment actions.

Discussion 0