Professional Security Operations Engineer Exam Questions and Answers (Page: 2)

QUESTION: 9

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours.
What should you do?

Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

Answer(s): A

Explanation:

The fastest and most effective way to identify unknown C2 nodes within 24 hours is to write a detection rule in Google SecOps that compares historic outbound connections against ingested threat intelligence, then run it as a retrohunt across the full tenant. Retrohunt enables rapid scanning of past telemetry at scale to surface potential matches without waiting for new events to occur.

Reveal Solution Next Question

QUESTION: 10

You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident.
What should you do? (Choose two.)

Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
Review the finding, investigate the pod and related resources, and research the related attack and response methods.
Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.

Answer(s): A,B

Explanation:

The correct response involves both notifying the workload owner and following the response playbook to ensure coordinated incident handling, and reviewing the finding while investigating the pod and related resources to understand the attack and determine the appropriate remediation. This approach ensures proper communication, structured incident response, and thorough technical investigation without prematurely deleting or silencing critical evidence.

Reveal Solution Next Question

QUESTION: 11

You are reviewing the security analyst team's playbook action process. Currently, security analysts navigate to the Playbooks tab in Google Security Operations (SecOps) for each alert and manually run steps assigned to a user. You need to present all actions from alerts awaiting user input in one location for the analyst to execute.
What should you do?

Enable approval links in the manual action and display them as clickable links to the user in a HTML widget in the Default Case View tab.
Add a general insight in your playbook to display manual action details to the user.
Use the Pending Actions widget in the Default Case View in settings.
Create an Alert View with the playbook that incorporates the Pending Actions widget.

Answer(s): C

Explanation:

The correct approach is to use the Pending Actions widget in the Default Case View. This widget consolidates all manual playbook actions that require analyst input, allowing them to be executed from a single location. This streamlines the workflow, reduces manual navigation, and ensures analysts don't miss pending steps across multiple alerts.

Reveal Solution Next Question

QUESTION: 12

You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem.
What should you do?

Modify the default parser and include a default time zone.
Create a parser extension to correct the time zone.
Create a custom parser to correct the time zone.
Modify the UI settings to correct the time zone.

Answer(s): B

Explanation:

The correct fix is to create a parser extension to correct the time zone. Parser extensions let you adjust specific fields, such as timestamps, without modifying the default parser. This resolves ingestion delays caused by time zone mismatches while maintaining the integrity and upgrade compatibility of the default parser.

Reveal Solution Next Question

QUESTION: 13

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach.
What should you do?

Use the UDM lookup feature to identify relevant process-related UDM fields and values.
Run a UDM search, and review aggregations for relevant process-related UDM fields.
Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.

Answer(s): B

Explanation:

The most efficient method is to run a UDM search and use aggregations on process-related UDM fields. This allows you to quickly identify the most common processes and applications across all servers, providing accurate data to establish baselines and exclusion lists without relying only on alerts or dashboards.

Reveal Solution Next Question

QUESTION: 14

You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs.
What should you do?

Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.

Answer(s): A

Explanation:

To detect data exfiltration attempts from sensitive Cloud Storage buckets and BigQuery datasets using ETD, you only need "data read" audit logs. These logs capture access and read events (which indicate potential exfiltration). Enabling them only for the designated sensitive resources minimizes Cloud Logging costs while still providing the necessary visibility for detections.

Reveal Solution Next Question

QUESTION: 15

Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required.
What should you do?

Generate a YARA-L rule in Google SecOps that detects when a service account key is created. Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.
Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.
Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName:
"google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.

Answer(s): B

Explanation:

The most efficient solution is to use the built-in SCC detection "Initial Access: Dormant Service Account Key Created", ingest the finding into Google SecOps, and automate the response with a custom SOAR action that deletes the key. This leverages existing SCC findings for accurate detection, integrates directly with Google SecOps for centralized alerting, and minimizes manual effort by automating remediation.

Reveal Solution Next Question

QUESTION: 16

Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?

Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic. Configure a trigger to send an email alert when new events are sent to this feed.
Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.
Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.

Answer(s): B

Explanation:

The correct approach is to sink logs to BigQuery, where you can perform windowing and advanced aggregations over time. Then, use Cloud Run functions to periodically query BigQuery and generate normalized alerts published to a Pub/Sub topic. From there, alerts can be written back into SCC as findings via the SCC API, giving analysts a central interface for triage. This architecture supports large-scale environments, advanced calculations, and efficient integration with SCC.

Reveal Solution Next Question

Google Professional Security Operations Engineer Exam (page: 2) Google Professional Security Operations Engineer Updated on: 12-Feb-2026

QUESTION: 9

Explanation:

QUESTION: 10

Explanation:

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

QUESTION: 16

Explanation:

Google Professional Security Operations Engineer Exam (page: 2)
Google Professional Security Operations Engineer
Updated on: 12-Feb-2026