Professional Security Operations Engineer Exam Questions and Answers (Page: 3)

QUESTION: 17

Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag.
What should you do?

Ask Cloud Customer Care to add a custom filter to the dashboard.
Add a custom filter to the dashboard.
Copy an existing dashboard and add a custom filter.
Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps.

Answer(s): B

Explanation:

In Google SecOps, you can add a custom filter directly to the SIEM dashboard to dynamically monitor assets based on a specific asset tag. This approach is straightforward, requires no external intervention, and ensures that the dashboard updates automatically as assets with the tag change over time.

Reveal Solution Next Question

QUESTION: 18

A business unit in your organization plans to use Vertex AI to develop models within Google Cloud. The security team needs to implement detective and preventative guardrails to ensure that the environment meets internal security control requirements. How should you secure this environment?

Implement Assured Workloads by creating a folder for the business unit and assigning the relevant control package.
Implement preconfigured and custom organization policies to meet the control requirements. Apply these policies to the business unit folder.
Create a policy bundle representing the control requirements using Rego. Implement these policies using Workload Manager. Scope this scan to the business unit folder.
Create a posture consisting of predefined and custom organization policies and predefined and Security Health Analytics (SHA) custom modules. Scope this posture to the business unit folder.

Answer(s): D

Explanation:

The correct approach is to create a posture in SCC that combines predefined and custom organization policies with predefined and custom Security Health Analytics (SHA) modules, and then scope it to the business unit folder. This ensures both preventative guardrails (organization policies) and detective guardrails (SHA findings) are enforced for the Vertex AI environment, aligning with internal security control requirements.

Reveal Solution Next Question

QUESTION: 19

You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes.
What should you do?

Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.
Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.
Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.

Answer(s): A

Explanation:

The best solution is to create a Cloud Monitoring notification with a metric-absence condition for each collector_id. A metric-absence alert triggers when expected ingestion metrics are missing within a defined period (e.g., five minutes), which quickly identifies silent sources or failed collectors. This provides near real- time detection of ingestion health issues in the SecOps pipeline.

Reveal Solution Next Question

QUESTION: 20

A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts. The rule was designed to detect suspicious Cloud Storage enumeration by triggering an alert whenever the storage.objects.list API operation is called using the api.operation UDM field. However, a legitimate backup automation tool that uses the same API, causing the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while still detecting potentially malicious usage. How should you modify the rule to improve its accuracy?

Add principal.user.email != "backup-bot@foobaa.com" to the rule condition to exclude the automation account.
Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
Adjust the rule severity to LOW to deprioritize alerts from automation tools.

Answer(s): A

Explanation:

The most accurate way to reduce false positives is to exclude the known trusted backup automation account by adding a condition such as principal.user.email != "backup-bot@foobaa.com". This keeps the rule active for all other accounts, ensuring you still detect suspicious or malicious Cloud Storage enumeration while preventing unnecessary alerts from legitimate automation.

Reveal Solution Next Question

QUESTION: 21

Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts. Specifically, you need to detect when a user account downloads an unusually large volume of data compared to the user's established baseline activity. You want to detect this anomalous data access behavior using the least amount of effort.
What should you do?

Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.
Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.
Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.
Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.

Answer(s): D

Explanation:

The most effective and least effort solution is to enable curated UEBA (User and Endpoint Behavioral Analytics) detection rules in Google SecOps and use the Risk Analytics dashboard. UEBA automatically establishes user baselines and detects anomalies such as unusually large data downloads, removing the need to manually define thresholds or build custom rules.

Reveal Solution Next Question

QUESTION: 22

Your organization uses Security Command Center (SCC) and relies on Compute Engine instances to run business-critical workloads. SCC has flagged a particular instance for exhibiting a high volume of outbound network connections to geographically diverse and unknown IP addresses. You need to determine whether the instance has been compromised by malware.
What should you do?

Examine the IAM roles assigned to the service account that are associated with the instance. Revoke any permissions that could have facilitated malware installation.
Review the Google Cloud Service Health dashboard to identify any ongoing Google Cloud platform incidents that could be causing unusual network traffic from the instance.
Disable and re-enable the instances' network interface and determine whether the unusual network behavior is resolved.
Analyze Event Threat Detection findings. Review the events and the outbound network connections associated with the instance.

Answer(s): D

Explanation:

The correct action is to analyze Event Threat Detection (ETD) findings in SCC, which provide detailed insights into suspicious activities such as unusual outbound network connections. Reviewing these findings allows you to correlate the flagged activity with the instance's outbound traffic patterns, helping determine whether the instance is compromised by malware.

Reveal Solution Next Question

QUESTION: 23

Your company wants to enhance its detection capabilities to prevent insider threat incidents. You need to be alerted when a privileged Google Group is modified to allow access to the general public. You need to identify and enable the optimal log source, and configure the alert.
What should you do?

Enable Google Drive log events. Create a reporting rule that triggers when a file sharing event occurs with the visibility set to anyone with the link.
Enable VPC Flow Logs for the default VPC network. Configure a log-based alert in Cloud Logging to detect anomalous traffic patterns associated with Google Groups API endpoints.
Enable IAM Admin Activity audit logs, and export the logs to Google Security Operations (SecOps). Write a YARA-L rule in Google SecOps to capture any changes to relevant IAM policies.
Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.

Answer(s): D

Explanation:

To detect insider threats involving Google Group privilege modifications, you need Google Workspace Admin Audit logs, which capture group membership and sharing changes. By enabling data sharing of these logs with SCC and ensuring Event Threat Detection (ETD) is enabled, SCC will automatically generate findings for risky modifications, such as making a privileged group publicly accessible. This provides the optimal log source and automated alerting with minimal effort.

Reveal Solution Next Question

QUESTION: 24

You are using Google Security Operations (SecOps) to investigate suspicious activity linked to a specific user. You want to identify all assets the user has interacted with over the past seven days to assess potential impact. Your need to understand the user's relationships to endpoints, service accounts, and cloud resources. How should you identify user-to-asset relationships in Google SecOps?

Use the Raw Log Scan view to group events by asset ID.
Query for hostnames in UDM Search and filter the results by user.
Generate an ingestion report to identify sources where the user appeared in the last seven days.
Run a retrohunt to find rule matches triggered by the user.

Answer(s): B

Explanation:

The correct approach is to query UDM Search for hostnames (or other asset identifiers) and filter results by the specific user. UDM normalizes logs into a common schema, allowing you to trace the user's interactions across endpoints, service accounts, and cloud resources within the seven-day window. This provides a comprehensive view of user-to-asset relationships for impact assessment.

Reveal Solution Next Question

Google Professional Security Operations Engineer Exam (page: 3) Google Professional Security Operations Engineer Updated on: 12-Feb-2026

QUESTION: 17

Explanation:

QUESTION: 18

Explanation:

QUESTION: 19

Explanation:

QUESTION: 20

Explanation:

QUESTION: 21

Explanation:

QUESTION: 22

Explanation:

QUESTION: 23

Explanation:

QUESTION: 24

Explanation:

Google Professional Security Operations Engineer Exam (page: 3)
Google Professional Security Operations Engineer
Updated on: 12-Feb-2026