You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?
Answer(s): C
The backdoor is running on TCP port 5555 on the server, meaning the server is the source of the traffic. In Google Security Operations (SecOps), the field principal.port represents the source port of the traffic, while target.port represents the destination. Since you want to identify traffic originating from the compromised server, filtering on principal.port = 5555 is the most effective approach.
You are an incident responder at your organization using Google Security Operations (SecOps) for monitonng and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?
The most effective first step in containment while preserving forensic data is to use the EDR integration to quarantine the compromised asset. Quarantine isolates the server from the network, preventing further malicious activity, but it does not wipe or reboot the system, ensuring that evidence such as persistence mechanisms, unauthorized file changes, and indicators of compromise remain intact for forensic investigation.
Your organization uses Google Security Operations (SecOps). You discover frequent file downloads from a shared workspace within a short time window. You need to configure a rule in Google SecOps that identifies these suspicious events and assigns higher risk scores to repeated anomalies. What should you do?
Answer(s): B
The correct approach is to create a frequency-based YARA-L detection rule in Google SecOps. Frequency- based rules allow you to detect repeated suspicious behavior, such as multiple file downloads within a short time window, and assign higher risk outcome scores accordingly. This ensures anomalies are prioritized based on their frequency and severity, rather than flagging isolated single events.
You are implementing Google Security Operations (SecOps) at your organization. You discover that the current detection rules are too noisy. Due to the high volume of alerts, some true positives might be missed. You want to ingest additional context sources to reduce false positives in your security detections and to improve the overall positive ratio of the alerts. What should you do?
Answer(s): A
Ingesting high-value asset (HVA) data from the CMDB allows Google SecOps to prioritize alerts based on the sensitivity and criticality of the affected systems. This reduces noise by helping analysts focus on detections involving critical assets, improving the signal-to-noise ratio and ensuring true positives on important systems are not missed.
You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes. What should you do?
The safest way to minimize production impact is to develop and refine the rule logic in UDM search first. By running searches and reviewing outputs, you can iteratively tune filters and conditions until the detections are accurate. Once validated, you then copy the tested query into the Rules Editor. This approach ensures accuracy without risking false positives or unnecessary load in production.
Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company A's security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts:do not have access to any case data originating from outside of Company A.are able to re-purpose playbooks previously developed by your organization's employees.You need to minimize effort to implement your solution. What is the first step you should take?
The correct first step is to define a new SOC role for Company A within Google SecOps. By assigning appropriate role-based access controls, you can ensure Company A's analysts only see case data originating from their own telemetry, while still being able to reuse existing playbooks from your organization. This approach minimizes effort compared to acquiring or creating new environments or tenants.
You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group. What should you do?
The correct action is to upload the malware to Google Threat Intelligence using Private Scanning. Private Scanning allows you to analyze malware safely and extract IOCs without sharing the sample publicly. This prevents alerting the threat group while still enabling rapid and detailed intelligence gathering.
Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?
To grant read-only access to all Google SecOps resources, including detection engine rules, you assign the roles/chronicle.Viewer IAM role. The correct method is to create a Google Group, add the required users, and grant this role to the group at the project level tied to your Google SecOps instance. This ensures consistent, least-privilege access management through Cloud Identity.
Share your comments for Google Security-Operations-Engineer exam with other users:
please i need the mo-100 questions
very good use full
very valid questions
will these question help me to clear pl-300 exam?
please provide me with these dumps questions. thanks
in the pdf downloaded is write google cloud database engineer i think that it isnt the correct exam
i think you have the answers wrong regarding question: "what are three core principles of web content accessibility guidelines (wcag)? answer: robust, operable, understandable
these questions are not valid , they dont come for the exam now
question looks valid
good for practice
need more q&a to go ahead
question 59 - a newly-created role is not assigned to any user, nor granted to any other role. answer is b https://docs.snowflake.com/en/user-guide/security-access-control-overview
just passed my exam today. i saw all of these questions in my text today. so i can confirm this is a valid dump.
needed dumps
very helpful
will post once the exam is finished
relevant questions
just clear exam on 10/06/2202 dumps is valid all questions are came same in dumps only 2 new questions total 46 questions 1 case study with 5 question no lab/simulation in my exam please check the answers best of luck
q.112 - correct answer is c - the event registry is a module that provides event definitions. answer a - not correct as it is the definition of event log
good and useful.
good questions
good content
totally not correct answers. 21. you have one gcp account running in your default region and zone and another account running in a non-default region and zone. you want to start a new compute engine instance in these two google cloud platform accounts using the command line interface. what should you do? correct: create two configurations using gcloud config configurations create [name]. run gcloud config configurations activate [name] to switch between accounts when running the commands to start the compute engine instances.
kindly upload the dumps
still learning
excellent way to learn
help so much
understand sql col.
i would give 5 stars to this website as i studied for az-800 exam from here. it has all the relevant material available for preparation. i got 890/1000 on the test.
this is nice.
q55- the ridac workflow can be modified using flow designer, correct answer is d not a
by far this is the most accurate exam dumps i have ever purchased. all questions are in the exam. i saw almost 90% of the questions word by word.
i cleared the az-104 exam by scoring 930/1000 on the exam. it was all possible due to this platform as it provides premium quality service. thank you!
question # 232: accessibility, privacy, and innovation are not data quality dimensions.