Prepare with latest Google GCP-SOE-B Pass-King Actual Torrent

Google GCP-SOE-B Exam Syllabus Topics:

Google Security Operations Engineer (Beta) Sample Questions:

1. During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

A) Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
B) Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
C) Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
D) Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.

2. You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?

A) net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
B) net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
C) not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
D) not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")

3. You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

A) Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
B) Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
C) Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
D) Review the finding, investigate the pod and related resources, and research the related attack and response methods.
E) Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.

4. You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?

A) Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time.
B) Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data.
C) Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.
D) Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious.

5. Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

A) Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
B) Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
C) Generate a report in SOAR Reports, and schedule delivery of the report.
D) Build an Advanced Report in SOAR Reports, and schedule delivery of the report.

Solutions: