VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Google Cloud Professional Security Operations Engineer Free Sample Questions

Description

Covers security platform operations and access configuration, ingesting logs and baseline context, threat hunting, detection engineering, and incident response playbooks.

12 free sample questions135 in the full practice test Other version: PSOE(299)

Try simulator

GCP-PSOE Sample Questions

  1. Question 1

    Intermediate

    Platform Operations · Enhancing Detection and Response

    A multinational enterprise is deploying Google Security Operations (SecOps) and needs to ingest logs from various on-premises firewalls and cloud-native services. The security architect needs to visualize the architecture to ensure high availability and secure transport for the on-premises logs.

    Based on the architecture diagram below, which component is missing or misconfigured in the flow for the On-Premises Firewall logs to reach the Google SecOps Ingestion API securely?

    Answer and explanation

    Correct answer: A

    On-premises logs typically require a Google SecOps Forwarder (deployed as a container or binary) to collect syslog or file-based logs, encrypt them, and transmit them securely to the Google SecOps Ingestion API over HTTPS. Direct transmission from legacy firewalls to the API is often not supported or secure without the intermediate forwarder to handle authentication and buffering.

    flowchart LR FW[On-Prem Firewall] -->|Syslog/TCP| FWD[SecOps Forwarder] FWD -->|HTTPS/TLS| API[Google SecOps Ingestion API] Cloud[Google Cloud Logs] -->|Sink| API

  2. Question 2

    Beginner

    Platform Operations · Configuring Access

    You are configuring access control for a team of Tier 1 SOC analysts in Google Security Operations. These analysts require the ability to search logs and view detections but must strictly be prevented from modifying parsers, detection rules, or system configurations. Which Identity and Access Management (IAM) role or permission set approach is most appropriate to enforce the Principle of Least Privilege?

    Answer and explanation

    Correct answer: D

    The 'Chronicle Viewer' role provides read-only access to the Google Security Operations platform. This allows analysts to search UDM data, view detections, and access dashboards without granting permissions to modify configurations, rules, or parsers, aligning perfectly with the Principle of Least Privilege for Tier 1 analysts.

  3. Question 3

    Intermediate

    Platform Operations · Enhancing Detection and Response

    A security engineer is integrating Security Command Center (SCC) Premium with Google Security Operations. The goal is to ensure that high-fidelity threats detected by SCC's Event Threat Detection service are automatically available in SecOps for investigation. Which integration method achieves this with the lowest latency and operational overhead?

    Answer and explanation

    Correct answer: A

    Google Security Operations (SecOps) provides a native, direct integration for Security Command Center (SCC). Enabling this feature in the SecOps settings allows findings to flow directly without the need for intermediate infrastructure like Pub/Sub or Forwarders, reducing latency and operational complexity.

  4. Question 4

    Advanced

    Platform Operations · Configuring Access

    Your organization uses Workforce Identity Federation to allow external analysts to access the Google Security Operations console. An analyst reports they can log in but cannot see the 'SOAR' tab to access playbooks. You have confirmed their identity is correctly federated and mapped. What is the most likely cause of this issue?

    Answer and explanation

    Correct answer: D

    Google Security Operations SOAR maintains its own internal Role-Based Access Control (RBAC) separate from the main Google Cloud IAM roles used for the SIEM/Search interface. Even if a user has IAM access to the platform, they must be explicitly provisioned and assigned a role within the SOAR module settings to access SOAR features like playbooks and cases.

  5. Question 5

    IntermediateMultiple answers

    Platform Operations · Configuring Access

    Which TWO of the following are valid methods to authenticate a Python script running on an on-premises server that needs to query the Google Security Operations Search API? (Select TWO)

    Answer and explanation

    Correct answers: A, D

    For on-premises workloads where Workload Identity Federation is not configured, a Service Account Key (JSON) is a standard method to authenticate to Google Cloud APIs.

    Workload Identity Federation is the recommended best practice for external workloads. It allows the on-prem service to exchange external credentials (like OIDC or SAML) for a Google Cloud access token without managing long-lived service account keys.

  6. Question 6

    Intermediate

    Platform Operations · Enhancing Detection and Response

    An organization is using Cloud IDS (Intrusion Detection System) to monitor traffic in their VPC. They want to correlate Cloud IDS threat alerts with endpoint logs in Google Security Operations. What is the prerequisite step to enable this correlation?

    Answer and explanation

    Correct answer: B

    To correlate data in Google SecOps, disparate log sources must be ingested and normalized into the Unified Data Model (UDM). Once Cloud IDS logs are mapped to UDM fields (e.g., principal.ip or target.ip), they can be joined with endpoint logs sharing those same IPs in detection rules or searches.

Register free for 6 more questions

Or unlock all 135 GCP-PSOE questions with explanations, timed mode and flashcards.

Related practice tests

All Google practice exams