Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Google
Exam Format
120 min
50-60
Not publicly disclosed
Professional
Registration
$200 USD
Kryterion or online proctoring
Validity
2 years
Pass the current version of the Professional Security Operations Engineer exam during the renewal eligibility period
PSOE Exam Topics and Domains
PSOE is organized into 6 weighted domains. Expect to work with Google SecOps, SCC, GTI, Cloud Logging, and more.
1
Platform Operations
14%
Enhancing Detection and Response
Prioritizing Telemetry SourcesIntegrating Multiple Security Tools
- Prioritize telemetry sources to detect incidents or misconfigurations within an enterprise environment
- Integrate multiple tools in the security architecture to enhance detection capabilities
- Justify the use of tools with overlapping capabilities based on a set of requirements
- Evaluate the effectiveness of existing tools to identify gaps in coverage and mitigate potential threats
- Evaluate automation and cloud-based tools to enhance existing detection and response processes
Configuring Access
Authentication ConfigurationAuthorization and Access ControlAudit Log Configuration
- Configure user and service account authentication to security tools
- Configure user and service account authorization for feature access using IAM roles and permissions
- Configure user and service account authorization for data access using IAM roles and permissions
- Configure and analyze audit logs for the solution
- Configure API access for automations within security tools
- Provision identities using Workforce Identity Federation
2
Data Management
14%
Ingesting Logs for Security Tooling
Data Ingestion ApproachesParser Configuration and Data NormalizationLog Cost Management
- Determine approaches for data ingestion within security tools
- Configure an ingestion tool or features within security tools
- Assess required logs for detection and response, including automated sources
- Evaluate parsers for data ingestion in Google SecOps
- Configure parser modifications or extensions in Google SecOps
- Evaluate data normalization techniques from log sources
- Evaluate new labels for data ingestion
- Manage log and ingestion costs
Identifying a Baseline of User, Asset, and Entity Context
Threat Intelligence IntegrationEvent and Entity Data Management
- Identify relevant threat intelligence information in the enterprise environment
- Differentiate event and entity data log sources
- Evaluate event and entity data matches for enrichment by using aliasing fields
3
Threat Hunting
19%
Performing Threat Hunting Across Environments
Query Development for Anomaly DetectionThreat Pattern and IOC Identification
- Develop queries to search across environment logs to identify anomalous activity
- Analyze user behavior to identify anomalous activity
- Investigate the network, endpoints, and services to identify threat patterns or indicators of compromise (IOCs) using Google Cloud tools
- Collaborate with the incident response team to identify active threats in the environment
- Develop hypotheses based on behavior, threat intel, posture, and incident data
Leveraging Threat Intelligence for Threat Hunting
Historical and Real-Time Threat Analysis
- Search for IOCs within historical logs
- Identify new attack patterns and techniques in real time using threat intelligence and risk assessments
- Analyze entity risk score to identify anomalous behavior
- Compare and perform retrohunt of historical event data with newly enriched logs
- Search proactively for underlying threats using threat intelligence
4
Detection Engineering
22%
Developing and Implementing Mechanisms to Detect Risks and Identify Threats
Log and Event Analysis for AnomaliesRisk-Based Detection RulesAdvanced Detection Techniques
- Reconcile threat intelligence with user and asset activity
- Analyze logs and events to identify anomalous activity
- Assess suspicious behavior patterns by using detection rules and searches across various timelines
- Design detection rules that use risk values to identify threats matching risk profiles
- Discover anomalous behavior of assets or users, and assign risk values to the detections
- Design detection rules to discover posture or risk profile changes within the environment
- Identify new or low prevalence processes, domains, and IP addresses that do not appear in threat intelligence sources using various methods
- Assess how to use entity/context data within detection rules to improve their accuracy
- Configure SCC Event Threat Detection custom detectors for IOCs
Leveraging Threat Intelligence for Detection
IOC-Based Detection and Alert Management
- Score alerts based on the risk level of IOCs
- Use latest IOCs to search within ingested security telemetry
- Measure the frequency of repetitive alerts to identify and reduce false positives
5
Incident Response
21%
Containing and Investigating Security Incidents
Evidence Collection and ForensicsIncident Scope and ContainmentForensic Analysis and Root Cause
- Collect evidence on the scope of the incident, including forensic images and artifacts
- Observe and analyze alerts related to the incident using security tooling
- Analyze the scope of the incident using security tooling
- Collaborate with other engineering teams for detection and long-term remediation efforts
- Isolate affected services and processes to prevent further damage and spread of attack
- Analyze identified artifacts based on forensic analysis
- Perform root cause analysis using security tools
Building, Implementing, and Using Response Playbooks
Playbook Design and AutomationContinuous Playbook Improvement
- Determine the appropriate response steps for automation
- Prioritize high-value enrichments based on threat profiles
- Evaluate appropriate integrations to be leveraged by playbooks
- Design new processes in response to newly identified attack patterns from recent incidents
- Recommend new orchestrations and automation playbooks based on gaps in the current implementation
- Implement mechanisms to notify analysts and stakeholders of incidents
Implementing the Case Management Lifecycle
Case Management Workflow
- Assign cases into appropriate response stages
- Implement efficient workflows for case escalation
- Assess the effectiveness of case handoffs
6
Observability
10%
Developing and Maintaining Dashboards and Reports to Provide Insights
Security Analytics and Visualization
- Identify key security analytics (metrics, KPIs, trends)
- Implement dashboards to visualize security telemetry, ingestion metrics, detections, alerts, and IOCs
- Generate and customize reports
Configuring Health Monitoring and Alerting
Health Monitoring and Alert Configuration
- Identify important metrics for health monitoring and alerts
- Create dashboards that centralize metrics
- Create alerts with thresholds for specific metrics
- Configure notifications using Google Cloud tools
- Identify health issues using Google Cloud tools
- Configure silent source detection
How do I earn this certification?
Passing PSOE earns the Google Cloud Certified - Professional Security Operations Engineer certification. It sits in the Security track.
Current Level Exams
Next Level Options
N/A - No higher level - Professional is top tier for this track
Alternative Paths
- Professional Cloud Security Engineer - Professional Cloud Security EngineerComplementary focus on designing and implementing security solutions on Google Cloud
- Professional Cloud Architect - Professional Cloud ArchitectBroader cloud architecture skills with security design considerations
- Professional Cloud DevOps Engineer - Professional Cloud DevOps EngineerDevSecOps practices and security automation integration
- Professional Data Engineer - Professional Data EngineerSkills in analyzing security logs and telemetry data at scale
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for PSOE is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2025-09-08
- Announcement date: 2025-09-08
Updates
- Google Security Operations (SecOps) Latest Core platform for SIEM and SOAR capabilities tested throughout exam • Release date: 2025-09-08
- Security Command Center (SCC) Latest Event Threat Detection and Security Health Analytics are key exam topics • Release date: Ongoing updates
- Google Threat Intelligence (GTI) Latest Critical for threat hunting and detection engineering domains • Release date: Ongoing updates
- YARA-L 2.0 2.0 Essential language for detection rule development, heavily tested in Detection Engineering domain • Release date: 2024-2025
Who should take this exam?
- 3+ years of security industry experience
- 1+ years of hands-on experience with Google Cloud security tooling
- Experience with SIEM and SOAR platforms
- Understanding of security operations center (SOC) workflows
- Familiarity with threat hunting and incident response
- Knowledge of YARA-L detection language