VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Professional Security Operations Engineer Free Sample Questions

Description

Covers security platform operations and access management, log ingestion and baseline context, threat hunting, detection engineering, and incident containment and case management.

20 free sample questions299 in the full practice test Other version: GCP-PSOE(135)

Try simulator

PSOE Sample Questions

  1. Question 1

    Intermediate

    Data Management · Ingesting Logs for Security Tooling

    You are a Security Engineer configuring Google Security Operations (SecOps) to ingest logs from an on-premises firewall. You need to ensure that the raw logs are correctly mapped to the Unified Data Model (UDM) for effective searching and detection. You are creating a custom parser. Which specific UDM field should you map the source IP address of the traffic to, assuming the firewall logs represent outbound traffic from your internal network?

    Answer and explanation

    Correct answer: B

    In the Unified Data Model (UDM), 'principal' typically refers to the actor initiating the event. For outbound traffic, the internal source IP initiating the connection is mapped to 'principal.ip'. The destination would be mapped to 'target.ip'.

  2. Question 2

    Advanced

    Platform Operations · Enhancing Detection and Response

    A multinational corporation is implementing Security Command Center (SCC) Premium. They require a centralized view of vulnerabilities across multiple Google Cloud organizations and folders. What is the most effective architectural approach to achieve this centralized visibility while maintaining strict IAM boundaries?

    Answer and explanation

    Correct answer: A

    SCC is activated at the Organization level. To aggregate findings across multiple distinct Organizations, the best practice is to configure Continuous Exports from each SCC instance to a centralized BigQuery dataset. This allows for cross-organization querying and dashboarding without breaking IAM boundaries or requiring complex peering.

  3. Question 3

    Intermediate

    Detection Engineering · Developing and Implementing Detection Mechanisms

    You are writing a YARA-L detection rule to identify potential brute-force attacks. You want to trigger a detection when a user fails to login 10 times within a 5-minute window, followed by a successful login. Which section of the YARA-L rule is responsible for defining the time window logic?

    Answer and explanation

    Correct answer: D

    The 'match' section in YARA-L is used to group events by specific fields (like user ID) and define the time window (e.g., 'over 5m') over which the condition must be met. The 'events' section filters the raw events, and the 'condition' section defines the logic (e.g., count > 10).

  4. Question 4

    Beginner

    Threat Hunting · Leveraging Threat Intelligence for Threat Hunting

    While investigating an incident in Google SecOps, you need to determine if a specific file hash has been seen in your environment over the past 12 months. However, your hot storage retention is only 6 months. Which feature should you use to search older data?

    Answer and explanation

    Correct answer: C

    For long-term retention and analysis beyond the hot storage limits of the SecOps platform interface, data is typically exported to BigQuery. Searching BigQuery allows you to access historical data that exceeds the standard retention period of the interactive search console.

  5. Question 5

    Intermediate

    Incident Response · Building and Using Response Playbooks

    A financial services company processes sensitive transactions. You need to configure a Google SecOps SOAR playbook that requires human approval before isolating a critical payment server during a suspected incident. Which playbook action should you utilize?

    Answer and explanation

    Correct answer: D

    The 'Ask' action (or 'Manual Action' / 'User Choice') in Google SecOps SOAR playbooks pauses the execution flow and sends a notification (e.g., email, slack, SMS) to an analyst or manager. The playbook resumes only after a response is received, enabling human-in-the-loop decision making for critical actions like server isolation.

  6. Question 6

    AdvancedMultiple answers

    Platform Operations · Configuring Access

    Select TWO primary benefits of using Workforce Identity Federation when configuring access to Google Cloud security tools for your operations team.

    Answer and explanation

    Correct answers: A, D

    You can map attributes (claims) from the external IdP token to Google Cloud attributes, enabling precise access control policies based on the user's role or group in the external system.

    Workforce Identity Federation allows you to use an external Identity Provider (IdP) (like Azure AD or Okta) to authenticate users directly without synchronizing user accounts to Google Cloud, simplifying identity management.

  7. Question 7

    Intermediate

    Detection Engineering · Developing and Implementing Detection Mechanisms

    You are investigating a data exfiltration incident. You have identified a suspicious IP address communicating with your Compute Engine instances. You want to visualize the flow of traffic to understand which internal assets communicated with this IP over the last 48 hours. Which Google SecOps feature provides this visualization?

    Answer and explanation

    Correct answer: B

    While Asset/Domain views show lists, the Enterprise Insights (or specialized graph views within the investigation console) and the Entity Graph capabilities allow analysts to visually map relationships and traffic flows between entities (assets) and external indicators (IPs) over time.

  8. Question 8

    Beginner

    Observability · Health Monitoring and Alerting

    True or False: In Google SecOps, the 'silent source detection' feature automatically alerts you when a log source that was previously sending data stops sending data for a specified period.

    Answer and explanation

    Correct answer: A

    True. Silent source detection is a health monitoring feature that monitors data ingestion rates and generates an alert if a specific log stream or forwarder stops sending data or drops below a defined threshold, indicating a potential collection failure.

  9. Question 9

    Advanced

    Observability · Dashboards and Reports for Security Insights

    You are creating a dashboard in Looker Studio to visualize security metrics from Google SecOps. You need to join security alerts with HR data to display alerts by department. The HR data is updated daily and stored in a CSV file in Cloud Storage. What is the most efficient way to achieve this?

    Answer and explanation

    Correct answer: A

    BigQuery can query data directly from Cloud Storage using external tables. By creating a view that joins the live SecOps data (exported to BigQuery) with the HR CSV external table, Looker Studio can query this unified view. This avoids manual imports and ensures data freshness.

  10. Question 10

    Beginner

    Threat Hunting · Leveraging Threat Intelligence for Threat Hunting

    A new zero-day vulnerability has been announced. The CISO asks you to determine if any internal hosts have communicated with a list of 50 known bad IP addresses associated with this threat over the past 30 days. Which Google SecOps feature is designed to perform this retrospective analysis most efficiently?

    Answer and explanation

    Correct answer: A

    Retrohunt (now integrated with Google Threat Intelligence) is specifically designed to take a set of IOCs (like IPs) and scan historical log data to see if those indicators were present in the environment before they were known to be malicious.

Register free for 10 more questions

Or unlock all 299 PSOE questions with explanations, timed mode and flashcards.

Related practice tests

All Google practice exams