Free Professional-Security-Operations-Engineer Exam Questions and Answers

Your SOC director asks for a weekly view that shows two things: the mean time to close cases by priority and by analyst, and the volume of alerts by log source. Your organization uses Google Security Operations (SecOps) SIEM and SOAR. Analysts record case closure in SOAR. You want to build the view with the least custom data engineering. What should you do?

• AA. Build a SIEM dashboard with UDM search charts that derive case closure time from the timestamps of rule detections, and add charts for alert volume.
• BB. Create SOAR reports for case closure time by priority and analyst, and add a SIEM dashboard chart for alert volume by log source.
• CC. Export case data to BigQuery on a schedule and build charts for both metrics in a Looker Studio dashboard.
• DD. Build a single SIEM dashboard whose charts query UDM events for both case closure time and alert volume by log source.

You deploy the following YARA-L 2.0 rule in Google Security Operations (SecOps) to detect password guessing. The rule generates a detection for every blocked login, but you want a detection only when a single source IP address has 10 or more blocked logins within 5 minutes. rule failed_login_burst { meta: author = "secops" events: $e.metadata.event_type = "USER_LOGIN" $e.security_result.action = "BLOCK" $e.principal.ip = $ip match: $ip over 5m condition: $e } What should you do?

• AA. Add an outcome section that sets $failures = count($e).
• BB. Change the match section to $ip over 10m.
• CC. Move the $e.principal.ip = $ip line from the events section to the condition section.
• DD. Change the condition section to #e >= 10.

A reporting application outside Google Cloud must call the Google Security Operations (SecOps) API every hour to read detections and rule metadata. No person will be signed in when it runs, and the application must not be able to change rules or settings. What should you do?

• AA. Create a service account, and grant it the Chronicle API Admin role in the project that is bound to the instance.
• BB. Create a service account, and grant it the basic Viewer role on the organization.
• CC. Create a service account, and grant it the Chronicle API Viewer role in the project that is bound to the instance.
• DD. Use the credentials of a SOC analyst with the Chronicle API Editor role, and store them in the application.

You need to be notified by email when the volume of logs ingested into Google Security Operations (SecOps) for a specific log type drops below an expected level. Which approach should you use?

• AA. Create a YARA-L rule that matches events for the log type and send its detections to the SOC mailbox when a match occurs.
• BB. Create a log-based metric in Cloud Logging on Cloud Audit Logs entries for the Google SecOps API and alert on it.
• CC. Create a Cloud Monitoring alerting policy on the Google SecOps ingestion metrics with an email notification channel.
• DD. Configure a Security Command Center notification config that publishes ingestion findings to a Pub/Sub topic for email delivery.

Your organization has two business units, Retail and Payments, that send logs to the same Google Security Operations (SecOps) instance. Analysts in the Retail SOC group must be able to search only Retail log data. You manage access through Cloud IAM. What should you do? (Choose two.)

Select 2 answers.

• AA. Grant the Retail analyst group the Chronicle API Restricted Data Access role with an IAM condition that references the Retail scope.
• BB. Create a separate Google SecOps instance for each business unit and forward the Retail logs to only the first instance.
• CC. Create a data access scope that allows only Retail data by using the labels applied to Retail logs at ingestion.
• DD. Grant the Retail analyst group the Chronicle API Viewer role at the project level, and use saved searches to exclude Payments data.
• EE. Add the Payments log sources to a VPC Service Controls perimeter that does not include the Retail analyst group.

Your SOC manager wants every analyst to record why a case was closed, such as a false positive from a misconfigured scanner or a confirmed phishing campaign. The manager also wants to report on case volume by that reason. You use Google Security Operations (SecOps) SOAR. What should you do?

• AA. Create a custom case stage for each reason and move cases to the matching stage before closing them.
• BB. Create a case tag for each reason and ask analysts to add one tag to each case before closing it.
• CC. Add a required comment template to the case wall and search the comments when the manager needs reports.
• DD. Define a list of root causes in the SOAR case closure settings so analysts select one when they close a case.

Your organization ingests Okta user context into Google Security Operations (SecOps) as entity data. In these entity records, the userid field contains the sAMAccountName and the employee_id field contains a numeric HR identifier. Windows authentication events populate principal.user.userid with the sAMAccountName and carry no employee ID or email address. A multi-event YARA-L rule joins the events to the context with the condition $e.principal.user.userid = $ctx.graph.entity.user.employee_id. The rule never matches, although both data sources are ingesting correctly. What should you do?

• AA. Change the entity metadata type of the Okta records from USER to ASSET.
• BB. Extend the match window of the rule from 1 hour to 48 hours.
• CC. Join the events to the context by using $ctx.graph.entity.user.userid.
• DD. Join the events to the context by using $ctx.graph.entity.user.email_addresses.

Your organization uses Microsoft Entra ID as its identity provider. Detection engineers want rules and investigations in Google Security Operations (SecOps) to use user attributes such as job title, department, and manager. Sign-in events from Entra ID are already ingested. What should you do?

• AA. Ingest the Entra ID audit log type so that user attributes appear in the audit events.
• BB. Upload a CSV file of user attributes to a reference list and update it each week.
• CC. Create a feed that ingests the Microsoft Entra ID context log type to populate entity context.
• DD. Create a SOAR connector that queries Entra ID for user attributes each time a case is created.

During a proactive hunt, you run a statistical UDM search on outbound proxy logs from the last 24 hours. The results show the following: Domain Hosts Events Median interval Domain first seen repo.pkg-mirror.example 1,860 212,400 irregular 4 years ago sync-telemetry.example 1 1,440 60 seconds 2 days ago mail.relay-corp.example 14 9,800 irregular 6 years ago assets.cdn-fonts.example 2,310 640,000 irregular 9 years ago You have time to investigate only one domain first. Which domain should you investigate first?

• AA. sync-telemetry.example
• BB. assets.cdn-fonts.example
• CC. mail.relay-corp.example
• DD. repo.pkg-mirror.example

Your SOC uses Google Security Operations (SecOps) and wants to use a curated detection category for cloud threats. The SOC wants high-fidelity detections to generate alerts for analysts. It also wants broader, lower-fidelity detections to be available for hunting without creating alerts. What should you do?

• AA. Enable the Precise rule set with alerting on, and enable the Broad rule set with alerting off.
• BB. Enable the Broad rule set with alerting on, and leave the Precise rule set disabled.
• CC. Enable both the Precise and Broad rule sets with alerting on, and tune alert volume in SOAR.
• DD. Enable the Precise rule set with alerting on, and leave the Broad rule set disabled.