Free Professional-Security-Operations-Engineer Exam Questions and Answers

Last updated: September 19, 2026

Provider

Google

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Practice format

Multiple choice

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IoCs that you suspect were generated due to the exercise. What should you do?

   • A. Ask Gemini to provide a list of IoCs from the red team exercise.
   • B. Filter IoCs with an ingestion time that matches the time period of the red team exercise.
   • C. Navigate to the IOC Matches page. Identify and mute the IoCs from the red team exercise.
   • D. Navigate to the IOC Matches page. Review IoCs with an Indicator Confidence Score (IC-Score) label >= 80%.
   Reveal Answer

2. Question #2

   You manage a large fleet of Compute Engine instances. Security Command Center (SCC) has generated a large number of CONFIDENTIAL_COMPUTING_DISABLED findings. You need to quickly tune these findings. What should you do?

   • A. Manually mark the findings as inactive.
   • B. Disable Event Threat Detection (ETD)
   • C. Create a mute rule for the finding.
   • D. Disable the Security Health Analytics detector (SHA).
   Reveal Answer

3. Question #3

   You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

   • A. Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
   • B. Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
   • C. Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
   • D. Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
   Reveal Answer

4. Question #4

   You are a platform engineer at an organization that is migrating from a third-party SIEM product to Google Security Operations (SecOps). You previously manually exported context data from Active Directory (AD) and imported the data into your previous SIEM as a watchlist when there were changes in AD's user/asset context data. You want to improve this process using Google SecOps. What should you do?

   • A. Ingest AD organizational context data as user/asset context to enrich user/asset information in your security events.
   • B. Configure a Google SecOps SOAR integration for AD to enrich user/asset information in your security alerts.
   • C. Create a data table that contains AD context data. Use the data table in your YARA-L rule to find user/asset data that can be correlated within each security event.
   • D. Create a data table that contains the AD context data. Use the data table in your YARA- L rule to find user/asset information for each security event.
   Reveal Answer

5. Question #5

   You need to augment your organization's existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IoCs and would like to include external signals for this capability to ensure broad detection coverage. What should you do?

   • A. Create a custom posture for your organization that combines the prebuilt Event Threat Detection and Security Health Analytics (SHA) detectors.
   • B. Create a Security Health Analytics (SHA) custom module using the compute address resource.
   • C. Create an Event Threat Detection custom module using the "Configurable Bad IP"template.
   • D. Create a custom log sink with internal and external IP addresses from threat intelligence. Use the SCC API to generate a finding for each event.
   Reveal Answer

6. Question #6

   You have a custom-built YARA-L rule in Google Security Operations (SecOps) correlating observed IP addresses in network and EDR logs against threat intelligence findings ingested from a Malware Information Sharing Platform (MISP) over a 2-minute time window. Your company's SOC reported that the rule generates too many false positives. You want to reduce the number of false positives generated by the rule while continuing to use threat intelligence. What should you do?

   • A. Convert the rule to a dashboard, and use a match window of 24 hours to visualize entities in a bar chart.
   • B. Modify the rule to alert only when the graph.metadata.threat.severity value is critical or high.
   • C. Modify the rule to trigger only when the ICCs graph.risk_score.risk_score field exceeds 500.
   • D. Adjust the match window in the rule to 24 hours to aggregate IP addresses by asset once a day.
   Reveal Answer

7. Question #7

   Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process within SCCE and integrate with the existing SOC ticketing system. You want to use the most efficient solution. How should you implement this functionality?

   • A. Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.
   • B. Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.
   • C. Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your GoogleSecOps SOAR playbook to generate a ticket based on the event type.
   • D. Configure the SCC notifications feed to send alerts to a Cloud Storage bucket. Create a Dataflow job to read the new files, extract the relevant information, and send the information to the SOC ticketing system.
   Reveal Answer

8. Question #8

   You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?

   • A. Create a Google SecOps dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.
   • B. Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.
   • C. Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.
   • D. Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.
   Reveal Answer

9. Question #9

   You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

   • A. Use Gemini to generate a playbook based on a template from a standard incident response plan, and implement automated scripts to filter network traffic based on known malicious IP addresses.
   • B. Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be complete
   • C. Have a senior analyst build out the playbook to include those new procedures.
   • D. Use the playbook creation feature in Gemini, and enter details about the intended objective
   • E. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.
   • F. Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
   Reveal Answer

10. Question #10

    You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

    • A. Configure the Windows server to send an email notification if there is an error in the Bindplane process.
    • B. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.
    • C. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
    • D. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
    Reveal Answer