Security-Operations-Engineer無料問題集「Google Cloud Certified - Professional Security Operations Engineer (PSOE)」

質問 1

You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?

（A）Configure each network in the Google SecOps SOAR settings.

（B）Create an outcome variable in the rule to assign the network name.

（C）Enrich the IP address entities as the initial step of the playbook.

（D）Modify the entity attribute in the alert overview.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

Your organization recently conducted a penetration test on their environment. You have been tasked with identifying a successful attack chain. The required log sources have been ingested into Google Security Operations (SecOps). You discover anomalous outbound traffic to external domains. You suspect that the finding is a communication to a command and control (C2) infrastructure. You need to identify the least common network communications over the last 14 days. What should you do?

（A）Perform a Google SecOps SOAR search that looks for cases with low rolling prevalence of NETWORK_CONNECTION or NETWORK_HTTP events over the last 14 days.

（B）Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for principal domains over the last 14 days.

（C）Perform a Google SecOps SIEM raw log search that looks for low rolling prevalence domains with NETWORK_CONNECTION or NETWORK_HTTP in the firewall and proxy logs over the last 14 days.

（D）Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for target domains over the last 14 days.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

（A）Add an action to the playbook that runs the SIEM query and returns the results.

（B）Modify the detection rule in the SIEM to include the query results as part of the detection.

（C）Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.

（D）Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

（A）Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.

（B）Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.

（C）Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.

（D）Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

You are configuring role-based data access controls for two groups of users in Google Security Operations (SecOps). Group A requires access to all data, and Group B requires access to all data except data from the "restricted" namespace. You need to configure access for these two groups. What should you do? (Choose two.)

（A）Create a new data access scope to allow access to the "restricted" namespace data for Group A.
Assign this data scope to Group A in IAM.

（B）Create a new data access scope in the Google SecOps SIEM settings to allow access to all data for Group A. Assign this data access scope to Group A in IAM.

（C）Create a custom label with a UDM query to include all labels for Group A. Assign this data label to Group A in IAM.

（D）Create a custom label with a UDM query to include all data except the "restricted" namespace data for Group B. Assign this data label to Group B in IAM.

（E）Create a new data access scope in the Google SecOps SIEM settings to allow access to all data and exclude the "restrict" namespace data for Group B. Assign this data access scope to Group B in IAM.

正解：B、E 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

Your organization is conducting a penetration test. The CISO has asked you to implement a real- time method to track cases that originate from the penetration test, and clearly differentiate these cases from other security incidents. You need to recommend the most effective and efficient approach to achieve this goal in Google Security Operations (SecOps). What should you do?

（A）Create a dashboard that is connected to the Google SecOps data lake. Use pre-built templates to visualize case status based on the penetration testing IP address range.

（B）Create a custom Google SecOps SOAR playbook that automatically extracts case metadata, including key findings and risk scores, and sends an email summary to the CISO.

（C）Configure a custom alert rule that triggers a high-severity alert for all activity originating from the penetration testing team's source IP addresses and sends a notification for potential critical vulnerabilities. Verify that these alerts are immediately visible in the alert queue.

（D）Implement case tagging within Google SecOps and apply a unique tag (e.g., PenTest) to all cases related to the penetration test entities. Use this tag for filtering and monitoring.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?

（A）Add an exception in the detection rule to exclude matches originating from specific asset groups.

（B）Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.

（C）Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.

（D）Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

You observe several distinct, low-severity suspicious activities associated with a single internal server. You determine that no single event is a high-confidence IOC. You need to create a solution that ensures ongoing and heightened scrutiny for this server. What should you do?

（A）Develop a YARA-L detection rule specific to this server.

（B）Add the server to a Google Security Operations (SecOps) watchlist, and monitor the watchlist closely for the next few weeks.

（C）Schedule a daily Google Security Operations (SecOps) report detailing all activity on this server.

（D）Create a case, isolate the server from the network, and escalate the case for forensic investigation.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

Security-Operations-Engineer 無料問題集「Google Cloud Certified - Professional Security Operations Engineer (PSOE)」

弊社を連絡する

関連リンク

トップ試験