Google Security Operations Engineer (Beta) Sample Questions:

1. Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

A) Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
B) Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
C) Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
D) Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.

2. You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A) Configure the Windows server to send an email notification if there is an error in the Bindplane process.
B) Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
C) Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
D) Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

3. You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?

A) Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.
B) Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
C) Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
D) Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.

4. Which Google Cloud log source is MOST critical for detecting unauthorized IAM role changes?

A) Cloud Audit Logs - Admin Activity
B) VPC Flow Logs
C) Firewall Rules logs
D) Cloud DNS logs

5. You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?

A) Cloud IDS logs
B) Cloud Audit Logs
C) Security Command Center Premium (SCCP) findings
D) VPC Flow Logs

Solutions: