Google Cloud Professional Security Operations Engineer - Full Practice Exam 1

1. A broad suppression reduces alert volume but also hides an important attack pattern. Which approach best fits?
2. A case is closed immediately after blocking one malicious address, though the root cause remains unknown. Which approach best fits?
3. A cloud credential is confirmed compromised and remains usable. Which approach best fits?
4. A confirmed compromised workload is actively using an exposed credential. Responders are authorized to contain the incident and need reliable evidence for investigation. Which two actions are appropriate? Select 2 answers.
5. A containment action could interrupt a critical business service. Responders have time to coordinate the approved decision. Which approach best fits?
6. A custom detector should match a supported indicator in eligible cloud activity telemetry. Which approach best fits?
7. A dashboard should help prioritize current investigation work rather than display every raw event equally. Which approach best fits?
8. A detection needs department and asset criticality context that is not present in individual authentication events. Which approach best fits?
9. A detection should identify repeated behavior within a bounded time range rather than across the full retention period. Which approach best fits?
10. A detection stopped firing after a source vendor renamed a field and the parser no longer maps it. Which approach best fits?
11. A hunt begins with a claim that stolen identities may access unusual resources after privileged sign-in. Which approach best fits?
12. A hunt finds a rare process on a high-value server. The team needs to distinguish a newly approved tool from unauthorized execution. Which approach best fits?
13. A hunter needs to reconstruct a suspicious account's actions across authentication, endpoint, and cloud sources. Which approach best fits?
14. A hunt's query is expensive and covers years of data without a justified scope. Which approach best fits?
15. A known indicator appears in a log field that stores quoted email content rather than an actual network connection. Which approach best fits?
16. A log source is accepted by the collector but events arrive hours late and weaken time-sensitive detections. Which approach best fits?
17. A network security requirement calls for supported intrusion-detection inspection rather than only endpoint audit logs. Which approach best fits?
18. A new detection has not been evaluated against historical legitimate activity. Which approach best fits?
19. A new parser change may alter fields used by existing detection rules. Which approach best fits?
20. A newly ingested source appears in raw logs but key user and IP fields are absent from normalized security searches. Which approach best fits?
21. A noisy rule alerts repeatedly on a documented approved scanner, but other scanners should still be detected. Which approach best fits?
22. A possible active compromise emerges during a scheduled hunt. Which approach best fits?
23. A response playbook performs a destructive containment step with high business impact. Which approach best fits?
24. A rule matches unrelated events because it joins only on a common generic process name. Which approach best fits?
25. A rule must correlate a failed-login sequence and a successful login for the same principal within a defined interval. Which approach best fits?
26. A rule should evaluate normalized event fields across supported source types. Which approach best fits?
27. A rule update should remain traceable to the incident or threat hypothesis that justified it. Which approach best fits?
28. A security team needs visibility into supported Google Cloud vulnerabilities and misconfigurations, including prioritized posture findings. Which approach best fits?
29. A SOAR playbook may retry a ticket-creation step after an ambiguous timeout. Which approach best fits?
30. A SOC dashboard shows no detections from a source that stopped sending logs. Analysts assume it is safe. Which approach best fits?
31. A SOC is promoting a new cross-source detection rule. It must avoid misleading correlations and establish meaningful effectiveness. Which two validation activities are appropriate? Select 2 answers.
32. A SOC needs centralized security telemetry, threat detection, investigation, and response workflows rather than only cloud configuration findings. Which approach best fits?
33. A SOC needs evidence that a critical rule continues to work after ingestion and parser changes. Which approach best fits?
34. A SOC wants to identify low-prevalence domains that do not appear in any existing threat feed. Which approach best fits?
35. A source parser assigns a destination address to the principal field, causing misleading entity correlations. Which approach best fits?
36. A stakeholder needs incident updates but should not receive unrestricted sensitive forensic data. Which approach best fits?
37. A suspicious binary needs enrichment without executing it on an analyst's production workstation. Which approach best fits?
38. A suspicious process hash is not in current threat-intelligence feeds, but its execution behavior is unusual. Which approach best fits?
39. A threat report describes a new attack technique without a reliable static hash or domain list. Which approach best fits?
40. A weekly report claims improving security because raw alert volume fell sharply after telemetry loss. Which approach best fits?
41. An analyst hands off an incident to another team but omits affected entities, evidence, and actions already taken. Which approach best fits?
42. An audit needs to determine who changed a security-platform configuration. Which approach best fits?
43. An automation needs read access to selected security findings without a human's shared credentials. Which approach best fits?
44. An endpoint is actively exfiltrating data. Responders have authority to contain it while preserving evidence where feasible. Which approach best fits?
45. An enrichment service is temporarily unavailable, but the rest of the incident workflow can proceed safely. Which approach best fits?
46. An entity's risk score rises sharply. Analysts need to understand which events drove the change. Which approach best fits?
47. An ingestion-cost dashboard lacks source ownership, making remediation difficult. Which approach best fits?
48. An ingestion pipeline drops malformed records without any counters or review destination. Which approach best fits?
49. Analysts need enriched information about suspicious indicators from Google's supported threat-intelligence offering. Which approach best fits?
50. External workforce analysts should authenticate through an approved organizational identity provider. Which approach best fits?
51. Forensic artifacts must remain reliable for a later authorized investigation. Which approach best fits?
52. Historical hunting returns no matches, but the relevant telemetry source was not collected during the suspected period. Which approach best fits?
53. Junior analysts need case investigation access but must not modify organization-wide security integrations. Which approach best fits?
54. Leadership needs to compare response performance over time using consistent definitions. Which approach best fits?
55. One user logs in from a new location, but legitimate travel is possible. Which approach best fits?
56. Security needs a finding when a supported cloud resource becomes publicly exposed contrary to posture policy. Which approach best fits?
57. The same host appears under several identifiers, preventing useful cross-source correlation. Which approach best fits?
58. The SOC must prioritize limited ingestion capacity toward logs needed for its most important detection use cases. Which approach best fits?
59. The team needs to determine when an investigation should escalate to the incident commander. Which approach best fits?
60. Threat intelligence identifies a newly malicious domain. Analysts need to know whether internal systems contacted it in retained historical telemetry. Which approach best fits?

Comments — 0