구매 전에 Security-Operations-Engineer 샘플 문제를 무료로 확인해 보실 수 있습니다. ExamPassdump이 제공하는 Google Cloud Certified - Professional Security Operations Engineer (PSOE) 데모로 문제 품질과 구성을 직접 살펴보신 후 결정하시기 바랍니다.

Google Security-Operations-Engineer 시험 개요:

Google Security-Operations-Engineer 시험 요강 주제:

Google Security-Operations-Engineer 시험에 대한 질문과 답변 모음

최신 Google Cloud Certified Security-Operations-Engineer 무료샘플문제

문제 #1

You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?

A. Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.
B. Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time.
C. Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious.
D. Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data.

문제 #2

You are using a Google-managed image on a Compute Engine instance in Google Cloud to run an application. You need to ingest the application's log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time required to move this data into Google SecOps. What should you do?

A. Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.
B. Use the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging.
Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.
C. Use the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.
D. Create a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.

문제 #3

You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?

A. Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.
B. Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.
C. Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.
D. Create a Google SecOps SOAR dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.

문제 #4

You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes. What should you do?

A. Develop the rule in the Rules Editor, define the sections the rule logic, and test the rule using the test rule feature.
B. Use Gemini in Google SecOps to develop the rule by providing a description of the parameters and conditions, and transfer the rule into the Rules Editor.
C. Develop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.
D. Develop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by setting it to live but not alerting. Run a YARA-L retrohunt from the rules dashboard.

문제 #5

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on-premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

A. Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
B. Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
C. Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
D. Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.

질문과 대답: