Google GCP-SOE-B Exam Syllabus Topics:

Google Security Operations Engineer (Beta) Sample Questions:

1. You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on- premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

A) Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
B) Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
C) Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
D) Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.

2. You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?

A) not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
B) not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
C) net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
D) net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")

3. Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

A) Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
B) Generate a report in SOAR Reports, and schedule delivery of the report.
C) Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
D) Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.

4. You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?

A) Run a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
B) Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.
C) Perform a UDM search for login events, and pivot to group results by user and country of origin.
D) Perform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.

5. You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

A) Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.
B) Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
C) Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
D) Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.

Solutions: