今すぐSecurity-Operations-Engineer問題を使おうSecurity-Operations-Engineer問題集PDF [Q36-Q54]

5/5 - (1 vote)

今すぐSecurity-Operations-Engineer問題を使おうSecurity-Operations-Engineer問題集PDF

問題集練習試験問題学習ガイドはSecurity-Operations-Engineer試験合格させます

新問題 36
You are investigating whether an advanced persistent threat (APT) actor has operated in your organization’s environment undetected. You have received threat intelligence that includes:
* A SHA256 hash for a malicious DLL
* A known command and control (C2) domain
* A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon.
However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.

Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.

Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

Build a data table that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.

新問題 37
An organization detects a successful login to a Google Cloud IAM user from an unfamiliar country, followed by the creation of multiple new service account keys within minutes. No malware alerts are triggered. What is the MOST appropriate immediate action?

Rotate only the affected user’s password

Disable the service accounts and continue monitorin

Revoke active credentials, disable the compromised identity, and initiate an incident response

Wait for evidence of data access

新問題 38
You are implementing Google Security Operations (SecOps) for your organization. Your organization has their own threat intelligence feed that has been ingested to Google SecOps by using a native integration with a Malware Information Sharing Platform (MISP). You are working on the following detection rule to leverage the command and control (C2) indicators that were ingested into the entity graph.

What code should you add in the detection rule to filter for the domain IOCS?

$ioc.graph.metadata.entity_type = MDOMAlN_NAME”
$ioc.graph.metadata.scurce_type = “ElfelTYj^ONTEXT”

$ioc.graph.metadata.entity_type = “DOMAlN_NAME”
Sioc.graph.metadata.source_type = “GLOBAL_CONTEXT”

$ioc.graph.metadata.entity_type = “D0MAIN_NAME”
$ioc.graph.metadata.source_type = MDERIVED_CONTEXT”

$ioc.graph.metadata.entity_type = ,’D0MAIN_NAME*’
$ioc.graph.metadata.source type = “source type unspecified”

新問題 39
You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?

In Google SecOps SOAR settings, create a role for each customer.

In Google SecOps Playbooks, create a playbook for each customer.

In Google SecOps SOAR settings, create a permissions group for each customer.

In Google SecOps SOAR settings, create a new environment for each customer.

新問題 40
You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps).
You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR’s features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?

Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.

Use the ROI – Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.

Use the filters and visualizations in the Management – SOC Status report in SOAR Reports to extract case-specific performance data.

Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.

新問題 41
You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset.
You confirmed that the dataset exists. How should you address this export failure?

Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.

Set a retention period for the BigQuery export.

Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.

Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.

新問題 42
You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Your organization recently faced a cybersecurity breach. You need to increase the threat analytics as quickly as possible. What should you do?

Enable curated detections to identify threats.

Design YARA-L detection rules based on Google SecOps Marketplace use cases.

Develop YARA-L detection rules that focus on threat intelligence.

Ingest data from a threat intelligence platform (TIP) into Google SecOps.

新問題 43
You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?

Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.

Set a retention period for the BigQuery export.

Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.

Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.

新問題 44
You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into:
– User identity behavior
– Lateral movement
– Privilege escalation attempts
You need to determine which telemetry sources are ingested first. Which log source should you prioritize?

Cloud access security broker (CASB) logs

EDR logs

IAM logs

Network firewall logs

新問題 45
Your company is taking a more proactive approach to security. You want to generate an alert when a binary hash first appears in your environment. What should you do?

Enable the Applied Threat Intelligence – Curated Prioritization rule set in curated detections.

Navigate to the Alerts & IOCs page in Google Security Operations (SecOps). Create a filter that targets hashes and specifies a first_seen_time value excluding the current date.

Write a rule to examine file-related events that join with derived context for hashes in the entity graph. Compare the timestamp of the hash with the first_seen_time field.

Create a table by using the Google Security Operations (SecOps) statistics in search to examine file-related events for the current day. Verify that the first_seen_time value predates the current day.

新問題 46
Your organization recently acquired a Google Security Operations (SecOps) Enterprise Plus license. Your organization is already ingesting Cloud Audit Logs, firewall logs, proxy logs and endpoint logs, but there are no threat intelligence feeds being ingested into your Google SecOps environment. You need to design and deploy a solution that alerts your team quickly if an IOC of an active breach is observed in your environment. What should you do?

Write, enable, and configure alerting on a custom multi-event rule.

Write, enable, and configure alerting on a custom single-event rule.

Enable and configure alerting for relevant curated detection rule sets.

Create and schedule a dashboard to send periodic summaries of the active breach IOCs and their associated events.

新問題 47
You are a member of the incident response team working in a global enterprise. You need to identify all potential Google Threat Intelligence IOCs within your organization’s data using Google Security Operations (SecOps). What should you do?

Use the Cases page in Google SecOps.

Create YARA-L rules to detect and alert when Google Threat Intelligence identifies potential threats.

Use Gemini to perform a search for potential cybersecurity threats against your organization’s data.

Use the Alerts & IOCs page in Google SecOps.

新問題 48
You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization’s leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool.
You must recommend a tool to your leadership team as quickly as possible. What should you do?
(Choose two.)

Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.

Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.

Review the architecture of the tool to identify the cloud provider that hosts the tool.

Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.

Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.

新問題 49
Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer. You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?

Create a Google Group and add the required users. Grant the roles/chronicle.viewer IAM role to the group on the project associated with your Google SecOps instance.

Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.

Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.

Create a workforce identity pool at the organization level. Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group
/GROUP_ID principal set on the project associated with your Google SecOps instance.

新問題 50
Your third-party application data is published in a Pub/Sub topic located in a separate Google Cloud project from your Google Security Operations (SecOps) instance. Your attempts to push data from the Pub/Sub topic to Google SecOps have failed. You need to send this data into Google SecOps in a low-latency, robust way. What should you do?

Push the data to Cloud Logging, and modify the export filter in direct ingestion.

Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.

Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.

Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.

新問題 51
Your company’s Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company’s SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?

Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.

Revoke additional role access from Tier 1 and Tier 2 analysts.

Configure the Cross Environment Policy to allow users to move cases between environments.
Move Tier 3 cases to an environment that only Tier 3 analysts can access.

Assign the cases to a user in the Tier 3 role.

新問題 52
You are responsible for identifying suspicious activity and security events at your organization.
You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?

Detect on events where network.ApplicationProtocol is HTTP.

Detect on events where target.port is 5555.

Detect on events where principal.port is 5555.

Detect on events where network.ip_protocol is TCP.

新問題 53
Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts. Specifically, you need to detect when a user account downloads an unusually large volume of data compared to the user’s established baseline activity.
You want to detect this anomalous data access behavior using minimal effort. What should you do?

Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.

Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.

Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.

Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.

新問題 54
You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IOCs that you suspect were generated due to the exercise. What should you do?

Ask Gemini to provide a list of IOCs from the red team exercise.

Filter IOCs with an ingestion time that matches the time period of the red team exercise.

Navigate to the IOC Matches page. Identify and mute the IOCs from the red team exercise.

Navigate to the IOC Matches page. Review IOCs with an Indicator Confidence Score (IC-Score) label >= 80%.

Google Security-Operations-Engineer 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Monitoring and Reporting: This section of the exam measures the skills of Security Operations Center (SOC) Analysts and covers building dashboards, generating reports, and maintaining health monitoring systems. It focuses on identifying key performance indicators (KPIs), visualizing telemetry data, and configuring alerts using tools like Google SecOps, Cloud Monitoring, and Looker Studio. Candidates are assessed on their ability to centralize metrics, detect anomalies, and maintain continuous visibility of system health and operational performance.
トピック 2	Incident Response: This section of the exam measures the skills of Incident Response Managers and assesses expertise in containing, investigating, and resolving security incidents. It includes evidence collection, forensic analysis, collaboration across engineering teams, and isolation of affected systems. Candidates are evaluated on their ability to design and execute automated playbooks, prioritize response steps, integrate orchestration tools, and manage case lifecycles efficiently to streamline escalation and resolution processes.
トピック 3	Detection Engineering: This section of the exam measures the skills of Detection Engineers and focuses on developing and fine-tuning detection mechanisms for risk identification. It involves designing and implementing detection rules, assigning risk values, and leveraging tools like Google SecOps Risk Analytics and SCC for posture management. Candidates learn to utilize threat intelligence for alert scoring, reduce false positives, and improve rule accuracy by integrating contextual and entity-based data, ensuring strong coverage against potential threats.