Official Bank
0/60
Page
1/4
Pro Security Operations Engineer (Security Operations Engineer) - Google Cloud Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
60
Total Questions
1
Question
Your Google Security Operations (SecOps) case queue contains a case with IP address entities. You need to determine whether the entities are internal or external assets and ensure that internal IP address entities are marked accordingly upon ingestion into Google SecOps SOAR. What should you do?
Options
A
Indicate your organization's known internal CIDR ranges in the Environment Networks list in the settings.
B
Modify the connector logic to perform a secondary lookup against your CMDB and flag incoming entities as internal or external.
C
Create a custom action to ping the IP address entity from your Remote Agent. If successful, the custom action designates the IP address entity as internal.
D
Configure a feed to ingest enrichment data about the networks, and include these fields into your detection outcome.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process within SCCE and integrate with the existing SOC ticketing system. You want to use the most efficient solution. How should you implement this functionality?
Options
A
Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.
B
Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.
C
Configure the SCC notifications feed to send alerts to a Cloud Storage bucket. Create a Dataflow job to read the new files, extract the relevant information, and send the information to the SOC ticketing system.
D
Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post-processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning. What should you do?
Options
A
Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
B
Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
C
Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
D
Generate a report in SOAR Reports, and schedule delivery of the report.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?
Options
A
Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs where the principal email matches the external identity.
B
Use Policy Analyzer to identify the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
C
Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
D
Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?
Options
A
Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.
B
Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy
for each collector_id.
for each collector_id.
C
Create a Google SecOps dashboard that shows the ingestion metrics for each iog_cype and collector_id.
D
Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.