Google Security-Operations-Engineer Exam : Google Cloud Certified - Professional Security Operations Engineer (PSOE) Exam

Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?

• A. Configure direct ingestion from your Google Cloud organization.
• B. Configure a third-party API feed in Google SecOps.
• C. Configure and deploy a Google SecOps forwarder.
• D. Configure and deploy a Bindplane collection agent.

A security analyst wants to detect lateral movement between Compute Engine instances using valid credentials. Which data source is MOST useful?

• A. Cloud Load Balancer logs
• B. Compute Engine serial console output
• C. Identity-aware Proxy logs
• D. VPC Flow Logs

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)

• A. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
• B. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
• C. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
• D. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
• E. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.

Your organization recently adopted Google Security Operations (SecOps), and has configured ingestion, parsing and rules for their log sources. The security operations team is currently triaging alerts one at a time using several external product dashboards with alerts and enrichment data. You want to use the case management functionality in Google SecOps to reduce the amount of pivoting between products your SOC analysts are required to do. You want to minimize development effort. What should you do first?

• A. Build a job to periodically iterate over recent cases, determine relevant context, and enrich alerts.
• B. Build a playbook for each detection rule to enrich and remediate alerts relative to the particular threat each rule is designed to detect.
• C. Build a low-priority, catch-all playbook for enrichment of entities in a case using threat intelligence sources.
• D. Build a playbook for each of the noisiest alert sources to gather additional context on the case from the source product.

You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)

• A. Group events by user identity and time to identify repeated access patterns.
• B. Correlate events based on the asset role or classification such as database or user workstation.
• C. Use a saved search to identify all events with the LATERAL_MOVEMENT tag over the past 30 days.
• D. Filter for events using protocol-level attributes that indicate RDP connections.
• E. Filter for RDP connections with non-standard ports.