GCP-SOE-B試験無料問題集（87題）「Google Security Operations Engineer (Beta) 認定」

出題：1

A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?

A. Limit alerts to business hours

B. Increase alert thresholds globally

C. Disable medium-severity rules

D. Apply risk-based alert scoring and entity correlation

正解：D 解答を投票する

出題：2

A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?

A. Short-lived (ephemeral) resources

B. Encryption at rest

C. Global IP addressing

D. High availability architecture

正解：A 解答を投票する

出題：3

You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?

A. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.

B. Create a case for each identified user with the user designated as the entity.

C. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.

D. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.

正解：D 解答を投票する

出題：4

You are an incident responder at your organization using Google Security Operations (SecOps) for monitonng and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?

A. Use VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.

B. Use the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.

C. Use the EDR integration to quarantine the compromised asset.

D. Deploy emergency patches, and reboot the server to remove malicious persistence.

正解：C 解答を投票する

出題：5

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

A. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.

B. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

C. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.

D. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.

正解：B 解答を投票する

出題：6

After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

A. Closing all related alerts

B. Increasing log retention

C. Adding more analysts

D. Updating detections, playbooks, and IAM controls based on lessons learned

正解：D 解答を投票する

出題：7

You are reviewing the results of a UDM search in Google Security Operations (SecOps). The UDM fields shown in the default view are not relevant to your search. You want to be able to quickly view the relevant data for your analysis. What should you do?

A. Select the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.

B. Use the columns feature to select or remove columns that are relevant to your analysis.

C. Download the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.

D. Create a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.

正解：B 解答を投票する

出題：8

Which Google Cloud log source is MOST critical for detecting unauthorized IAM role changes?

A. Firewall Rules logs

B. VPC Flow Logs

C. Cloud DNS logs

D. Cloud Audit Logs - Admin Activity

正解：D 解答を投票する

出題：9

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

A. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.

B. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.

C. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.

D. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.

正解：D 解答を投票する

GCP-SOE-B試験無料問題集「Google Security Operations Engineer (Beta) 認定」