Security-Operations-Engineer試験無料問題集（143題）「Google Cloud Certified - Professional Security Operations Engineer (PSOE) 認定」

出題：1

Your organization is a Google Security Operations (SecOps) customer. You use Google Threat Intelligence to identify cyber threats within your organization's threat profile. You believe your organization may have been targeted by a cyber crime group. You need to identify whether your organization has been the victim of an attack. What should you do?

A. Review the Threat Landscape feature to identify threat groups that are active in your industry, research their known MITRE ATT&CK tactics, techniques, and procedures (TTPs) and implement detection rules in Google SecOps.

B. Implement monitors in the Digital Threat Monitoring feature to identify new compromised credentials, dark web mentions, or data leaks.

C. In the Reports & Analysis feature, extract the IOCs from the recent reports, and implement detection rules and lists in Google SecOps to identify whether they are present in your organization's environment.

D. In the Vulnerability Intelligence feature, identify new high and critical vulnerabilities in products or technologies that your organization uses so they can be patched.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

You are reviewing the security analyst team's playbook action process. Currently, security analysts navigate to the Playbooks tab in Google Security Operations (SecOps) for each alert and manually run steps assigned to a user. You need to present all actions from alerts awaiting user input in one location for the analyst to execute. What should you do?

A. Enable approval links in the manual action and display them as clickable links to the user in a HTML widget in the Default Case View tab.

B. Create an Alert View with the playbook that incorporates the Pending Actions widget.

C. Use the Pending Actions widget in the Default Case View in settings.

D. Add a general insight in your playbook to display manual action details to the user.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

You are a SOC analyst at an organization that uses Google Security Operations (SecOps). You are investigating suspicious activity in your organization's environment. Alerts in Google SecOps indicate repeated PowerShell activity on a set of endpoints. Outbound connections are made to a domain that does not appear in your threat intelligence feeds. The activity occurs across multiple systems and user accounts. You need to search across impacted systems and user identities to identify the malicious user and understand the scope of the compromise. What should you do?

A. Use the User Sign-In Overview dashboard to monitor authentication trends and anomalies across all users.

B. Perform a raw log search for the suspicious domain string, and manually pivot to related user activity.

C. Use the Behavioral Analytics dashboard in Risk Analytics to identify abnormal IP-based activity and high-risk user behavior.

D. Perform a YARA-L 2.0 search to correlate activity across impacted systems and users.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process and integrate with the existing SOW ticketing system. How should you implement this functionality?

A. Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.

B. Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.

C. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system.

D. Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Your company uses Cloud Identity to manage employee identities and has Google Security Operations (SecOps) linked to your Google Cloud project. You have assigned the roles/chronicle.viewer IAM role at the project level to a specific Google Group that contains users with external Google accounts. Users in this external group authenticate successfully to Google Cloud, but are unable to access Google SecOps. Internal users granted the same role can access Google SecOps. What Google Cloud configuration is most likely preventing the external users from accessing Google SecOps?

A. The roles/chronicle.viewer IAM role does not apply correctly when granted to Google Groups containing external identities.

B. The constraints/iam.allowedPolicyMemberDomains organization policy is restricting IAM role assignments to identities within your company domain only.

C. Google SecOps inherently blocks sign-ins from identities outside the organization's primary domain.

D. External users must be synchronized to Cloud Identity using Google Cloud Directory Sync (GCDS) for IAM roles to take effect.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?

A. Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.

B. Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).

C. Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.

D. Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

Security-Operations-Engineer試験無料問題集「Google Cloud Certified - Professional Security Operations Engineer (PSOE) 認定」