Updated Sep-2026 Test Engine or PDF for the Google GCP-SOE-B test to help you quickly prepare for the Google exam!
Full GCP-SOE-B Practice Test and 87 unique questions with explanations waiting just for you, get it now!
NEW QUESTION # 38
During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?
- A. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
- B. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.
- C. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
- D. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
Answer: B
NEW QUESTION # 39
Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?
- A. Add an exception in the detection rule to exclude matches originating from specific asset groups.
- B. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
- C. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
- D. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
Answer: A
NEW QUESTION # 40
You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?
- A. Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.
- B. Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.
- C. Create a Google SecOps SOAR dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.
- D. Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.
Answer: A
NEW QUESTION # 41
Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?
- A. Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
- B. Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
- C. Assign the cases to a user in the Tier 3 role.
- D. Revoke additional role access from Tier 1 and Tier 2 analysts.
Answer: B
NEW QUESTION # 42
Which Google Cloud security feature MOST helps enforce the principle of least privilege at scale?
- A. IAM predefined roles and conditional IAM policies
- B. VPC Firewall Rules
- C. Binary Authorization
- D. Cloud NAT
Answer: A
NEW QUESTION # 43
You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?
- A. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
- B. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
- C. Create a case for each identified user with the user designated as the entity.
- D. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
Answer: D
NEW QUESTION # 44
Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?
- A. Configure a rule exclusion for the target.ip field.
- B. Configure a rule exclusion for the target.domain field.
- C. Configure a rule exclusion for the principal.ip field.
- D. Configure a rule exclusion for the network.asset.ip field.
Answer: D
NEW QUESTION # 45
You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?
- A. Look for correlations across impacted users in the Risk Analytics dashboard.
- B. Enable default curated detections to automatically block suspicious IP addresses.
- C. Use UDM Search to query historical logs for recent IOCS associated with the suspicious login attempts.
- D. Remove user accounts that have repeated invalid login attempts.
Answer: A
NEW QUESTION # 46
An organization detects a successful login to a Google Cloud IAM user from an unfamiliar country, followed by the creation of multiple new service account keys within minutes. No malware alerts are triggered. What is the MOST appropriate immediate action?
- A. Disable the service accounts and continue monitorin
- B. Wait for evidence of data access
- C. Rotate only the affected user's password
- D. Revoke active credentials, disable the compromised identity, and initiate an incident response
Answer: D
NEW QUESTION # 47
You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?
- A. Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.
- B. Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.
- C. Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.
- D. Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
Answer: A
NEW QUESTION # 48
You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?
- A. Apply any pending updates to the prebuilt parser.
- B. Implement middleware to modify the underlying data structure.
- C. Design and develop a custom parser.
- D. Implement a parser extension on top of the prebuilt parser.
Answer: D
NEW QUESTION # 49
Which Google Cloud log source is MOST critical for detecting unauthorized IAM role changes?
- A. VPC Flow Logs
- B. Cloud DNS logs
- C. Cloud Audit Logs - Admin Activity
- D. Firewall Rules logs
Answer: C
NEW QUESTION # 50
You are using Google Security Operations (SecOps) to hunt for signs of lateral movement through Remote Desktop Protocol (RDP) in your organization. You suspect that a compromised account was used to access multiple internal systems within a short time window. You want to construct a UDM-based search to identify this activity. How should you build this query? (Choose two.)
- A. Group events by user identity and time to identify repeated access patterns.
- B. Filter for RDP connections with non-standard ports.
- C. Correlate events based on the asset role or classification such as database or user workstation.
- D. Use a saved search to identify all events with the LATERAL MOVEMENT tag over the past 30 days.
- E. Filter for events using protocol-level attributes that indicate RDP connections.
Answer: A,E
NEW QUESTION # 51
Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?
- A. Generate a report in SOAR Reports, and schedule delivery of the report.
- B. Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
- C. Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
- D. Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
Answer: D
NEW QUESTION # 52
You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?
- A. Create an outcome variable in the rule to assign the network name.
- B. Enrich the IP address entities as the initial step of the playbook.
- C. Configure each network in the Google SecOps SOAR settings.
- D. Modify the entity attribute in the alert overview.
Answer: B
NEW QUESTION # 53
Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?
- A. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
- B. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
- C. Use the UDM lookup feature to identify relevant process- related UDM fields and values.
- D. Run a UDM search, and review aggregations for relevant process-related UDM fields.
Answer: D
NEW QUESTION # 54
You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?
- A. Cloud Audit Logs
- B. Security Command Center Premium (SCCP) findings
- C. Cloud IDS logs
- D. VPC Flow Logs
Answer: D
NEW QUESTION # 55
Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts. Specifically, you need to detect when a user account downloads an unusually large volume of data compared to the user's established baseline activity. You want to detect this anomalous data access behavior using the least amount of effort. What should you do?
- A. Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.
- B. Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.
- C. Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.
- D. Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.
Answer: B
NEW QUESTION # 56
You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?
- A. Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
- B. Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable
- C. Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
- D. Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.
Answer: B
NEW QUESTION # 57
Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?
- A. Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
- B. Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
- C. Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
- D. Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
Answer: B
NEW QUESTION # 58
Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?
- A. Pull the firewall logs by using a Google SecOps feed integration.
- B. Set the Google SecOps URL instance as the Syslog destination.
- C. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
- D. Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
Answer: D
NEW QUESTION # 59
You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?
- A. Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.
- B. Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).
- C. Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).
- D. Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.
Answer: B
NEW QUESTION # 60
You are a security analyst at an organization that uses Google Security Operations (SecOps). You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?
- A. Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.
- B. On the Alerts & IOCS page, review results and entries where the IP address appears.
- C. Write a YARA-L 2.0 detection rule that searches for events with the IP address.
- D. Run raw log searches using the IP address as a search term.
Answer: A
NEW QUESTION # 61
You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?
- A. Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.
- B. Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.
- C. Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.
- D. Set a retention period for the BigQuery export.
Answer: B
NEW QUESTION # 62
Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?
- A. Use Gemini to generate YARA-L rules for multi-cloud use cases.
- B. Use curated detections from the Cloud Threats category to monitor your cloud environment.
- C. Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.
- D. Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.
Answer: B
NEW QUESTION # 63
......
Full GCP-SOE-B Practice Test and 87 unique questions with explanations waiting just for you, get it now: https://examsboost.pass4training.com/GCP-SOE-B-test-questions.html
