GCP-SOE-B問題集、Google実際の試験問題

質問 1

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A. Configure the Windows server to send an email notification if there is an error in the Bindplane process.

B. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

C. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.

D. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

正解: C

質問 2

During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

A. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.

B. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.

C. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.

D. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.

正解: C

質問 3

Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting dat a. You need to minimize the cost of these configurations.
What should you do?

A. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.

B. Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.

C. Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.

D. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.

正解: B

質問 4

You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?

A. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.

B. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.

C. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.

D. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.

正解: C

質問 5

You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps).
You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR's features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?

A. Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.

B. Use the filters and visualizations in the Management - SOC Status report in SOAR Reports to extract case-specific performance data.

C. Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.

D. Use the ROI - Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.

正解: D

質問 6

You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

A. Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.

B. Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.

C. Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.

D. Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.

正解: C

質問 7

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

A. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.

B. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.

C. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

D. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

正解: B

質問 8

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

A. Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.

B. Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.

C. Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.

D. Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.

正解: B

質問 9

You observe several distinct, low-severity suspicious activities associated with a single internal server. You determine that no single event is a high-confidence IO You need to create a solution that ensures ongoing and heightened scrutiny for this server. What should you do?

A. Add the server to a Google Security Operations (SecOps) watchlist, and monitor the watchlist closely for the next few weeks.

B. Create a case, isolate the server from the network, and escalate the case for forensic investigation.

C. Develop a YARA-L detection rule specific to this server.

D. Schedule a daily Google Security Operations (SecOps) report detailing all activity on this server.

正解: A

Google Security Operations Engineer (Beta) - GCP-SOE-B 模擬練習