Security-Operations-Engineer問題集、Google実際の試験問題

質問 1

You manage a large fleet of Compute Engine instances. Security Health Analytics (SHA) has generated a CONFIDENTIAL_COMPUTING_DISABLED finding within Security Command Center (SCC). You need to quickly remediate this finding. What should you do?

A. Delete the offending VM instance, and allow the finding to be automatically marked as inactive.

B. Delete the offending VM instance, and manually mark the finding as inactive.

C. Delete the offending VM instance, and mute the finding.

D. Delete the offending VM instance, and disable the SHA detector.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 2

You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?

A. In Google SecOps SOAR settings, create a permissions group for each customer.

B. In Google SecOps SOAR settings, create a role for each customer.

C. In Google SecOps SOAR settings, create a new environment for each customer.

D. In Google SecOps Playbooks, create a playbook for each customer.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 3

Your organization has mission-critical production Compute Engine VMS that you monitor daily.
While performing a UDM search in Google Security Operations (SecOps), you discover several outbound network connections from one of the production VMs to an unfamiliar external IP address occurring over the last 48 hours. You need to use Google SecOps to quickly gather more context and assess the reputation of the external IP address. What should you do?

A. Search for the external IP address in the Alerts & IOCs page in Google SecOps.

B. Examine the Google SecOps Asset view details for the production VM.

C. Create a new detection rule to alert on future traffic from the external IP address.

D. Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 4

You are a security analyst at an organization that uses Google Security Operations (SecOps).
You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

A. Look for correlations across impacted users in the Risk Analytics dashboard.

B. Enable default curated detections to automatically block suspicious IP addresses.

C. Remove user accounts that have repeated invalid login attempts.

D. Use UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 5

Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

A. Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.

B. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.

C. In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.

D. Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 6

Your organization uses Security Command Center (SCC) and relies on Compute Engine instances to run business-critical workloads. SCC has flagged a particular instance for exhibiting a high volume of outbound network connections to geographically diverse and unknown IP addresses. You need to determine whether the instance has been compromised by malware.
What should you do?

A. Analyze Event Threat Detection findings. Review the events and the outbound network connections associated with the instance.

B. Disable and re-enable the instances' network interface and determine whether the unusual network behavior is resolved.

C. Review the Google Cloud Service Health dashboard to identify any ongoing Google Cloud platform incidents that could be causing unusual network traffic from the instance.

D. Examine the IAM roles assigned to the service account that are associated with the instance.
Revoke any permissions that could have facilitated malware installation.

正解: A

解説: (PassTest メンバーにのみ表示されます)

Google Cloud Certified - Professional Security Operations Engineer (PSOE) - Security-Operations-Engineer 模擬練習