2026年最新のSecurity-Operations-Engineer問題集にはGoogle Cloud Certified認証済み試験問題と解答
実際に出ると確認されたSecurity-Operations-Engineer試験問題集と解答でSecurity-Operations-Engineer無料更新
Google Security-Operations-Engineer 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 27
You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain. You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the effort required by the SOC analyst. What should you do?
- A. Create a case for each identified user with the user designated as the entity.
- B. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.
- C. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
- D. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
正解：B
解説：
The key requirement is to *automate* the extraction of data to *minimize analyst effort*. This is a core function of Google Security Operations SOAR (formerly Siemplify). The **Siemplify integration** provides the foundational playbook actions for case management and entity manipulation.
The **`Create Entity`** action is designed to programmatically add new entities (like users, IPs, or domains) to the active case. To make this action automatic, the playbook developer must use the **Expression Builder**. The Expression Builder is the tool used to parse the JSON output from a previous action (the UDM query) and dynamically map the results (the list of usernames) into the parameters of a subsequent action.
By using the Expression Builder to configure the `Entities Identifier` parameter of the `Create Entity` action, the playbook automatically extracts all `principal.user.userid` fields from the UDM query results and adds them to the case. These new entities can then be automatically passed to the next playbook step, such as
"Reset Password."
Options A and C are incorrect because they are **manual** actions. They require an analyst to intervene, which does *not* minimize effort. Option D is incorrect as it creates multiple, unnecessary cases, flooding the queue instead of enriching the single, original phishing case.
*(Reference: Google Cloud documentation, "Google SecOps SOAR Playbooks overview"; "Using the Expression Builder"; "Marketplace and Integrations")*
***
質問 # 28
You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?
- A. Run a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
- B. Perform a UDM search for login events, and pivot to group results by user and country of origin.
- C. Perform a YARA-L 2.0 search for login events and their associated principal.location.country field.
Use an outcome field to aggregate the number of failed logins. - D. Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.
正解：B
解説：
The most direct way to validate if the account shows signs of compromise is to perform a UDM search for login events and group the results by user and country of origin. This allows you to clearly identify impossible travel patterns (same user logging in from different countries in a short time window), which is a strong indicator of account compromise.
質問 # 29
Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?
- A. Configure and deploy a Google SecOps forwarder.
- B. Configure and deploy a Bindplane collection agent
- C. Configure a third-party API feed in Google SecOps.
- D. Configure direct ingestion from your Google Cloud organization.
正解：A
解説：
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
The standard, native, and minimal-effort solution for ingesting logs from on-premises sources into Google Security Operations (SecOps) is to use the Google SecOps forwarder. The forwarder is a lightweight software component (available as a Linux binary or Docker container) that is deployed within the customer's network. It is designed to collect logs from a variety of on-premises sources and securely forward them to the SecOps platform.
The forwarder can be configured to monitor log files directly (which is a common output for a MySQL database) or to receive logs via syslog. Once the forwarder is installed and its configuration file is set up to point to the MySQL log file or syslog stream, it handles the compression, batching, and secure transmission of those logs to Google SecOps. This is the intended and most direct ingestion path for on-premises telemetry.
Option C is incorrect because the log source is on-premises, not within the Google Cloud organization. Option B (API feed) is the wrong mechanism; feeds are used for structured data like threat intelligence or alerts, not for raw telemetry logs from a database. Option A (Bindplane) is a third-party partner solution, which may involve additional configuration or licensing, and is not the native, minimal-effort tool provided directly by Google SecOps for this task.
(Reference: Google Cloud documentation, "Google SecOps data ingestion overview"; "Install and configure the SecOps forwarder")
質問 # 30
You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?
- A. Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.
- B. Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.
- C. Configure the Windows server to send an email notification if there is an error in the Bindplane process.
- D. Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.
正解：D
解説：
The most efficient solution is to create an alert policy in Cloud Monitoring that triggers a notification when no logs are ingested from the server's hostname for over 30 minutes. Cloud Monitoring can natively monitor log ingestion and absence, providing real-time alerts with minimal setup and integration effort.
質問 # 31
You were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand the current performance by calculating the mean time to respond or remediate (MTTR) for your cases. What should you do?
- A. Create a playbook block that can be re-used in all alert playbooks to write timestamps in the case wall after each change to the case. Write a job to calculate the case metrics.
- B. Create a dashboard table widget that displays the average case handling times by analyst, case priority, and environment.
- C. Use the playbooks' case stages to capture metrics for each stage change. Create a dashboard based on these metrics.
- D. Create a multi-event detection rule to calculate the response metrics in the outcome section based on the entity graph. Create a dashboard based on these metrics.
正解：B
解説：
The most direct approach is to create a dashboard table widget that displays average case handling times by analyst, case priority, and environment. This gives you a clear view of MTTR and other relevant metrics without additional playbook or rule development, making it easy to understand your SOC's current performance.
質問 # 32
Your third-party application data is published in a Pub/Sub topic located in a separate Google Cloud project from your Google Security Operations (SecOps) instance. Your attempts to push data from the Pub/Sub topic to Google SecOps have failed. You need to send this data into Google SecOps in a low-latency, robust way. What should you do?
- A. Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.
- B. Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.
- C. Push the data to Cloud Logging, and modify the export filter in direct ingestion.
- D. Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.
正解：D
解説：
The recommended low-latency and robust method to ingest third-party Pub/Sub data into Google Security Operations (SecOps) is to create a Cloud Run function subscribed to the Pub/Sub topic.
The function can process each message and forward it securely using a Google SecOps Ingestion API key. This design handles cross-project integration cleanly, provides fault tolerance and scalability, and ensures near real-time ingestion into SecOps.
質問 # 33
You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?
- A. In Google SecOps SOAR settings, create a new environment for each customer.
- B. In Google SecOps SOAR settings, create a role for each customer.
- C. In Google SecOps Playbooks, create a playbook for each customer.
- D. In Google SecOps SOAR settings, create a permissions group for each customer.
正解：A
解説：
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
The correct mechanism for achieving logical data segregation for different customers in a Google Security Operations (SecOps) SOAR multi-tenant environment is by using Environments. The documentation explicitly states that "you can define different environments and environment groups to create logical data segregation." This separation applies to most platform modules, including cases, playbooks, and dashboards.
This feature is specifically designed for this use case: "This process is useful for businesses and Managed Security Service Providers (MSSPs) who need to segment their operations and networks. Each environment...
can represent a separate customer." When an analyst is associated with a specific environment, they can only see the cases and data relevant to that customer, ensuring strict logical separation.
While permission groups (Option C) and roles (Option A) are used to control what a user can do within the platform (e.g., view cases, edit playbooks), they do not provide the primary data segregation. Environments are the top-level containers that separate one customer's data and cases from another's. Playbooks (Option B) are automation workflows and are not a mechanism for logical separation.
(Reference: Google Cloud documentation, "Control access to the platform using SOAR permissions"; " Support multiple instances [SOAR]")
質問 # 34
You received an IOC from your threat intelligence feed that is identified as a suspicious domain used for command and control (C2). You want to use Google Security Operations (SecOps) to investigate whether this domain appeared in your environment. You want to search for this IOC using the most efficient approach.
What should you do?
- A. Enter the IOC into the IOC Search feature, and wait for detections with this domain to appear in the Case view.
- B. Enable Group by Field in scan view to cluster events by hostname.
- C. Configure a UDM search that queries the DNS section of the network noun.
- D. Run a raw log search to search for the domain string.
正解：C
解説：
The most efficient and reliable method to proactively search for a specific indicator (like a domain) in Google Security Operations is to perform a Universal Data Model (UDM) search. All ingested telemetry, including DNS logs and proxy logs, is parsed and normalized into the UDM. This allows an analyst to run a single, high- performance query against a specific, indexed field.
To search for a domain, an analyst would query a field such as network.dns.question.name or network.http.
hostname. Option B correctly identifies this as querying the "DNS section of the network noun." This approach is vastly superior to a raw log search (Option C), which is slow, inefficient, and does not leverage the normalized UDM data.
Option D (IOC Search/Matches) is a passive feature that shows automatic matches between your logs and Google's integrated threat intelligence. While it's a good place to check, a UDM search is the active, analyst- driven process for hunting for a new IoC that may have come from an external feed. Option A is a UI feature for grouping search results and is not the search method itself.
(Reference: Google Cloud documentation, "Google SecOps UDM Search overview"; "Universal Data Model noun list - Network")
質問 # 35
During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization- level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets.
You need to determine whether any actions were taken by this external identity in your environment.
What should you do?
- A. Use Policy Analyzer to identify the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
- B. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
- C. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
- D. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs where the principal email matches the external identity.
正解：D
解説：
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
To definitively determine "whether any actions were taken" by a specific identity, you must search the audit logs directly for that identity's activity. The scenario specifies two data repositories: a centralized Cloud Logging bucket (for recent/retention-period logs) and BigQuery (for historical logs).
According to Google Cloud Observability and Security Operations documentation, Cloud Audit Logs (specifically Admin Activity and Data Access logs) capture "Who did what, where, and when." The primary identifier for the actor in these logs is the protoPayload.authenticationInfo.principalEmail.
Option C is the only method that directly queries the activity logs for the specific actor.
* Cloud Logging: You would use the Logging Query Language to filter: protoPayload.authenticationInfo.
principalEmail="[IDENTITY_EMAIL]".
* BigQuery: You would use SQL to query the exported tables: SELECT * FROM [DATASET.TABLE] WHERE protopayload_auditlog.authenticationInfo.principalEmail = "[IDENTITY_EMAIL]".
Options A and B focus on access potential (Recommender/Policy Analyzer) rather than historical actions.
Option D (VPC Flow Logs) records network traffic 5-tuples and does not contain identity information (principal email), making it unsuitable for attributing API actions to a specific user.
References: Google Cloud Documentation > Cloud Logging > Logging query language; Google Cloud Documentation > Cloud Audit Logs > Audit log fields
質問 # 36
Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?
- A. Set the Google SecOps URL instance as the Syslog destination.
- B. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
- C. Deploy a third-party agent (e.g., Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
- D. Pull the firewall logs by using a Google SecOps feed integration.
正解：B
解説：
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
(Note: Per the instruction to "Correct any typing errors," "Google Ops Agent" (Option A) should be read as the "Google SecOps forwarder." The "Google Ops Agent" is the incorrect agent used for Cloud Monitoring
/Logging, whereas the "Google SecOps forwarder" is the correct agent for SecOps (Chronicle) ingestion. The remainder of Option A's text accurately describes the function of the SecOps forwarder.) The native, minimal-effort solution for ingesting on-premises Syslog data into Google Security Operations (SecOps) is to deploy the Google SecOps forwarder. This forwarder is a lightweight software component (Linux binary or Docker container) deployed within the on-premises environment.
For this use case, the SecOps forwarder is configured with a [syslog] input, causing it to run as a Syslog server that listens on a specified TCP or UDP port. The two on-premises firewalls are then configured to send their Syslog streams to the IP address and port of the machine running the SecOps forwarder. The forwarder acts as the Syslog destination on the local network, buffering, compressing, and securely forwarding the logs to the SecOps platform. Option C is a valid, but third-party, solution. Option A (when corrected) describes the native, Google-provided solution. Option B (Feed) is incorrect as feeds are for threat intel, not telemetry.
Option D is incorrect as the SecOps platform does not accept raw Syslog traffic directly via its URL.
(Reference: Google Cloud documentation, "Google SecOps data ingestion overview"; "Install and configure the SecOps forwarder"; "Forwarder configuration syntax - Syslog input")
質問 # 37
Your organization has mission-critical production Compute Engine VMs that you monitor daily. While performing a UDM search in Google Security Operations (SecOps), you discover several outbound network connections from one of the production VMs to an unfamiliar external IP address occurring over the last 48 hours. You need to use Google SecOps to quickly gather more context and assess the reputation of the external IP address. What should you do?
- A. Create a new detection rule to alert on future traffic from the external IP address.
- B. Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.
- C. Search for the external IP address in the Alerts & IoCs page in Google SecOps.
- D. Examine the Google SecOps Asset view details for the production VM.
正解：C
解説：
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
The most direct and efficient method to "quickly gather more context and assess the reputation" of an unknown IP address is to check it against the platform's integrated threat intelligence. The **Alerts & IoCs page**, specifically the **IoC Matches** tab, is the primary interface for this.
Google Security Operations continuously and automatically correlates all ingested UDM (Universal Data Model) events against its vast, integrated threat intelligence feeds, which include data from Google Threat Intelligence (GTI), Mandiant, and VirusTotal. If the unfamiliar external IP address is a known malicious Indicator of Compromise (IoC)-such as a command-and-control (C2) server, malware distribution point, or known scanner-it will have already generated an "IoC Match" finding.
By searching for the IP on this page, an analyst can immediately confirm if it is on a blocklist and gain critical context, such as its threat category, severity, and the specific intelligence source that flagged it. While Option B (finding the user) and Option C (viewing the asset) are valid subsequent steps for understanding the internal scope of the incident, they do not provide the *external reputation* of the IP. Option D is a *response* action taken only *after* the IP has been assessed as malicious.
*(Reference: Google Cloud documentation, "View alerts and IoCs"; "How Google SecOps automatically matches IoCs"; "Investigate an IP address")*
***
質問 # 38
Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)
- A. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
- B. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
- C. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
- D. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
- E. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
正解：A、E
解説：
Running a UDM search for low-prevalence domains first seen in the last 30 days helps uncover potentially anomalous or malicious domains, since attackers often use newly registered or rarely seen domains for C2 or exfiltration.
Using the Risk Analytics dashboard allows you to identify domains with higher normalized risk scores. Drilling into those entities helps validate whether they are new, rare, or potentially tied to malicious activity.
質問 # 39
Your organization has recently onboarded to Google Cloud with Security Command Center Enterprise (SCCE) and is now integrating it with your organization's SOC. You want to automate the response process and integrate with the existing SOW ticketing system. How should you implement this functionality?
- A. Use the SCC notifications feed to send alerts to Pub/Sub. Ingest these feeds using the relevant SIEM connector.
- B. Configure the SCC notifications feed to use Pub/Sub for alerts. Create a Cloud Run function to trigger when an event arrives in the topic and generate a ticket by calling the API endpoint in the SOC ticketing system.
- C. Disable the generic posture finding playbook in Google Security Operations (SecOps) SOAR and enable the playbook for the ticketing system. Add a step in your Google SecOps SOAR playbook to generate a ticket based on the event type.
- D. Evaluate each event within the SCC console. Create a ticket for each finding in the ticketing system, and include the remediation steps.
正解：B
解説：
The correct solution is to configure the SCC notifications feed to Pub/Sub and then use a Cloud Run function triggered by new events in the topic to call the SOC ticketing system's API. This automates ticket creation for findings, integrates seamlessly with the existing SOC process, and minimizes manual intervention while ensuring timely response.
質問 # 40
You are configuring a new integration in Google Security Operations (SecOps) to perform enrichment actions in playbooks. This enrichment technology is located in a private data center that does not allow inbound network connections. You need to connect your Google SecOps instance to the integration. What should you do?
- A. Create a network route in Google Cloud to the private data center.
- B. Query the enrichment source in the private data center and upload the results to the case wall in Google SecOps.
- C. Create a forwarder in the private data center. Configure an instance of the integration to run on the forwarder.
- D. Create a remote agent in the private data center. Configure an instance of the integration to run on a remote agent in Google SecOps.
正解：D
解説：
The correct approach is to create a remote agent in the private data center and configure the integration to run on that agent. Remote agents can initiate outbound connections to Google SecOps, enabling playbook enrichment without requiring inbound network access, which adheres to the private data center's network restrictions.
質問 # 41
Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?
- A. Create a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
- B. Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API.
- C. Send the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic.
Configure a trigger to send an email alert when new events are sent to this feed. - D. Use log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
正解：B
解説：
The correct approach is to sink logs to BigQuery, where you can perform windowing and advanced aggregations over time. Then, use Cloud Run functions to periodically query BigQuery and generate normalized alerts published to a Pub/Sub topic. From there, alerts can be written back into SCC as findings via the SCC API, giving analysts a central interface for triage. This architecture supports large-scale environments, advanced calculations, and efficient integration with SCC.
質問 # 42
You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs.
What should you do?
- A. Ingest logs from Windows PowerShell.
- B. Ingest logs from Microsoft Entra ID.
- C. Ingest logs from Windows Procmon.
- D. Ingest logs from Windows Sysmon.
正解：D
解説：
To ensure the principal.user.userid field captures all relevant activity, you should ingest logs from Windows Sysmon. Sysmon provides detailed system activity, including process creation, network connections, and user context, which complements EDR and Windows Event logs, allowing YARA-L rules to match across all endpoint telemetry.
質問 # 43
......
実際問題を使ってSecurity-Operations-Engineer問題集で100%無料Security-Operations-Engineer試験問題集：https://www.passtest.jp/Google/Security-Operations-Engineer-shiken.html
Security-Operations-Engineer試験問題集、テストエンジン練習テスト問題：https://drive.google.com/open?id=1HoqVMH4E-EH9WpMAGp7QV6nJkYH4TDAV