Google Security-Operations-Engineer : Google Cloud Certified - Professional Security Operations Engineer (PSOE) Exam

ITDumpsKR의 Security-Operations-Engineer 자료는 PDF, Desktop Test Engine, Online Test Engine 세 가지 형태로 제공됩니다. 인쇄해 공부하든, PC에서 실전처럼 풀든, 브라우저에서 바로 응시하든 총 143문항을 원하는 방식으로 학습하실 수 있습니다.

Google Security-Operations-Engineer 시험 개요:

Google Security-Operations-Engineer 시험 요강 주제:

Security-Operations-Engineer 시험에 대해 자주 묻는 질문

최신 Google Cloud Certified Security-Operations-Engineer 무료샘플문제

문제 #1

You are a security engineer at a financial technology company. You need to create a centralized dashboard to provide security posture visibility for your leadership team. The dashboard must meet these requirements:
- Provide insights from Security Command Center (SCC) findings and security-related events captured in Cloud Logging.
- Support large volumes of historical data.
- Be able to join SCC findings and audit logs.
You want to use the most effective visualization solution that uses Google Cloud managed services. What should you do?

A. Use the built-in SCC dashboard to visualize the SCC finding, and extract log counts for specific log events from Cloud Audit Logs.
B. Ingest the SCC findings and Cloud Audit Logs into a Cloud Storage bucket. Write a Python script that reads the data and uses Matplotlib to create the visualizations.
C. Export SCC findings and Cloud Audit Logs to BigQuery. Connect Looker Studio to the BigQuery datasets, and create the visualizations and filters.
D. Create custom metrics in Cloud Monitoring based on the SCC findings, and configure log-based metrics for security-related events. Build Cloud Monitoring dashboards to visualize these custom and log-based metrics.

문제 #2

A SOC uses Chronicle SIEM and wants to reduce alert fatigue without lowering detection coverage. What is the BEST strategy?

A. Apply risk-based alert scoring and entity correlation
B. Disable medium-severity rules
C. Increase alert thresholds globally
D. Limit alerts to business hours

문제 #3

Your organization recently conducted a penetration test on their environment. You have been tasked with identifying a successful attack chain. The required log sources have been ingested into Google Security Operations (SecOps). You discover anomalous outbound traffic to external domains. You suspect that the finding is a communication to a command and control (C2) infrastructure. You need to identify the least common network communications over the last 14 days. What should you do?

A. Perform a Google SecOps SIEM raw log search that looks for low rolling prevalence domains with NETWORK_CONNECTION or NETWORK_HTTP in the firewall and proxy logs over the last 14 days.
B. Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for target domains over the last 14 days.
C. Perform a Google SecOps SIEM UDM search that looks for NETWORK_CONNECTION or NETWORK_HTTP events with low rolling prevalence for principal domains over the last 14 days.
D. Perform a Google SecOps SOAR search that looks for cases with low rolling prevalence of NETWORK_CONNECTION or NETWORK_HTTP events over the last 14 days.

문제 #4

Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?

A. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
B. Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
C. Pull the firewall logs by using a Google SecOps feed integration.
D. Set the Google SecOps URL instance as the Syslog destination.

문제 #5

You are helping a new Google Security Operations (SecOps) customer configure access for their SOC team. The Google SecOps administrators currently have access to the instance. The customer is reporting that new Google SecOps users are not getting authorized to access the instance, but they are able to authenticate to the third-party identity provider (IdP). How should you fix the issue? (Choose two.)

A. Grant the appropriate data access scope to the SOC team's IdP group in IAM.
B. Integrate Google SecOps with the third-party IdP using Workforce Identity Federation.
C. Grant the Basic permission to the appropriate IdP groups in the Google SecOps SOAR Advanced Settings.
D. Link Google SecOps to a Google Cloud project with the Chronicle API.
E. Grant the roles/chronicle.viewer role to the SOC team's IdP group in IAM.

질문과 대답: