Google인증 실제 시험문제, Security-Operations-Engineer 덤프문제집

문제1
Your organization is a Google Security Operations (SecOps) customer and monitors critical assets using a SIEM dashboard. You need to dynamically monitor the assets based on a specific asset tag. What should you do?

A. Export the dashboard configuration to a file, modify the file to add a custom filter, and import the file into Google SecOps.

B. Ask Cloud Customer Care to add a custom filter to the dashboard.

C. Add a custom filter to the dashboard.

D. Copy an existing dashboard and add a custom filter.

정답: C

설명: (ITDumpsKR 회원만 볼 수 있음)

문제2
You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

A. Pass the response back to the SIEM.

B. Use a conditional statement to determine whether to treat the URL as suspicious or benign.

C. Use the number of detections from the response JSON in a conditional statement to set the severity.

D. Create a widget that translates the JSON output to a severity score.

E. Verify that the response is accurate by manually checking the URL in VirusTotal

정답: B,C

설명: (ITDumpsKR 회원만 볼 수 있음)

문제3
A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?

A. High availability architecture

B. Global IP addressing

C. Encryption at rest

D. Short-lived (ephemeral) resources

정답: D

설명: (ITDumpsKR 회원만 볼 수 있음)

문제4
Your team hunts for threats in a large multinational corporation. You have subscriptions to threat intelligence feeds from third-party sources. You want to implement a solution to continuously compare DNS calls on endpoints to your threat intelligence feeds. What should you do?

A. Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the entity graph.

B. Create a YARA-L rule in Google Security Operations (SecOps) to track matches between the ingested EDR log entries and the VirusTotal table in the entity graph.

C. Push endpoint logs to BigQuery and use scripts to compare entries to Google Threat intelligence by using a Google Threat Intelligence API key.

D. Use custom modules in Event Threat Detection in Security Command Center (SCC) to correlate feed data with Google Cloud logs.

정답: A

설명: (ITDumpsKR 회원만 볼 수 있음)

문제5
You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?

A. Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.

B. Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.

C. Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.

D. Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.

정답: A

설명: (ITDumpsKR 회원만 볼 수 있음)

문제6
You are a security analyst at a company that uses Google Security Operations (SecOps) Enterprise. Security Command Center Enterprise (SCCE), and Google Threat Intelligence (GTI).
You need to leverage threat intelligence to improve threat hunting capabilities to proactively identify novel and emerging attack patterns targeting your Google Cloud environment in near real-time. What should you do?

A. Configure an Applied Threat Intelligence Fusion Feed in Google SecOps, and develop YARA-L detection rules to search ingested Google Cloud telemetry for patterns matching this intelligence.

B. Configure Google Cloud Armor security policies with preconfigured web application firewall (WAF) rule sets, and enable Adaptive Protection to use GTI.

C. Use the built-in threat intelligence of Event Threat Detection in SCCE to detect relevant threats.

D. Route all Google Cloud logs to a dedicated BigQuery dataset, and use scheduled queries with curated open-source threat intelligence feeds.

정답: A

설명: (ITDumpsKR 회원만 볼 수 있음)

문제7
You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?

A. Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.

B. Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.

C. Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.

D. Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.

정답: B

설명: (ITDumpsKR 회원만 볼 수 있음)

문제8
Your company uses Cloud Identity to manage employee identities and has Google Security Operations (SecOps) linked to your Google Cloud project. You have assigned the roles/chronicle.viewer IAM role at the project level to a specific Google Group that contains users with external Google accounts. Users in this external group authenticate successfully to Google Cloud, but are unable to access Google SecOps. Internal users granted the same role can access Google SecOps. What Google Cloud configuration is most likely preventing the external users from accessing Google SecOps?

A. The roles/chronicle.viewer IAM role does not apply correctly when granted to Google Groups containing external identities.

B. The constraints/iam.allowedPolicyMemberDomains organization policy is restricting IAM role assignments to identities within your company domain only.

C. Google SecOps inherently blocks sign-ins from identities outside the organization's primary domain.

D. External users must be synchronized to Cloud Identity using Google Cloud Directory Sync (GCDS) for IAM roles to take effect.

정답: B

설명: (ITDumpsKR 회원만 볼 수 있음)

문제9
You are a security analyst at an organization that uses Google Security Operations (SecOps).
You have identified a new IP address that is known to be used by a malicious threat actor to launch network attacks. You need to search for this IP address in Google SecOps using all normalized logs to determine whether any malicious activity has occurred. You want to use the most effective approach. What should you do?

A. Write a YARA-L 2.0 detection rule that searches for events with the IP address.

B. Run raw log searches using the IP address as a search term.

C. On the Alerts & IOCs page, review results and entries where the IP address appears.

D. Write UDM searches using YARA-L 2.0 syntax to find events where the IP address appears.

정답: D

설명: (ITDumpsKR 회원만 볼 수 있음)

최신Google Cloud Certified - Professional Security Operations Engineer (PSOE) - Security-Operations-Engineer무료샘플문제

자격증의 중요성:

ITDumpsKR 제품의 가치:

무료샘플 받아보기:

완벽한 서비스 제공:

유용한 링크

인기 시험

우리와 연락하기