Free Google GCP-SOE-B Exam Dumps Questions & Answers

Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

• A.  Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
• B.  Generate a report in SOAR Reports, and schedule delivery of the report.
• C.  Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.
• D.  Build an Advanced Report in SOAR Reports, and schedule delivery of the report.

You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

• A.  Use the number of detections from the response JSON in a conditional statement to set the severity.
• B.  Use a conditional statement to determine whether to treat the URL as suspicious or benign.
• C.  Pass the response back to the SIEM.
• D.  Create a widget that translates the JSON output to a severity score.
• E.  Verify that the response is accurate by manually checking the URL in VirusTotal

You are responsible for selecting and prioritizing potential sources of data to integrate with Google Security Operations (SecOps). Your company has recently started using several Google Cloud services to increase security in its Google Cloud organization. You need to determine which logs should be ingested into Google SecOps to reduce the effort required to write detections. What should you do?

• A.  Ingest Google Cloud Armor logs by using Cloud Logging.
• B.  Deploy a Bindplane agent to ingest event logs from Compute Engine VMs that provide endpoint visibility.
• C.  Use Google Threat Intelligence to gain insight about threat group behavior and support threat hunting activities.
• D.  Integrate Security Command Center (SCC) into Google SecOps to ingest logs originating from the Google Cloud services.

Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?

• A.  Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
• B.  Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
• C.  Revoke additional role access from Tier 1 and Tier 2 analysts.
• D.  Assign the cases to a user in the Tier 3 role.

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

• A.  Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
• B.  Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
• C.  Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
• D.  Review Security Health Analytics (SHA) findings in Security Command Center (SCC).