Free Google GCP-SOE-B Exam Dumps Questions & Answers

You work for a telecommunications company that wants to monitor their multi-region 5G network logs in Google Security Operations (SecOps). The logs are currently only available on- premises and are stored in a standalone network-attached storage (NAS) located in four different regions.
You need to ingest the logs into Google SecOps and tag each NAS as a specific log source to avoid IP address aliasing. What should you do?

• A.  Configure feed management to pull data from each log's location, and configure an ingestion label for each log source.
• B.  Configure feed management to pull data from each log's location, and configure a namespace for each log source.
• C.  Configure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source.
• D.  Configure a Bindplane agent that collects Syslog from each log's location, and configure a namespace for each log source.

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

• A.  Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
• B.  Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.
• C.  Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
• D.  Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.

You are receiving security alerts from multiple connectors in your Google Security Operations (SecOps) instance. You need to identify which IP address entities are internal to your network and label each entity with its specific network name. This network name will be used as the trigger for the playbook. What should you do?

• A.  Create an outcome variable in the rule to assign the network name.
• B.  Modify the entity attribute in the alert overview.
• C.  Configure each network in the Google SecOps SOAR settings.
• D.  Enrich the IP address entities as the initial step of the playbook.

Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

• A.  Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
• B.  Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.
• C.  In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
• D.  Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

• A.  Customize the Case Name format to include the DLP event type.
• B.  Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
• C.  Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
• D.  Customize the Close Case dialog and add the five DLP event types as root cause options.