Free Google Security-Operations-Engineer Exam Dumps Questions & Answers

Your company uses Google-managed images on Compute Engine VM instances extensively and has deployed Security Command Center Enterprise (SCCE) at the organization level Due to a recent increase in vulnerability exploits, you want to improve visibility into operating system (OS) risks for all VMs in your organization. You want to use managed services to enhance security detection capabilities related to these vulnerabilities using minimal effort. What should you do?

• A.  Enable Virtual Machine Threat Detection in SCCE, and allow it to generate findings.
• B.  Create a custom Security Health Analytics (SHA) scanner to check the sourceImage of the compute disk. Check for matches in a vulnerability database.
• C.  Set up Google Open Source Vulnerability (OSV)-Scanner to scan all Compute Engine VMs.
  Configure a Google Security Operations (SecOps) forwarder to write logs to your Google SecOps instance.
• D.  Enable VM Manager across your projects, and allow VM Manager to write findings to SCCE.

After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

• A.  Increasing log retention
• B.  Closing all related alerts
• C.  Updating detections, playbooks, and IAM controls based on lessons learned
• D.  Adding more analysts

You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on-premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

• A.  Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.
• B.  Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
• C.  Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
• D.  Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.

You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into:
- User identity behavior
- Lateral movement
- Privilege escalation attempts
You need to determine which telemetry sources are ingested first. Which log source should you prioritize?

• A.  IAM logs
• B.  EDR logs
• C.  Cloud access security broker (CASB) logs
• D.  Network firewall logs

You are responsible for identifying suspicious activity and security events at your organization.
You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?

• A.  Detect on events where target.port is 5555.
• B.  Detect on events where principal.port is 5555.
• C.  Detect on events where network.ip_protocol is TCP.
• D.  Detect on events where network.ApplicationProtocol is HTTP.