Google Security Operations Engineer (Beta) Sample Questions:

1. You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?

A) Security Command Center Premium (SCCP) findings
B) Cloud IDS logs
C) Cloud Audit Logs
D) VPC Flow Logs

2. Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

A) Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.
B) Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
C) In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
D) Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.

3. You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?

A) Create a custom parser to correct the time zone.
B) Create a parser extension to correct the time zone.
C) Modify the default parser and include a default time zone.
D) Modify the UI settings to correct the time zone.

4. You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

A) Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
B) Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
C) Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
D) Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.

5. Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?

A) Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
B) Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
C) Use a custom parser that outputs all fields as raw JSON for detection.
D) Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.

Solutions: