Google GCP-PSOE Certification Exam Sample Questions

GCP-PSOE Exam Dumps, GCP-PSOE Examcollection, GCP-PSOE Braindumps, GCP-PSOE Questions PDF, GCP-PSOE VCE, GCP-PSOE Sample Questions, GCP-PSOE Official Cert Guide PDF, Google Professional Security Operations Engineer PDFWe have prepared Google Professional Security Operations Engineer (GCP-PSOE) certification sample questions to make you aware of actual exam properties. This sample question set provides you with information about the Google Professional Security Operations Engineer exam pattern, question formate, a difficulty level of questions and time required to answer each question. To get familiar with Google Cloud Platform - Professional Security Operations Engineer (GCP-PSOE) exam, we suggest you try our Sample Google Professional Security Operations Engineer Certification Practice Exam in simulated Google certification exam environment.

To test your knowledge and understanding of concepts with real-time scenario based questions, we strongly recommend you to prepare and practice with Premium Google GCP-PSOE Certification Practice Exam. The premium certification practice exam helps you identify topics in which you are well prepared and topics in which you may need further training to achieving great score in actual Google Cloud Platform - Professional Security Operations Engineer (GCP-PSOE) exam.

Google GCP-PSOE Sample Questions:

01. Intelligence reports that a newly registered domain is being used by a threat actor targeting your sector. You need to determine whether any host in your environment has interacted with it.
Which telemetry should you examine?
(Choose two.)
a) Endpoint process telemetry, to find processes whose command lines contain the domain.
b) Authentication telemetry, to find accounts that signed in on those hosts shortly before any contact with the domain.
c) Cloud audit telemetry, to find API calls made to resources hosted under the domain.
d) DNS query telemetry, to find hosts that resolved the domain.
e) Web proxy and network connection telemetry, to find hosts that connected to the addresses the domain resolves to.
 
02. A new appliance emits records that are structurally unlike anything already ingested. A colleague proposes onboarding it under an existing log type to avoid creating a new one.
Why should it have its own log type instead?
(Choose two.)
a) A detection rule can reference only one log format, so a shared type would prevent writing rules for the appliance.
b) The parser applied to an event is selected by its log type.
c) Alerts from a shared log type are grouped into one case, so the two appliances would merge into a single investigation.
d) Parsing and normalization statistics are reported per log type, so a format problem stays attributable to this appliance.
e) The ingestion label for a source is derived from its log type, so a shared type would make the two appliances indistinguishable.
 
03. While hunting, you find that a signed but uncommon utility executed on eleven workstations across three departments this week. Applied Threat Intelligence shows the associated domain has been observed in your environment for over two years.
How should you read these two signals together?
a) The utility's rarity is worth pursuing, while the domain's long history in your environment makes it a weak indicator on its own.
b) Both signals point to established activity, since a signed utility and a long-observed domain are each consistent with normal operations.
c) Both signals point to suspicious activity, since a utility appearing on multiple departments' workstations indicates lateral spread.
d) Neither signal is actionable until the domain's reputation score falls below your configured threshold.
 
04. Before deploying a new rule you test it against the previous thirty days of telemetry. The test returns roughly four thousand matches.
What does this most likely tell you?
a) The rule is working correctly, and the volume reflects the thirty-day period rather than the rule's precision.
b) Your environment has a widespread compromise that the rule has just revealed.
c) The rule as written describes behavior that is common in your environment.
d) The test evaluated the rule without its condition section, so the count reflects the events section alone.
 
05. Security Command Center reports a finding that a Compute Engine instance has a public IP address. Your team has reviewed it and established that this instance is a deliberately internet-facing service that is fronted by the appropriate controls. The finding reappears at every scan and clutters the queue.
What should you do?
a) Disable the detector that produces this finding.
b) Mute the finding for that resource, so the check stays active everywhere else.
c) Remediate the finding by removing the external address, and place the service behind a load balancer.
d) Add a rule exclusion in Google SecOps so the finding does not create a case.
 
06. Eight workstations were compromised by the same malware. The desktop team proposes reimaging all eight tonight so that staff can work tomorrow. The investigation has not yet established how the malware arrived or whether it established persistence beyond the running process.
What should you do?
a) Reimage the eight workstations tonight, and continue the investigation using the telemetry already ingested.
b) Reimage six of the workstations while retaining two for analysis.
c) Isolate the eight workstations and issue replacement hardware, deferring both the reimaging and the analysis.
d) Establish the initial access path and the persistence mechanisms first, then reimage.
 
07. An analyst opens a case in Google SecOps SOAR and runs a playbook action that isolates a host through the endpoint integration. The console reports that the analyst is not permitted to run that action. A platform engineer runs the same action from the same case successfully, and the analyst is able to open and edit every other part of the case.
What is the most likely cause?
a) The analyst's permission group restricts that action.
b) The analyst is associated with a different environment from the one that owns the case.
c) The remote agent serving the endpoint integration has lost its connection to the platform.
d) The analyst has not been assigned the SOC role that the playbook routes containment work to.
 
08. Google Cloud audit logs reach your Google SecOps instance, but they consistently arrive in large groups roughly an hour apart rather than continuously. Detection engineers say this delay makes near real-time rules ineffective for those log types.
What is the most likely cause?
a) The aggregated sink is configured at the organization level, so entries are buffered until all projects have reported.
b) The ingestion label applied to the feed groups events for attribution, which delays their availability.
c) The Cloud Audit Logs data access tier is enabled, and those entries are written on a slower path than admin activity entries.
d) The log sink routes to Cloud Storage, which accumulates entries into objects before they are collected.
 
09. During a hunt you are following one machine across several telemetry sources. The endpoint records identify it by hostname, the network flow records identify it by IP address, and the VPN records identify it by the user session. The machine uses a dynamically assigned address.
What is the most important step to take?
a) Use the hostname consistently across all three sources, since it is the stable identifier for the machine.
b) Establish which address the machine held during each period, and use that mapping to bound every address-based query in time.
c) Configure a namespace for the network telemetry so that the machine resolves to a single asset identity.
d) Filter each source to the VPN session period, since the user session ties the three identifiers together.
 
10. Over two days your SOC has opened nine cases that, on review, all stem from one phishing campaign against different departments. Analysts are duplicating enrichment work and the incident manager cannot see the campaign's overall scope.
What should you do?
a) Tag all nine cases with the campaign name, and filter the queue by that tag.
b) Close eight of the cases as duplicates, and continue the investigation in the remaining one.
c) Link the cases to one another so the relationship is recorded and the campaign can be viewed as a whole.
d) Adjust the alert grouping window to bring future campaign alerts into one case.

Answers:

Question: 01
Answer: d, e		 Question: 02
Answer: b, d		 Question: 03
Answer: a		 Question: 04
Answer: c		 Question: 05
Answer: b
Question: 06
Answer: d		 Question: 07
Answer: a		 Question: 08
Answer: d		 Question: 09
Answer: b		 Question: 10
Answer: c

Note: Please update us by writing an email on feedback@vmexam.com for any error in Google Cloud Platform - Professional Security Operations Engineer (GCP-PSOE) certification exam sample questions

Rating: 4.8 / 5 (111 votes)

User login