Free Google Cloud Professional Security Operations Engineer Sample Questions

Correct answer: A — Container Threat Detection in Security Command Center.

• A. Correct. Container Threat Detection (a feature of Security Command Center Premium/Enterprise) is specifically designed to detect runtime threats inside containers and GKE environments. It monitors the container runtime and the underlying OS to identify suspicious processes, such as reverse shells, cryptomining, and malware, which are not visible in Kubernetes API audit logs.
• B. Incorrect. VPC Flow Logs capture network traffic metadata (source/destination IP, port, protocol) for analysis. While they might show the network traffic generated by a reverse shell, they lack process-level visibility and are not the primary tool for detecting container runtime compromises.
• C. Incorrect. Cloud Data Loss Prevention (DLP) is used to discover, classify, and protect sensitive data (like PII) within storage or data streams. It has no functionality for monitoring process execution or detecting runtime threats in GKE pods.
• D. Incorrect. Binary Authorization is a deploy-time security control that ensures only trusted, signed container images are deployed. While it prevents untrusted images from starting, it does not provide detection capabilities for malicious activity occurring once a container is already running.

Correct answer: B — Build a playbook in Google SecOps SOAR that integrates with Workspace and VirusTotal to automate the triage and response.

• A. YARA-L rules in Google SecOps SIEM are designed for threat detection and pattern matching within logs. They do not have the native capability to execute response actions like deleting emails or suspending accounts, which require orchestration logic.
• B. Google SecOps SOAR is specifically designed for security orchestration, automation, and response. It allows you to build playbooks that integrate directly with external services like VirusTotal for enrichment and Google Workspace for remediation (e.g., suspending accounts), effectively automating the entire manual lifecycle described.
• C. Security Command Center (SCC) is primarily focused on cloud infrastructure security posture and asset findings. Mute rules are used to suppress noise by hiding alerts, but they do not facilitate the investigation, enrichment, or remediation actions needed for phishing response.
• D. While a custom Cloud Run service could technically be developed, it represents a high-maintenance, custom-coded solution. It fails to leverage the purpose-built automation and pre-integrated connectors available in the Google SecOps SOAR platform.

Correct answer: B — It enriches raw logs with asset, user, and threat intelligence context automatically, reducing manual correlation time.

• A. Incorrect. Blocking malicious IP addresses at the VPC firewall level is an enforcement or remediation action. The primary purpose of the Context Graph is to provide investigative context and visibility, not to directly manage or control network security infrastructure.
• B. Correct. The Google SecOps Context Graph helps analysts by automatically correlating raw events with related entity context such as assets, users, and threat intelligence. This enrichment reduces the manual effort required to piece together disparate logs, speeding up the understanding of the impact and scope of an incident.
• C. Incorrect. Generating compliance reports for standards like PCI-DSS and HIPAA is a governance and reporting function. While Google SecOps supports compliance monitoring, it is not the primary benefit or purpose of the Context Graph's relationship-mapping capabilities.
• D. Incorrect. Scanning container images for CVEs is a vulnerability scanning feature typically associated with Artifact Analysis or specialized container security tools. It is unrelated to the Context Graph's role in investigation-time log enrichment and correlation.

Correct answer: A — Configure Google SecOps Data Access Scopes based on log labels or namespaces.

• A. Correct. Data Access Scopes (DAS) are the native mechanism in Google SecOps designed to restrict the data a user can view. By defining scopes based on namespaces or ingestion labels, administrators can ensure analysts from specific subsidiaries see only their relevant data while global analysts can be assigned a scope that encompasses all logs.
• B. Incorrect. While IAM roles like `roles/chronicle.viewer` grant access to the Google SecOps service, IAM resource conditions are used to control access at the resource or project level (e.g., based on time or IP). They cannot be used to filter granular, row-level data within the Unified Data Model (UDM) based on the log's origin or content.
• C. Incorrect. Creating separate Google Cloud projects for each subsidiary would prevent the implementation of a single 'centralized' Google SecOps instance as requested. This approach increases architectural complexity and makes global analysis across subsidiaries significantly more difficult.
• D. Incorrect. Cloud Logging exclusion filters prevent logs from being ingested entirely. Using them would mean the logs are not stored in Google SecOps at all, preventing global analysts from viewing the data and defeating the purpose of centralized log collection.

Correct answer: A — The authenticated identity lacks the roles/securitycenter.findingsEditor role at the organization, folder, or project level where the finding resides.

• A. Correct. A '403 Permission Denied' error (when authentication is successful) indicates that the authenticated identity lacks the specific IAM authorization to perform the requested operation. Updating an SCC finding's state requires the 'securitycenter.findings.update' permission, which is included in the 'roles/securitycenter.findingsEditor' role at the appropriate resource level (Organization, Folder, or Project).
• B. Incorrect. The 'roles/securitycenter.findingsViewer' role provides read-only access to findings. While it allows an identity to see the findings, it does not grant the write permissions necessary to modify the finding's state.
• C. Incorrect. If the SCC API were not enabled, the error would typically be a '404 Not Found' or a specific error message indicating the API is not enabled for the project. A 403 Forbidden error usually points directly to IAM permission issues.
• D. Incorrect. If the finding were already in the desired state, the API would typically return a successful response (idempotency) or a '400 Bad Request' if the state transition was invalid. It would not return a permission denied error based on the current data state.

Correct answer: A — A client configuration file (JSON) containing the Workforce Identity Pool and Provider details.

• A. Correct. Workforce Identity Federation (WIF) for CLI and application-level access requires a credential configuration file (JSON). This file contains the information about the workforce identity pool and provider, and it allows the Google Cloud SDK or client libraries to perform the token exchange from the external identity provider to Google Cloud security tokens.
• B. Incorrect. Service account keys are static, long-lived credentials. Workforce Identity Federation is specifically designed to eliminate the need for such keys by using short-lived credentials derived from an external identity provider.
• C. Incorrect. An OAuth 2.0 Client Secret is typically used in the Web Server flow for standard OAuth 2.0 applications. In the context of Workforce Identity Federation for a CLI tool, the client configuration file is the mechanism used to define the trust relationship and exchange parameters.
• D. Incorrect. While a SAML metadata XML file is used by administrators to configure the trust relationship between the Identity Provider (IdP) and Google Cloud when setting up the provider, it is not used by the CLI tool itself to perform authentication flows.

Correct answer: B — It dynamically links events to entity context at search time based on overlapping aliasing fields and timestamps.

• A. Google SecOps (Chronicle) maintains raw logs as immutable data. It does not permanently rewrite or modify the original raw logs when evaluating entity context; instead, the context is applied through the platform's analysis layers.
• B. The Entity Graph dynamically associates telemetry events with entity context (such as user or asset information) at query or search time. It achieves this by matching aliasing fields—like IP addresses, hostnames, or usernames—while ensuring the timestamps align with the period the entity held those attributes.
• C. Chronicle automates the correlation process through its Unified Data Model (UDM) and Entity Graph. Analysts are not required to manually write SQL joins to connect disparate data sets, as the platform handles this relationship mapping natively.
• D. The Entity Graph is designed to correlate data across the entire environment regardless of the ingestion source. It can link events and entities from different log forwarders and platforms as long as they share relevant identifiers and temporal context.

Correct answer: C — Ingesting CMDB data as UDM Entity logs to enrich the instance's hostname with the `asset.owner` field.

• A. Incorrect. VPC Flow Logs provide essential network telemetry such as source/destination IP, ports, and traffic volume. However, they do not contain business metadata or identity context such as the application owner.
• B. Incorrect. While Cloud Audit Logs can show who originally created the instance, the creator is not always the current application owner. This method is indirect, requires manual correlation of historical events, and is less reliable than using an enriched asset database.
• C. Correct. Ingesting CMDB (Configuration Management Database) data as UDM Entity logs is the standard method in Google Security Operations for context enrichment. By mapping CMDB records to the UDM 'asset.owner' field, investigators can immediately see ownership details alongside technical logs, making it the most efficient approach.
• D. Incorrect. Vulnerability scans are designed to identify software versions, open ports, and security flaws. They do not provide administrative ownership context and are far too slow to use for real-time incident investigation.

Correct answer: B — Modify the YARA-L detection rule to only alert if the TI match is accompanied by a subsequent successful network connection to the domain.

• A. Disabling the threat intelligence feed entirely is an extreme measure that removes valuable detection capabilities and leaves the organization blind to potential threats. The objective is to tune the alerts, not eliminate visibility.
• B. Modifying the YARA-L detection rule to require context—such as a subsequent successful network connection—helps distinguish benign DNS lookups from actionable malicious activity. This multi-event correlation improves alert fidelity by ensuring alerts are only generated when there is evidence of actual communication with the suspicious domain.
• C. Deleting DNS logs is not a viable solution. DNS telemetry is critical for incident investigation, threat hunting, and compliance. Deleting logs removes evidence without fixing the root cause of the noisy alerts.
• D. Whitelisting all domains in the feed would nullify the purpose of subscribing to threat intelligence. This would create a significant security gap, as it prevents alerts for domains that may genuinely be malicious alongside the parked ones.

Correct answer: A — Create a parser extension using Grok to extract the specific field and map it to udm.additional.fields.

• A. Correct. Parser extensions in Google SecOps are specifically designed to enrich default parsers. By using a parser extension with Grok, you can extract custom fields from the raw log and map them to UDM fields (like udm.additional.fields) without needing to duplicate or replace the existing normalization logic for standard Apache fields.
• B. Incorrect. Writing a custom parser from scratch is time-consuming and inefficient. It requires duplicating the existing logic for standard fields and means you lose out on any automatic updates or improvements Google makes to the default Apache parser.
• C. Incorrect. Cloud Logging Log Router sinks are primarily used for routing, filtering, and basic transformations. Modifying the payload at the routing stage adds architectural complexity and does not resolve the UDM mapping requirement within Google SecOps as efficiently as a parser extension.
• D. Incorrect. Modifying raw logs via a Cloud Function is a brittle approach that can alter the original log integrity. Appending data to the user-agent string is a workaround that doesn't utilize the structured UDM schema properly and could cause further parsing issues.

Correct answers: A, C — VPC Flow Logs; Cloud Storage Data Access Logs

• A. VPC Flow Logs provide critical network-level visibility into outbound connections and traffic patterns. They allow security teams to detect large data transfers to external IP addresses, unusual traffic spikes, or connections to known malicious domains, which are primary indicators of network-based exfiltration.
• B. Cloud Audit Logs - Admin Activity track configuration and metadata changes (e.g., modifying firewall rules or IAM policies). While essential for understanding how an environment was compromised or weakened, they do not record the actual movement or access of data itself, making them less direct than Flow or Data Access logs for exfiltration detection.
• C. Cloud Storage Data Access Logs (specifically object-level read/write operations) are essential because many exfiltration events involve reading or exporting sensitive objects from Cloud Storage. These logs provide granular visibility into who is accessing specific files, allowing for the detection of mass downloads or access by unauthorized principals.
• D. Compute Engine Serial Console Logs are primarily used for troubleshooting boot issues or interactive console access. They do not contain information regarding network traffic or data access patterns required to detect data exfiltration.
• E. Cloud KMS Admin Logs track administrative actions like key creation or rotation. While KMS Data Access logs might show decryption activity (usage), Admin logs do not provide insights into the movement of data out of the environment.

Correct answers: A, B, C — Check the forwarder's internal log file (e.g., `syslog` or docker logs) for authentication or connection errors.; Verify that the API credentials (OAuth/Service Account) used by the forwarder have not expired or been revoked.; Ensure the forwarder VM has sufficient disk space, as a full disk can halt log processing.

• A. Checking the forwarder's internal logs is a primary troubleshooting step. Whether the forwarder is running as a system service or within a Docker container, these logs will provide specific error messages regarding authentication failures, connectivity timeouts, or parsing issues that prevent log transmission.
• B. The Google SecOps Forwarder relies on API credentials (typically a Service Account) to authenticate with Google Cloud. If these credentials have expired, been deleted, or had their permissions revoked, the forwarder will fail to connect and transmit logs.
• C. Insufficient disk space on the host VM is a common cause for service failure. The forwarder often uses disk space for local buffering and writing internal logs; if the disk is full, the process may hang or stop functioning entirely.
• D. Recompiling the forwarder binary is not a standard or recommended troubleshooting step. Google provides pre-built, verified binaries and Docker images; operational issues are typically resolved through configuration, connectivity, or resource management.
• E. Ingestion labels control how data is parsed once it reaches Google SecOps. Changing a label might resolve parsing issues, but it will not address a situation where the forwarder has stopped sending logs to the cloud altogether.
• F. Restarting a Google Cloud project is not a valid administrative action for troubleshooting a forwarder. API quotas are managed in the Cloud Console and are not 'refreshed' by a project-level restart.

Correct answers: A, B — Asset and User context from integrated identity providers (e.g., Google Workspace, Active Directory).; Threat intelligence context (e.g., VirusTotal, GTI) for domains, IPs, and file hashes.

• A. Correct. Google SecOps automatically enriches UDM events with asset and user context derived from ingested identity sources like Google Workspace and Active Directory. This allows hunters to see the associated user identity and device details directly within the event context.
• B. Correct. Threat intelligence context, specifically from Google Threat Intelligence (GTI) and VirusTotal, is automatically applied to UDM events for indicators like domains, IP addresses, and file hashes, providing immediate reputation and risk assessment.
• C. Incorrect. Full packet capture (PCAP) data is a deep forensic resource that is not automatically applied as a default enrichment to UDM events in Google SecOps.
• D. Incorrect. Memory dumps are heavy forensic artifacts collected during an investigation; they are not part of the standard, automatic contextual enrichment for UDM events.
• E. Incorrect. Google SecOps focuses on telemetry, asset, and threat intel context. Static source code analysis of executables is not a default automatic enrichment applied to events.

Correct answer: B — Prioritize GTI alerts in Google SecOps if the targeted asset is part of an active SCC Toxic Combination.

• A. While this describes a proactive threat hunting strategy, it is primarily a manual, point-in-time process. Furthermore, hunting for 'known' TTPs is less effective for identifying 'new' attack patterns in real-time compared to an integrated prioritization workflow.
• B. This is the most effective operational combination for real-time detection. By correlating high-risk exposure data from SCC (Toxic Combinations) with live threat actor signals from GTI within Google SecOps, security teams can automatically prioritize alerts on assets that are both actively targeted and highly susceptible to breach, allowing for the immediate identification of critical attack patterns.
• C. GTI indicators (IOCs/TTPs) are used for detection and intelligence context, not for patching. SCC identifies vulnerabilities, but remediation is a separate IT operations process; SCC is not a patch management system.
• D. Toxic Combinations in SCC are derived from the Cloud Security Graph, which analyzes actual resource configurations, IAM policies, and vulnerabilities within your environment. They are not generated from external GTI dark web intelligence.
• E. GTI and SCC Toxic Combinations serve distinct purposes: GTI provides intelligence on external threats, while SCC identifies internal misconfigurations and exposure paths. They are designed to be complementary, and GTI does not function as a vulnerability scanner.

Correct answer: B — SecOps uses Identity Correlation to merge the aliases into a single entity profile, aggregating the risk score across all associated identifiers.

• A. Google SecOps does not keep isolated or fragmented risk scores for each alias when identity correlation is available. Requiring manual addition would be inefficient and would hinder real-time anomaly detection.
• B. Google SecOps utilizes Identity Correlation to map various identifiers (emails, machine names, employee IDs) across different namespaces to a single entity profile. This unified profile allows the platform to aggregate signals and behavior from all aliases into one Entity Risk Score, providing a comprehensive view of the user's activity and improving the accuracy of threat detection.
• C. Limiting scoring to only a primary email address would ignore telemetry tied to other known identifiers, potentially missing malicious activity. The platform correlates all identities to preserve full behavioral context.
• D. Entity Risk Scores in Google SecOps are dynamic and calculated based on observed activity, UDM events, and threat signals. A static score would fail to support effective UEBA (User and Entity Behavior Analytics) or anomaly detection.

Correct answers: A, B, C — Modifications to /etc/crontab or user crontabs.; Additions of new SSH keys to ~/.ssh/authorized_keys for local users.; Changes to the Windows Registry Run or RunOnce keys.

• A. Modifications to /etc/crontab or user crontabs are a common Linux persistence mechanism. Attackers use cron jobs to schedule recurring execution of malicious scripts or commands to maintain access even after reboots.
• B. Adding SSH public keys to ~/.ssh/authorized_keys is a well-known method to maintain persistent, passwordless access to Linux systems. Monitoring centralized logs for file integrity changes or shell commands modifying these files is key to identifying unauthorized access points.
• C. The Windows Registry Run and RunOnce keys are classic persistence mechanisms used to launch malware or scripts automatically at logon or startup. Querying for registry modifications in these specific keys is a fundamental part of threat hunting for persistence.
• D. While creating systemd service files is a valid persistence method on Linux (allowing malicious services to run at startup), when restricted to three choices, the combination of Cron, SSH keys, and Windows Run keys typically represents the most common and broadly queried artifacts across diverse environments.
• E. A high volume of outbound traffic on port 443 typically indicates data exfiltration or Command and Control (C2) communication. While suspicious, it is not a direct artifact of how an attacker establishes persistence on a host.
• F. Failed login attempts in /var/log/auth.log are indicative of brute force attacks or unauthorized access attempts. These are associated with the Initial Access or Credential Access stages of an attack, rather than the Persistence stage.

Correct answers: A, B — Regex searches in Logs Explorer are case-sensitive by default unless specified otherwise.; You use the =~ operator to perform a regular expression match in the Logs Explorer query builder.

• A. Regular expression matches in the Logging Query Language (LQL) are case-sensitive by default. To perform a case-insensitive match, you must explicitly use the (?i) prefix within the regex string.
• B. In Logs Explorer (using LQL), the =~ operator is specifically used to perform a regular expression match, while !~ is used to filter for entries that do not match the regex pattern.
• C. This is incorrect. Google Cloud Logs Explorer uses the RE2 regular expression syntax. While RE2 is similar to PCRE, it excludes certain features like backreferences and lookahead to ensure linear-time performance and prevent resource exhaustion attacks (catastrophic backtracking).
• D. Regular expression matching is computationally more expensive and slower than simple substring matching. For broad searches, using the simple string operator (:) is more efficient and cost-effective.
• E. Logs Explorer is primarily for searching and filtering. While you can use regex to filter logs, creating or extracting new fields for visualization is typically done via Log Analytics (using SQL) or by defining Log-based Metrics.

Correct answer: A — Define a 10-minute window in the match section and use a count condition greater than 1000 in the condition section.

• A. Correct. In YARA-L, multi-event correlation requires a match section to group events by a common attribute (e.g., internal IP) over a specific duration (e.g., 10m). The condition section is then used to specify logic thresholds, such as checking if the count of matched events exceeds 1000.
• B. Incorrect. YARA-L is a declarative language and does not support procedural constructs like for loops to iterate over events.
• C. Incorrect. The max_alerts parameter is used to throttle the number of alerts generated by a rule over a period of time; it is not a thresholding mechanism for the event count logic itself.
• D. Incorrect. There is no time.window() function within the events section of YARA-L. Time correlation windows are explicitly defined in the match section using the 'over' keyword.

Correct answer: A — Use a 24-hour sliding window in the match section, grouping by source IP, and count distinct target users in the condition section.

• A. Correct. In YARA-L, a sliding window (up to 48 hours) is defined in the match section to correlate events over time. Grouping by source IP and using the condition section to verify if the number of distinct target users exceeds a threshold is the standard method for detecting a password spraying attack originating from a single source.
• B. Incorrect. Creating 24 separate rules is highly inefficient and fails to correlate events that span across the artificial hourly boundaries. YARA-L is designed to handle long-duration correlation within a single rule using the match section.
• C. Incorrect. The outcome section is used to produce additional data or risk scores for the alert, but the core logic for triggering based on time-windowed aggregations must be handled in the match and condition sections. Furthermore, a simple sum of failures might miss the 'spray' aspect if it doesn't account for unique target users.
• D. Incorrect. Windows Event ID 4624 represents a successful logon, whereas password spraying is detected via failed attempts (typically Event ID 4625). Additionally, a 1-minute window is far too short to capture a 'low and slow' attack designed to evade rapid-fire detection.

Correct answer: A — Configure Rule Exclusions in the curated detection settings using a Reference List containing the subnet.

• A. Google SecOps supports excluding specific entities or scopes from curated detections via Rule Exclusions. Using a Reference List is the standard method to maintain an exclusion list (like an administrative subnet) without editing the underlying locked YARA-L code. This preserves the vendor-managed content and ensures the rule continues to receive automatic updates from Google.
• B. Cloning a curated detection creates a custom rule that no longer receives automatic updates from Google. Deleting the original curated rule is not recommended for managing exceptions and violates the requirement of utilizing the curated detections as provided.
• C. Blocking logs at the firewall prevents telemetry from reaching Google SecOps entirely. While it would stop the alerts, it also eliminates visibility for forensic searching and compliance, creating a significant security blind spot.
• D. Changing the severity to 'INFO' is a global setting for the rule and does not scope the exclusion to a specific subnet. It would also still generate detections, just with a lower severity, rather than suppressing alerts for a specific administrative zone.

Correct answer: B — Upload the IPs to a Reference List (or multiple lists if limits apply) and use the `in %list_name` operator in a YARA-L rule for Retrohunt.

• A. Pasting a massive number of IPs directly into a YARA-L rule with OR operators is highly inefficient. This approach will exceed the rule's size and complexity limits, leading to compilation errors or system timeouts during execution.
• B. Reference Lists are specifically designed to handle large sets of indicators (IOCs) efficiently in Google SecOps. Using the `in %list_name` syntax in a YARA-L rule allows for scalable matching against historical telemetry via Retrohunt. This method leverages Chronicle's optimized list handling capabilities rather than overloading rule logic.
• C. Querying the Chronicle Search API 2 million times sequentially would be extremely slow and operationally impractical. This method would likely hit API rate limits, cause unnecessary strain on the system, and take an unreasonable amount of time to complete.
• D. Google SecOps is built for planet-scale data analysis. It is not restricted to searching only 1,000 indicators. While very large feeds must be managed correctly using features like Reference Lists, historical searching for millions of IOCs is a supported use case.

Correct answer: A — Use the count() function in the match section to only trigger the alert if the number of failed logins exceeds a threshold that is significantly higher than the service account's normal baseline.

• A. Correct. Using the count() function within the match section allows you to measure how many failed logins occur within a specific time window. By setting this threshold significantly higher than the service account's normal baseline, you can effectively baseline expected behavior and reduce false positives while still detecting anomalous spikes.
• B. Incorrect. The max() function in the outcome section is used for aggregating data or providing additional context (like the maximum value of a specific field) to the alert. It cannot be used to 'delete' alerts or filter out detections based on a username.
• C. Incorrect. The math.abs() function returns the absolute value of a number and is not used for ignoring events or baselining authentication behavior. Furthermore, thresholding logic is typically implemented in the match and outcome sections rather than the events section.
• D. Incorrect. Statistical functions are a primary tool in YARA-L for summarizing behavior and thresholding detections to reduce noise. While reference lists (exception lists) are another valid approach, they are not the only way to handle false positives.

Correct answer: C — Modify the rule to only alert if the HTTP request URL path matches the specific known malicious payload path, rather than just alerting on the IP address.

• A. Whitelisting the IP address is too broad and creates a blind spot. While it would stop the immediate noise, it prevents the rule from detecting any future malicious activity that might originate from that same IP if it is reused for threat delivery.
• B. Disabling the entire Threat Intel feed is not a surgical tuning method. It would remove coverage for many other legitimate indicators, leaving the organization exposed to other threats and significantly weakening the overall security posture.
• C. This is the most precise tuning method. By incorporating the specific URL path into the YARA-L rule, you can distinguish between benign traffic to the CDN and the specific malicious payload. This reduces false positives while maintaining visibility into the actual threat.
• D. Applying business-hours logic is an arbitrary filter that does not address whether traffic is malicious. It would cause the rule to miss potential threats during business hours and still alert on benign traffic outside of those hours.

Correct answer: A — Escalation involves transferring a case to a higher tier of expertise or authority, whereas reassignment transfers a case laterally to a peer.

• A. Escalation involves transferring a case to a higher level of expertise, authority, or priority (e.g., moving from Tier 1 to Tier 2) when complex analysis or specific approvals are needed. Reassignment typically refers to the lateral transfer of a case to a peer or another analyst at the same level, often for workload balancing, shift handovers, or specific subject matter specialization.
• B. Neither escalation nor reassignment inherently closes a case. Both actions are routing mechanisms designed to move the investigation forward to another party. Closure only occurs once the incident is fully resolved or determined to be a false positive.
• C. The distinction between escalation and reassignment is not based on case classification (true/false positive). Both actions are used during active investigations to ensure the right personnel are handling the event, regardless of its initial categorization.
• D. While escalation steps are frequently defined within a SOAR playbook for standardized response, it is not a technical requirement. Similarly, modern SOC tools allow for both automated (e.g., round-robin) and manual reassignment.

Correct answer: A — Make the 'Accessed Tables' custom field mandatory before the case stage can be changed from 'Investigation' to 'Escalated'.

• A. Correct. Implementing field validation rules within the case management system (e.g., Google Chronicle SOAR) is the most effective way to enforce documentation requirements. Making the 'Accessed Tables' custom field mandatory before changing the case stage to 'Escalated' ensures that Tier 1 analysts provide necessary context before Tier 2 receives the case, preventing incomplete escalations and ensuring data quality at the point of handoff.
• B. Incorrect. Weekly email reminders are a soft administrative control that depends on analyst behavior rather than technical enforcement. They do not reliably ensure data quality at the moment the case is being updated and do not prevent the escalation of incomplete cases.
• C. Incorrect. Automatically closing cases is an arbitrary and risky response that could cause valid security incidents to be lost or prematurely terminated. It fails to address the root issue of documentation and compromises the organization's security posture by potentially ignoring real threats.
• D. Incorrect. Requiring Tier 2 analysts to do the missing work defeats the purpose of tiered escalation and significantly decreases operational efficiency. The case management lifecycle should be designed to ensure the original analyst captures mandatory context before escalation to allow specialized tiers to focus on high-level analysis.

Correct answer: A — Create a mandatory boolean custom field named 'Malware Eradicated' that must be set to 'True' before the case status can be changed to 'Closed'.

• A. Correct. Mandatory custom fields are a standard technical control in case management workflows. By requiring a specific boolean field to be set to 'True' before allowing a status transition to 'Closed', you ensure the analyst explicitly confirms that the eradication stage is complete.
• B. Incorrect. Free-text notes are unstructured and cannot be used by the system to enforce workflow logic or prevent an analyst from closing a case. This method lacks technical enforcement and is prone to human error.
• C. Incorrect. Relying solely on an EDR signal for automatic closure is risky. A single quarantine report may not account for all affected endpoints or the full scope of the incident. It also bypasses the analyst's required verification step.
• D. Incorrect. This approach introduces significant operational friction and administrative overhead. It does not use the system's logic to enforce process quality; instead, it creates a bottleneck by requiring management intervention for every case closure.

Correct answer: B — Insider threat alerts often rely on behavioral analytics, which inherently carry a higher risk of false positives.

• A. Modern Identity Providers (IdPs) such as Google Workspace, Okta, and Microsoft Entra ID provide robust APIs that allow for programmatic account suspension and management. The decision to avoid automation is based on operational risk management, not a lack of technical capability.
• B. Insider threat detection typically leverages User and Entity Behavior Analytics (UEBA) to identify deviations from normal patterns. These systems are prone to false positives because legitimate but unusual business activities (such as an executive preparing for a merger) can appear anomalous. Fully automating account suspension in this context risks significant, unintended business disruption for high-value users.
• C. While GDPR includes provisions regarding automated individual decision-making and profiling (Article 22), automating a security containment action like account suspension is not an inherent violation. Security operations are typically justified under 'legitimate interests' or 'contractual necessity' to protect data, though human-in-the-loop is preferred for business continuity.
• D. SOAR (Security Orchestration, Automation, and Response) platforms are specifically built to integrate with Identity and Access Management (IAM) systems. Integration for the purpose of disabling accounts or revoking tokens is a standard use case for SOAR technologies.

Correct answer: B — Add a conditional branch in the playbook that checks for 'PII' tags or classifications, and only triggers the email integration to Legal if the condition is met.

• A. Sending a notification for every incident creates unnecessary noise and alert fatigue for the legal department. It fails to meet the specific requirement of conditional notification and places the burden of filtering on the recipient.
• B. This is the most efficient approach as it utilizes the automation capabilities of a SOAR platform. A conditional branch evaluates the incident context (such as metadata, tags, or DLP classifications) and only triggers the notification action when the PII condition is met, ensuring the legal department only receives relevant alerts.
• C. Manual monitoring of a SIEM dashboard by the legal department is inefficient and outside their core responsibilities. It does not provide a proactive notification mechanism and relies on human intervention rather than automated playbook logic.
• D. Alert parsers are meant for data normalization and ingestion logic, not for notification routing. Hardcoding email addresses and notification logic into a parser is inflexible, difficult to maintain, and does not provide the sophisticated conditional branching required for this scenario.

Correct answer: B — Modify the playbook to aggregate low-severity alerts and send a single daily summary report instead of real-time notifications.

• A. Muting the Slack channel permanently eliminates visibility into these events. While it stops the pings, it creates a blind spot where analysts might miss important trends, patterns, or escalations that require attention.
• B. Aggregating low-severity, high-frequency alerts into a summary report (e.g., daily or hourly) is a standard playbook optimization. This reduces noise and real-time interruptions, allowing analysts to focus on critical tasks while still maintaining situational awareness through periodic reviews.
• C. Escalating low-severity alerts to Priority 1 is counterproductive. It would exacerbate alert fatigue by artificially inflating the importance of routine events, potentially causing analysts to overlook truly critical incidents amidst the noise.
• D. Changing the notification sound is a superficial user-interface change that does not address the underlying issue of high alert volume. The analysts are still being interrupted by the same frequency of messages, which is the root cause of the fatigue.

Correct answer: A — Take a snapshot of the persistent disk, create a new disk from the snapshot, and attach it to an isolated forensic VM in read-only mode.

• A. Taking a snapshot is the standard, forensically sound method in Google Cloud to capture the state of a persistent disk without modifying the source. Creating a new disk from that snapshot and attaching it to a dedicated forensic instance in read-only mode ensures that the original data is preserved, the chain of custody is maintained within the cloud environment, and the analysis environment is isolated from the compromised host.
• B. While stopping a VM is a common containment step, exporting the disk and downloading it to a local workstation introduces unnecessary data handling risks and complicates the chain of custody. Forensic analysis should ideally be performed within an isolated VPC in Google Cloud to maintain the integrity and security of the evidence.
• C. Running commands like 'dd' via SSH on the compromised VM is not forensically sound because it interacts directly with the infected operating system. This process modifies metadata (such as access times and shell logs) and relies on the integrity of a potentially tampered-with kernel or utility, which could hide malicious activity.
• D. Detaching the source disk from a running VM can lead to data loss or corruption if not done properly and does not provide a copy for analysis. Attaching the original disk directly to another workstation risks accidental modification; the best practice is always to work on a copy (snapshot) rather than the original evidence.

Correct answer: A — principal.ip = "malicious_ip" OR target.ip = "malicious_ip"

• A. Correct. In the UDM schema, `principal.ip` represents the source of the activity and `target.ip` represents the destination. Searching for the malicious IP in either field captures both inbound and outbound communication involving internal assets. This is the standard and most comprehensive query for identifying communication with a known IP across all event types.
• B. Incorrect. The `about` field is intended for entities that are referenced in the log but are not the primary actors (principal) or the object being acted upon (target). Additionally, filtering solely for `NETWORK_CONNECTION` may miss other relevant activity such as DNS queries (`NETWORK_DNS`) or proxy logs where the IP might be captured differently.
• C. Incorrect. The `network.http.request` field is used to store the specific request string (e.g., the URL path or method) in an HTTP event. It is not used to store the IP address of the connection endpoint.
• D. Incorrect. This query restricts the search to events where a security tool took a 'BLOCK' action. When investigating a potential incident, it is critical to identify all communications, especially those that were not blocked, as those represent the actual successful sessions that could lead to a compromise.

Correct answer: B — Use the built-in Report Scheduler feature to automatically generate and email the report as a PDF or CSV.

• A. Configuring a cron job on the underlying SOAR server to export the database is not a recommended or supported method. This approach bypasses application controls, poses security risks, and is far more complex than using the platform's native reporting tools.
• B. The native Report Scheduler feature in Google SecOps SOAR is designed specifically for this purpose. It allows engineers to automate the generation of reports on a recurring basis (e.g., weekly) and distribute them to stakeholders via email in formats like PDF or CSV.
• C. While writing a custom Python script using the SOAR API and hosting it on Google Cloud Functions is technically feasible for highly complex integrations, it is not the preferred or simplest method when a native scheduling feature exists. This approach introduces unnecessary maintenance overhead.
• D. Granting external stakeholders read-only accounts for manual login does not satisfy the requirement for automation. It also increases access-management complexity and risk, making it an inefficient solution for regular report delivery.

Correct answers: A, D — Use Google SecOps SIEM for Report 1.; Use Google SecOps SOAR for Report 2.

• A. Correct. Google SecOps SIEM (formerly Chronicle SIEM) is designed to ingest and analyze massive amounts of security telemetry, such as DNS logs. It is the appropriate tool for querying raw event volumes and historical data over long periods (like a month) to identify trends or specific hits against threat intelligence lists.
• B. Incorrect. Google SecOps SOAR is primarily utilized for orchestration, automation, and incident case management. It does not store or process the raw log volume required to report on every DNS query; it focuses on high-fidelity alerts and incident response workflows.
• C. Incorrect. While the SIEM detects events, it is not optimized for tracking the manual workflow duration of analyst containment activities. Containment metrics are operational data points recorded during the incident response lifecycle within a case management system.
• D. Correct. Google SecOps SOAR is the primary tool for tracking the incident response lifecycle. It records timestamps for alert ingestion, analyst assignment, and case closure, making it the standard tool for calculating operational metrics like Mean Time to Contain (MTTC).
• E. Incorrect. Google Cloud Armor provides DDoS protection and Web Application Firewall (WAF) capabilities for Google Cloud workloads. It is not an enterprise-wide logging and reporting platform for general DNS query analytics.
• F. Incorrect. The Google Workspace Admin Console is used for managing users and settings within Google Workspace. It does not provide the Security Operations metrics or the broad infrastructure log analysis needed for these reports.

Correct answers: A, B — Review the `logging.googleapis.com/byte_count` metric to see if logs are being generated at the source.; Query Cloud Logging for `severity=ERROR` and `resource.type="logging_sink"` to identify sink execution failures.

• A. Reviewing ingestion metrics like `byte_count` or `log_entry_count` is a critical first step to determine if logs are actually reaching Cloud Logging. If these metrics show no data, the problem is upstream (at the source or log generation level) rather than with the sink or BigQuery.
• B. When a Log Router sink fails to deliver data to its destination, Cloud Logging records these failures as log entries. These error logs use the resource type `logging_sink`. Querying for these errors will provide the specific reason for the failure, such as 'Permission Denied' or 'Quota Exceeded'.
• C. While IAM misconfiguration is a common cause of sink failures, manually auditing permissions is a secondary step. Checking the sink's error logs (Option B) is a more efficient first step because it will explicitly report a permission error if one exists.
• D. Connectivity Tests are designed to troubleshoot VPC-based network paths. Routing logs from the Log Router to BigQuery is a managed service operation that does not use the standard VPC network paths evaluated by this tool.
• E. Restarting the Cloud Logging agent is intrusive and narrow in scope. Security-relevant logs include Cloud Audit Logs and other platform logs that do not rely on the Compute Engine agent.

Correct answer: B — Log-based alerts notify immediately upon a specific log entry appearing, while log-based metrics are better for tracking trends and alerting on thresholds over time.

• A. Incorrect. This statement reverses the roles of the two features. Log-based metrics are typically used for tracking trends over time by converting log data into numeric time-series data, while log-based alerts are used for immediate notification when a specific event occurs.
• B. Correct. Log-based alerts are designed to trigger a notification immediately whenever a log entry matches a specific filter. Log-based metrics extract data from logs to create time-series metrics, which are ideal for long-term trend analysis and setting alerts based on performance thresholds over a duration.
• C. Incorrect. Log-based metrics create time-series data that can be visualized directly in Cloud Monitoring dashboards. Log-based alerts are a mechanism for notification rather than visualization.
• D. Incorrect. Neither log-based metrics nor log-based alerts require exporting data to BigQuery. Both are native features of the Google Cloud Observability suite (formerly Stackdriver) and process logs within Cloud Logging.