Free Google Professional-Security-Operations-Engineer Practice Test Questions

Question 1

You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Youneed to improve your detection coverage and reduce the false positive detection ratio as quickly as possible.What should you do?

A : Enable curated detections to identify threats.

B : Ingest data from your threat intelligence platform (TIP) into Google SecOps.

C : Develop YARA-L detection rules that focus on threat intelligence.

D : Design YARA-L detection rules based on Google SecOps Marketplace use cases.

Answer: A

Question 2

You are part of a cybersecurity team at a large multinational corporation that uses Google Security Operations (SecOps). You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches for the unknown C2s within the next 24 hours. What should you do?

A : Review Security Health Analytics (SHA) findings in Security Command Center (SCC).

B : Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.

C : Write a YARA-L rule in Google SecOps that scans historic network outbound connections against ingested threat intelligence. Run the rule in a retrohunt against the full tenant.

D : Write a YARA-L rule in Google SecOps that compares network traffic from endpoints to recent WHOIS registrations. Run the rule in a retrohunt against the full tenant.

Answer: D

Question 3

Your Google Security Operations (SecOps) case queue contains a case with IP address entities. You need to determine whether the entities are internal or external assets and ensure that internal IP address entities are marked accordingly upon ingestion into Google SecOps SOAR. What should you do?

A : Configure a feed to ingest enrichment data about the networks, and include these fields into your detection outcome.

B : Modify the connector logic to perform a secondary lookup against your CMDB and flag incoming entities as internal or external.

C : Indicate your organization's known internal CIDR ranges in the Environment Networks list in the settings.

D : Create a custom action to ping the IP address entity from your Remote Agent. If successful, the custom action designates the IP address entity as internal.

Answer: C

Question 4

You are a security operations engineer in an enterprise that uses Google Security Operations (SecOps). Youneed to improve your detection coverage and reduce the false positive detection ratio as quickly as possible.What should you do?

A : Enable curated detections to identify threats.

B : Ingest data from your threat intelligence platform (TIP) into Google SecOps.

C : Develop YARA-L detection rules that focus on threat intelligence.

D : Design YARA-L detection rules based on Google SecOps Marketplace use cases.

Answer: A

Question 5

You are managing the integration of Security Command Center (SCC) with downstream tooling. You need topull security findings from SCC and import those findings as part of Google Security Operations (SecOps)SOAR actions. You need to configure the connection between SCC and Google SecOps.

A : Install the Google Rapid Response integration from the Google SecOps Marketplace. Gatherinformation about the findings from the appropriate server.

B : Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriateIAM roles to integrate with the Google SecOps instance. Configure this integration using a generatedAPI key scoped to the SCC API.

C : Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired findingtypes. Grant the Google SecOps service account the appropriate IAM roles to read from thissubscription.

D : Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired findingtypes. Create a new Google SecOps service account in the Google Cloud project, and grant this serviceaccount the appropriate IAM roles to read from this subscription. Export the credentials from IAM andimport the credentials into Google SecOps SOAR.

Answer: B

Free Google Professional-Security-Operations-Engineer Exam Practice Questions 2026