Google Security Operations Engineer (Beta) Sample Questions:

1. Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?

A) Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
B) Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
C) Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
D) Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

2. A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?

A) High availability architecture
B) Global IP addressing
C) Encryption at rest
D) Short-lived (ephemeral) resources

3. Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?

A) Configure direct ingestion from your Google Cloud organization.
B) Configure and deploy a Bindplane collection agent.
C) Configure a third-party API feed in Google SecOps.
D) Configure and deploy a Google SecOps forwarder.

4. You are threat hunting for an advanced threat group known for targeted, novel attacks by deploying campaign-specific infrastructure. You want to develop detections based on the threat group's behaviors so you can effectively detect whether the threat group has attacked your organization. What should you do?

A) Identify exposed technologies and products used by your organization, and develop detections to search for signs of exploitation.
B) Find intelligence reports in Google Threat Intelligence that relate to the threat actor, identify their behavior in previous campaigns, and use the past behavior to design detections in Google Security Operations (SecOps).
C) Search for the threat actor in Google Threat Intelligence, export the IOCs associated with the threat actor into a Google Security Operations (SecOps) list, and develop detections that reference this list.
D) Search for the threat actor in Google Threat Intelligence, review the threat actor's tactics, techniques, and procedures (TTPs), and design detections based on the TTPs in Google Security Operations (SecOps).

5. You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

A) Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.
B) Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable
C) Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
D) Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.

Solutions: