Google Security Operations Engineer (Beta) Sample Questions:

1. Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?

A) Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
B) Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.
C) In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
D) Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.

2. You are responsible for evaluating the level of effort required to integrate a new third-party endpoint detection tool with Google Security Operations (SecOps). Your organization's leadership wants to minimize customization for the new tool for faster deployment. You need to verify that the Google SecOps SOAR and SIEM support the expected workflows for the new third-party tool.
You must recommend a tool to your leadership team as quickly as possible. What should you do? (Choose two.)

A) Develop a custom integration that uses Python scripts and Cloud Run functions to forward logs and orchestrate actions between the third-party tool and Google SecOps.
B) Review the architecture of the tool to identify the cloud provider that hosts the tool.
C) Identify the tool in the Google SecOps Marketplace and verify support for the necessary actions in the workflow.
D) Review the documentation to identify if default parsers exist for the tool, and determine whether the logs are supported and able to be ingested.
E) Configure a Pub/Sub topic to ingest raw logs from the third-party tool and build custom YARA-L rules in Google SecOps to extract relevant security events.

3. Your company's SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall installed and configured with credentials. You want to use the integration to trigger firewall rule changes directly from the Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve the requested changes prior to deployment. How should you implement the workflow for analysts to trigger on demand?

A) Create an account for the system administrator in your Google SecOps instance to allow the system administrator to make the changes from Google SecOps directly. Add an escalation step to enable the analyst to assign the case to the system administrator.
B) Create a playbook where the firewall rule change is a manual step, allowing the analyst to edit the firewall rule as a pending action. Have the analyst email the system administrator with the change. Once approved, the analyst lets the playbook continue.
C) Create a request in the Google SecOps SOAR settings that includes a field for the firewall rule.Create a playbook that is triggered by this request. Configure the playbook step that makes the firewall rule change to send an approval request from the system administrator. The approval request must include the parameter being changed.
D) Create an email template for the analyst to get approval for the change from the system administrator. Have the analyst fill out the needed fields, and send the email for approval. Once approved, use a manual action to make the change to the firewall rule from any open case.

4. You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?

A) Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.
B) Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
C) Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
D) Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.

5. You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

A) Pass the response back to the SIEM.
B) Verify that the response is accurate by manually checking the URL in VirusTotal
C) Create a widget that translates the JSON output to a severity score.
D) Use a conditional statement to determine whether to treat the URL as suspicious or benign.
E) Use the number of detections from the response JSON in a conditional statement to set the severity.

Solutions: