Prepare for the Actual Google Cloud Certified GCP-SOE-B Exam Practice Materials Collection
Google Cloud Certified Certified Official Practice Test GCP-SOE-B - Aug-2026
NEW QUESTION # 40
Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps:
- Firewall logs
- Proxy logs
- DNS logs
- DHCP logs
What should you do? (Choose two.)
- A. Perform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
- B. Identify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
- C. Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days.
- D. Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.
- E. Perform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
Answer: B,C
NEW QUESTION # 41
You are responsible for developing and configuring data ingestion in Google Security Operations (SecOps) for your organization. Your organization is using a prebuilt parser to parse a complex but stable and common log source. The parser is working correctly. However, your organization now wants you to change the configuration to parse additional fields from the raw logs and map them to UDM fields. What should you do?
- A. Implement middleware to modify the underlying data structure.
- B. Apply any pending updates to the prebuilt parser.
- C. Design and develop a custom parser.
- D. Implement a parser extension on top of the prebuilt parser.
Answer: D
NEW QUESTION # 42
Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?
- A. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
- B. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
- C. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
- D. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
Answer: B
NEW QUESTION # 43
You are a senior SOC analyst in your organization. You are receiving alerts of traffic to a command and control (C2) IP address. You want to use Google Security Operations (SecOps) to investigate the IP address associated with the C2 IP address. What should you do?
- A. Use Google SecOps SOAR Search to identify the cases where the suspicious IP address exists.
- B. Use Google SecOps SIEM Search to query against the grouped ip field, and use the enriched field from the suspicious events to identify related activity.
- C. Conduct a Google SecOps SIEM Search that uses src.ip and target.ip to identify outbound and inbound traffic associated with the suspicious IP address.
- D. Use Google SecOps SOAR Search to run a playbook designed to investigate the suspicious IP address and identify related outbound and inbound traffic.
Answer: C
NEW QUESTION # 44
You have identified a new threat actor group that has several IOCs in Google Threat Intelligence. You want to use some of these IOCs in several detection rules in Google Security Operations (SecOps) to help identify suspicious activity. You want to use the most effective approach. What should you do?
- A. Add the IOCs to a new or existing reference list, and update the YARA-L logic of detection rules to include the reference list.
- B. Save the IOCs in a new collection in Google Threat Intelligence. Share this list with other members of the security team to facilitate their searches and rule creation.
- C. Configure a new data feed in Google SecOps that includes the IOCS. Update the YARA-L logic to reference the new IOCS against applicable UDM fields.
- D. Identify the detection rules that apply to the new IOCS, and update the YARA-L logic to reference the threat actor group.
Answer: A
NEW QUESTION # 45
Your Google Security Operations (SecOps) SOAR integration with Security Command Center (SCC) uses a service account that currently has read access to the findings at the organization level. Google SecOps SOAR successfully reads SCC finding data, but actions attempting to update the finding states consistently fail with a permission denied error. You need to resolve this error while following the principle of least privilege. What should you do?
- A. Grant the service account the roles/securitycenter.findingsBulkMuteEditor IAM role at the organization level.
- B. Grant the service account the roles/securitycenter.findings Editor IAM role at the organization level.
- C. Grant the service account the roles/iam.serviceAccountUser IAM role to itself.
- D. Regenerate the service account key, and update the credentials in Google SecOps SOAR.
Answer: B
NEW QUESTION # 46
Your company is adopting a multi-cloud environment. You need to configure comprehensive monitoring of threats using Google Security Operations (SecOps). You want to start identifying threats as soon as possible. What should you do?
- A. Ask Cloud Customer Care to provide a set of rules recommended by Google to monitor your company's cloud environment.
- B. Use curated detections from the Cloud Threats category to monitor your cloud environment.
- C. Use curated detections for Applied Threat Intelligence to monitor your company's cloud environment.
- D. Use Gemini to generate YARA-L rules for multi-cloud use cases.
Answer: B
NEW QUESTION # 47
Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?
- A. Revoke additional role access from Tier 1 and Tier 2 analysts.
- B. Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.
- C. Configure the Cross Environment Policy to allow users to move cases between environments. Move Tier 3 cases to an environment that only Tier 3 analysts can access.
- D. Assign the cases to a user in the Tier 3 role.
Answer: C
NEW QUESTION # 48
You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC). You want to follow the Google-recommended approach.
What should you do?
- A. Configure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a custom dashboard in SCC to visualize the data.
- B. Create a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories for IAM policy changes. When a change is detected identify the principal that made the change.
- C. Implement a Cloud Run function that is triggered by IAM policy changes within the project and sends an alert to SCC using the Security Command Center API.
- D. Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects when a specified principal calls a method against a resource.
Answer: D
NEW QUESTION # 49
Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?
- A. Use the UDM lookup feature to identify relevant process- related UDM fields and values.
- B. Run a UDM search, and review aggregations for relevant process-related UDM fields.
- C. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
- D. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.
Answer: B
NEW QUESTION # 50
Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting dat a. You need to minimize the cost of these configurations.
What should you do?
- A. Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
- B. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.
- C. Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.
- D. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
Answer: A
NEW QUESTION # 51
Your company has deployed two on-premises firewalls. You need to configure the firewalls to send logs to Google Security Operations (SecOps) using Syslog. What should you do?
- A. Set the Google SecOps URL instance as the Syslog destination.
- B. Deploy a Google Ops Agent on your on-premises environment, and set the agent as the Syslog destination.
- C. Deploy a third-party agent (e.g Bindplane, NXLog) on your on-premises environment, and set the agent as the Syslog destination.
- D. Pull the firewall logs by using a Google SecOps feed integration.
Answer: C
NEW QUESTION # 52
You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)
- A. Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
- B. Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
- C. Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
- D. Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
- E. Review the finding, investigate the pod and related resources, and research the related attack and response methods.
Answer: C,E
NEW QUESTION # 53
You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps. What should you do?
- A. Initiate a SIEM Search to query the entity.
- B. Initiate a SOAR Search to query the entity.
- C. Select the entity identifier in the Entity Highlights widget to open Entity Explorer.
- D. Select View Details for the entity in the Entity Highlights widget.
Answer: C
NEW QUESTION # 54
Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?
- A. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
- B. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
- C. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
- D. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
Answer: D
NEW QUESTION # 55
You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to ensure that cases for each customer are logically separated. How should you configure this logical separation?
- A. In Google SecOps SOAR settings, create a permissions group for each customer.
- B. In Google SecOps Playbooks, create a playbook for each customer.
- C. In Google SecOps SOAR settings, create a role for each customer.
- D. In Google SecOps SOAR settings, create a new environment for each customer.
Answer: D
NEW QUESTION # 56
You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?
- A. Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
- B. Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
- C. Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
- D. Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.
Answer: C
NEW QUESTION # 57
Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead. What should you do?
- A. Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
- B. Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.
- C. Use a VM to host a script that runs a playbook via an API call.
- D. Create a Cron Scheduled Connector for this use case Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.
Answer: D
NEW QUESTION # 58
You are reviewing the results of a UDM search in Google Security Operations (SecOps). The UDM fields shown in the default view are not relevant to your search. You want to be able to quickly view the relevant data for your analysis. What should you do?
- A. Use the columns feature to select or remove columns that are relevant to your analysis.
- B. Select the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.
- C. Download the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.
- D. Create a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.
Answer: A
NEW QUESTION # 59
You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:
- Receive a notification when data sources go silent within 15 minutes.
- Visualize ingestion throughput and parsing errors. What should you do?
- A. Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane. Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).
- B. Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.
- C. Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring. Create a Cloud Monitoring dashboard to visualize data ingestion metrics.
- D. Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.
Answer: C
NEW QUESTION # 60
You are using a Google-managed image on a Compute Engine instance in Google Cloud to run an application. You need to ingest the application's log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time required to move this data into Google SecOps. What should you do?
- A. Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.
- B. Use the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging. Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.
- C. Use the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.
- D. Create a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.
Answer: B
NEW QUESTION # 61
You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?
- A. Modify the detection rule in the SIEM to include the query results as part of the detection.
- B. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
- C. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
- D. Add an action to the playbook that runs the SIEM query and returns the results.
Answer: D
NEW QUESTION # 62
You work for a large international company that has several Compute Engine instances running in production. You need to configure monitoring and alerting for Compute Engine instances tagged with compliance-pci that have an external IP address assigned. What should you do?
- A. Create a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance-pci tag is assigned an external IP address.
- B. Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance-pci tag exists on the instances.
- C. Deploy the compute.vmExternallpAccess organization policy constraint to prevent specific projects or folders with the compliance-pci tag from creating Compute Engine instances with external IP addresses.
- D. Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance-pci tag.
Answer: B
NEW QUESTION # 63
Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?
- A. Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
- B. Use a custom parser that outputs all fields as raw JSON for detection.
- C. Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
- D. Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
Answer: D
NEW QUESTION # 64
You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?
- A. Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
- B. Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.
- C. Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.
- D. Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.
Answer: D
NEW QUESTION # 65
......
Ace Google GCP-SOE-B Certification with Actual Questions Aug 23, 2026 Updated: https://www.pass4guide.com/GCP-SOE-B-exam-guide-torrent.html