Google GCP-SOE-B 問題集

質問 1：
You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?
A. Security Command Center Premium (SCCP) findings
B. Cloud IDS logs
C. VPC Flow Logs
D. Cloud Audit Logs
正解：C

質問 2：
Your company's analyst team uses a playbook to make necessary changes to external systems that are integrated with the Google Security Operations (SecOps) platform. You need to automate the task to run once every day at a specific time. You want your solution to minimize maintenance overhead. What should you do?
A. Create a Cron Scheduled Connector for this use case Configure a playbook trigger to match the cases created by the connector that runs the playbook with the relevant actions.
B. Use a VM to host a script that runs a playbook via an API call.
C. Write a custom Google SecOps SOAR job in the IDE using the code from the existing playbook actions.
D. Create a Google SecOps SOAR request and a playbook trigger to match the request from the user to start the playbook with the relevant actions.
正解：A

質問 3：
You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?
A. net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
B. not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
C. not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
D. net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
正解：C

質問 4：
A workload is created and terminated within five minutes and later linked to cryptomining activity.
What MOST complicates the investigation?
A. Global IP addressing
B. Encryption at rest
C. Short-lived (ephemeral) resources
D. High availability architecture
正解：C

質問 5：
A phishing campaign successfully convinces users to grant OAuth permissions to a malicious third-party application. Which control failure MOST likely allowed this?
A. Missing antivirus signatures
B. Missing email sandboxing
C. Weak endpoint protection
D. Lack of monitoring and restriction on OAuth consent grants
正解：D

質問 6：
You work for an organization that operates an ecommerce platform. You have identified a remote shell on your company's web host. The existing incident response playbook is outdated and lacks specific procedures for handling this attack. You want to create a new, functional playbook that can be deployed as soon as possible by junior analysts. You plan to use available tools in Google Security Operations (SecOps) to streamline the playbook creation process. What should you do?
A. Use Gemini to generate a playbook based on a template from a standard incident response plan and implement automated scripts to filter network traffic based on known malicious IP addresses.
B. Add instruction actions to the existing incident response playbook that include updated procedures with steps that should be completed. Have a senior analyst build out the playbook to include those new procedures.
C. Use the playbook creation feature in Gemini, and enter details about the intended objectives. Add the necessary customizations for your environment, and test the generated playbook against a simulated remote shell alert.
D. Create a new custom playbook based on industry best practices, and work with an offensive security team to test the playbook against a simulated remote shell alert.
正解：C

質問 7：
You need to ingest audit logs from your organization's entire Google Cloud environment into Google Security Operations (SecOps). This process must include Cloud NAT logs for workloads within a designated folder. You need to configure this ingestion while minimizing integration complexity. You have already enabled Google Cloud data ingestion into Google SecOps. What should you do next?
A. Create a custom filter to export the folder-level Cloud NAT logs.
B. Configure an aggregated log sink at the organization level, and route the Cloud NAT logs to a Cloud Storage bucket. Configure the Cloud Storage connector for Google SecOps.
C. Create a custom filter to export the project-level Cloud NAT logs for each project in the environment folder.
D. Configure an aggregated log sink at the folder level, and route the Cloud NAT logs to Pub/Sub. Enable the Pub/Sub connector for Google SecOps.
正解：D

質問 8：
You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?
A. Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.
B. Set a retention period for the BigQuery export.
C. Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.
D. Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.
正解：A

質問 9：
Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?
A. Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
B. Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.
C. In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
D. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.
正解：D