Google Security-Operations-Engineer 問題集

質問 1：
You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCs in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?
A. Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC- Score) is between 60% and 80%.
B. Configure alert grouping for the most repetitive alerts.
C. Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.
D. Implement curated detections instead of custom YARA-L rules.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 2：
You were recently hired as a SOC manager at an organization with an existing Google Security Operations (SecOps) implementation. You need to understand the current performance by calculating the mean time to respond or remediate (MTTR) for your cases. What should you do?
A. Create a multi-event detection rule to calculate the response metrics in the outcome section based on the entity graph. Create a dashboard based on these metrics.
B. Create a playbook block that can be re-used in all alert playbooks to write timestamps in the case wall after each change to the case. Write a job to calculate the case metrics.
C. Create a dashboard table widget that displays the average case handling times by analyst, case priority, and environment.
D. Use the playbooks' case stages to capture metrics for each stage change. Create a dashboard based on these metrics.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
You are using Google Security Operations (SecOps) to investigate suspicious activity linked to a specific user. You want to identify all assets the user has interacted with over the past seven days to assess potential impact. Your need to understand the user's relationships to endpoints, service accounts, and cloud resources. How should you identify user-to-asset relationships in Google SecOps?
A. Generate an ingestion report to identify sources where the user appeared in the last seven days.
B. Run a retrohunt to find rule matches triggered by the user.
C. Use the Raw Log Scan view to group events by asset ID.
D. Query for hostnames in UDM Search and filter the results by user.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Your organization has mission-critical production Compute Engine VMS that you monitor daily.
While performing a UDM search in Google Security Operations (SecOps), you discover several outbound network connections from one of the production VMs to an unfamiliar external IP address occurring over the last 48 hours. You need to use Google SecOps to quickly gather more context and assess the reputation of the external IP address. What should you do?
A. Create a new detection rule to alert on future traffic from the external IP address.
B. Search for the external IP address in the Alerts & IOCs page in Google SecOps.
C. Examine the Google SecOps Asset view details for the production VM.
D. Perform a UDM search to identify the specific user account that was logged into the production VM when the connections occurred.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You are developing a security strategy for your organization. You are planning to use Google Security Operations (SecOps) and Google Threat Intelligence (GTI). You need to enhance the detection and response across multi-cloud and on-premises systems. How should you integrate these products? (Choose two.)
A. Use Google SecOps SOAR integrations with GTI for event enrichment.
B. Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.
C. Use Google SecOps SOAR integrations with GTI for entity enrichment.
D. Ingest GTI IOCs into Google SecOps as security events.
E. Ingest on-premises and cloud security logs into Google SecOps SIEM as events.
正解：A,E
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Your Google Security Operations (SecOps) instance is generating a high volume of alerts related to an IP address that recently appeared in a threat intelligence feed. The IP address is flagged as a known command and control (C2) server by multiple vendors. The IP address appears in repeated DNS queries originating from a sandboxing system and test environment used by your malware analysis team. You want to avoid alert fatigue while preserving visibility in the event that the IOC reappears in real production telemetry. What should you do?
A. Add an exception in the detection rule to exclude matches originating from specific asset groups.
B. Add the IP address to a Google SecOps reference list, and configure the rule to suppress alerts for that list.
C. Reduce the severity score in the rule configuration when the IOC match occurs in any internal IP address range.
D. Temporarily disable the rule to avoid unnecessary alerts until the IOC expires in the threat feed.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 7：
You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?
A. Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
B. Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.
C. Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.
D. Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 8：
Your company works with an external Managed Service Provider (MSP) that requires its users to have the ability to list findings from Security Command Center (SCC) using the Google Cloud SDK. You need to configure the required access for the managed service provider while minimizing your involvement in their external user lifecycle management processes. What should you do?
A. Create a workload identity pool in a SCC project. Grant the MSP user the permission to impersonate a service account from this pool, and grant the service account the appropriate IAM role at the organization level.
B. Create a user account in your Cloud Identity instance using a subdomain indicating they are external to your organization. Grant this user account the appropriate IAM role at the organization level.
C. Create a service account in a SCC project. Grant the MSP user permission to impersonate this account. Grant this service account the appropriate IAM role at the organization level.
D. Create a workforce identity pool and federate with the identity provider (IdP) of the managed service provider. Grant users of the MSP the appropriate IAM role at the organization level.
正解：D
解説: (Topexam メンバーにのみ表示されます)