Google Security Operations Engineer (Beta) Sample Questions:

1. You are responsible for selecting and prioritizing potential sources of data to integrate with Google Security Operations (SecOps). Your company has recently started using several Google Cloud services to increase security in its Google Cloud organization. You need to determine which logs should be ingested into Google SecOps to reduce the effort required to write detections. What should you do?

A) Integrate Security Command Center (SCC) into Google SecOps to ingest logs originating from the Google Cloud services.
B) Ingest Google Cloud Armor logs by using Cloud Logging.
C) Use Google Threat Intelligence to gain insight about threat group behavior and support threat hunting activities.
D) Deploy a Bindplane agent to ingest event logs from Compute Engine VMs that provide endpoint visibility.

2. You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?

A) Modify the default parser and include a default time zone.
B) Create a parser extension to correct the time zone.
C) Create a custom parser to correct the time zone.
D) Modify the UI settings to correct the time zone.

3. You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?

A) Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.
B) Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated reference list of all APT41-related IP addresses.
C) Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.
D) Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.

4. You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes:
- A SHA256 hash for a malicious DLL
- A known command and control (C2) domain
- A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

A) Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.
B) Write a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
C) Use Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
D) Create a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.

5. A phishing campaign successfully convinces users to grant OAuth permissions to a malicious third-party application. Which control failure MOST likely allowed this?

A) Missing email sandboxing
B) Weak endpoint protection
C) Missing antivirus signatures
D) Lack of monitoring and restriction on OAuth consent grants

Solutions: