Get real GCP-SOE-B exam questions for better preparation

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

• A. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
• B. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
• C. Customize the Case Name format to include the DLP event type.
• D. Customize the Close Case dialog and add the five DLP event types as root cause options.

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

• A. Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
• B. Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.
• C. Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
• D. Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.

After resolving a confirmed security incident in Google Cloud, what action provides the GREATEST long-term security improvement?

• A. Closing all related alerts
• B. Updating detections, playbooks, and IAM controls based on lessons learned
• C. Increasing log retention
• D. Adding more analysts

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?

• A. Ingest logs from Windows PowerShell.
• B. Ingest logs from Windows Sysmon.
• C. Ingest logs from Microsoft Entra I
• D. Ingest logs from Windows Procmon.

During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?

• A. Analyze IAM recommender insights and Security Command Center (SCC) findings associated with the external identity.
• B. Use Policy Analyzer to identity the resources that are accessible by the external identity. Examine the logs related to these resources in the centralized Cloud Logging bucket and the BigQuery dataset.
• C. Analyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential login events for the external identity.
• D. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter for logs for where the principal email matches the external identity.