Google GCP-SOE-B 시험 개요:

Google GCP-SOE-B 시험 요강 주제:

최신 Google Cloud Certified GCP-SOE-B 무료샘플문제

1. You received an alert from Container Threat Detection that an added binary has been executed in a business critical workload. You need to investigate and respond to this incident. What should you do? (Choose two.)

A) Keep the cluster and pod running, and investigate the behavior to determine whether the activity is malicious.
B) Silence the alert in the Security Command Center (SCC) console, as the alert is a low severity finding.
C) Notify the workload owner. Follow the response playbook, and ask the threat hunting team to identify the root cause of the incident.
D) Review the finding, quarantine the cluster containing the running pod, and delete the running pod to prevent further compromise.
E) Review the finding, investigate the pod and related resources, and research the related attack and response methods.

2. You scheduled a Google Security Operations (SecOps) report to export results to a BigQuery dataset in your Google Cloud project. The report executes successfully in Google SecOps, but no data appears in the dataset. You confirmed that the dataset exists. How should you address this export failure?

A) Set a retention period for the BigQuery export.
B) Grant the Google SecOps service account the roles/iam.serviceAccountUser IAM role to itself.
C) Grant the Google SecOps service account the roles/bigquery.dataEditor IAM role on the dataset.
D) Grant the user account that scheduled the report the roles/bigquery.dataEditor IAM role on the project.

3. You need to pull security findings from SCC and import those findings as part of Google Security Operations (SecOps) SOAR actions. You need to configure the connection between SCC and Google SecOps. What should you do?

A) Install the Google Rapid Response integration from the Google SecOps Marketplace. Gather information about the findings from the appropriate server.
B) Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Grant the Google SecOps service account the appropriate IAM roles to read from this subscription.
C) Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriate IAM roles to integrate with the Google SecOps instance. Configure this integration using a generated API key scoped to the SCC API.
D) Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired finding types. Create a new Google SecOps service account in the Google Cloud project, and grant this service account the appropriate IAM roles to read from this subscription. Export the credentials from IAM and import the credentials into Google SecOps SOAR.

4. Your company uses Security Command Center (SCC) and Google Security Operations (SecOps). Last week, an attacker attempted to establish persistence by generating a key for an unused service account. You need to confirm that you are receiving alerts when keys are created for unused service accounts and that newly created keys are automatically deleted. You want to minimize the amount of manual effort required. What should you do?

A) Use the Initial Access: Dormant Service Account Key Created finding from SCC, and write this finding to a Pub/Sub topic. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.
B) Use the Initial Access: Dormant Service Account Key Created finding from SCC, and ingest this finding into Google SecOps. Create a custom action in Google SecOps SOAR that is triggered on this finding. Use the built-in IDE to build code to delete the service account key.
C) Generate a YARA-L rule in Google SecOps that detects when a service account key is created. Using the built-in IDE, create a custom action in Google SecOps SOAR that deletes the service account key.
D) Configure a Cloud Logging sink to write logs to a Pub/Sub topic that filters for the methodName: "google.iam.admin.v1.CreateServiceAccountKey" field. Create a Cloud Run function that subscribes to the Pub/Sub topic and deletes the service account key.

5. You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

A) Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.
B) Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable
C) Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
D) Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.

질문과 대답: