최신 Security-Operations-Engineer 무료덤프 - Google Cloud Certified - Professional Security Operations Engineer (PSOE)

문제1

You are conducting proactive threat hunting in your company's Google Cloud environment. You suspect that an attacker compromised a developer's credentials and is attempting to move laterally from a development Google Kubernetes Engine (GKE) cluster to critical production systems. You need to identify IOCs and prioritize investigative actions by using Google Cloud's security tools before analyzing raw logs in detail. What should you do next?

A. Review threat intelligence feeds within Google Security Operations (SecOps), and enrich any anomalies with context on known IOCs, attacker tactics, techniques, and procedures (TTPs), and campaigns.

B. Investigate Virtual Machine (VM) Threat Detection findings in Security Command Center (SCC).
Filter for VM Threat Detection findings to target the Compute Engine instances that serve as the nodes for the cluster, and look for malware or rootkits on the nodes.

C. Create a Google SecOps SOAR playbook that automatically isolates any GKE resources exhibiting unusual network connections to production environments and triggers an alert to the incident response team.

D. In the Security Command Center (SCC) console, apply filters for the cluster and analyze the resulting aggregated findings' timeline and details for IOCs. Examine the attack path simulations associated with attack exposure scores to prioritize subsequent actions.

정답: D

설명: (DumpTOP 회원만 볼 수 있음)

문제2

Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?

A. Configure a rule exclusion for the target.domain field.

B. Configure a rule exclusion for the network.asset.ip field.

C. Configure a rule exclusion for the principal.ip field.

D. Configure a rule exclusion for the target.ip field.

정답: B

설명: (DumpTOP 회원만 볼 수 있음)

문제3

You are investigating an alert in Google Security Operations (SecOps). You want to view previous enrichment attributes and relevant historical cases for an entity using the fewest number of steps. What should you do?

A. Select the entity identifier in the Entity Highlights widget to open Entity Explorer.

B. Initiate a SOAR Search to query the entity.

C. Select View Details for the entity in the Entity Highlights widget.

D. Initiate a SIEM Search to query the entity.

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제4

Your third-party application data is published in a Pub/Sub topic located in a separate Google Cloud project from your Google Security Operations (SecOps) instance. Your attempts to push data from the Pub/Sub topic to Google SecOps have failed. You need to send this data into Google SecOps in a low-latency, robust way. What should you do?

A. Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.

B. Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.

C. Push the data to Cloud Logging, and modify the export filter in direct ingestion.

D. Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.

정답: D

설명: (DumpTOP 회원만 볼 수 있음)

문제5

Your company's Google Security Operations (SecOps) instance has three roles: Tier 1, Tier 2, and Tier 3. Currently, analysts in all tiers can access all cases in Google SecOps. Your company's SOC has a new requirement to restrict access to cases assigned to the Tier 3 role from the other tiers. You need to ensure cases that are assigned to the Tier 3 role can only be accessed by Tier 3 analysts. What should you do?

A. Assign the cases to a user in the Tier 3 role.

B. Configure the Cross Environment Policy to allow users to move cases between environments.
Move Tier 3 cases to an environment that only Tier 3 analysts can access.

C. Revoke additional role access from Tier 1 and Tier 2 analysts.

D. Instruct analysts in Tier 1 and Tier 2 to create a case queue filter to exclude cases assigned to the Tier 3 role.

정답: B

설명: (DumpTOP 회원만 볼 수 있음)

문제6

You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCs in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?

A. Modify the YARA-L rules to use an indicator confidence score (IC-Score) of 60% and above.

B. Create a playbook that automatically tunes the IOC source if its indicator confidence score (IC- Score) is between 60% and 80%.

C. Implement curated detections instead of custom YARA-L rules.

D. Configure alert grouping for the most repetitive alerts.

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제7

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

A. Customize the Close Case dialog and add the five DLP event types as root cause options.

B. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.

C. Customize the Case Name format to include the DLP event type.

D. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

최신 Security-Operations-Engineer 무료덤프 - Google Cloud Certified - Professional Security Operations Engineer (PSOE)

우리와 연락하기

유용한 링크

최신 업데이트