Google GCP-SOE-B : Security Operations Engineer (Beta)

You are working with your company's analyst team to automate the investigation of phishing alerts ingested directly into Google Security Operations (SecOps) SOAR from an email inbox.
The analyst team currently uses a SIEM query to search for related information. You need to design a solution to automatically include the query results in the Google SecOps case without writing any new code. What should you do?

• A. Create a custom action in Google SecOps IDE that runs the SIEM query from a playbook through an API call and returns the results.
• B. Add a widget to the Default Case View in Google SecOps SOAR that allows the analyst team to query directly from the widget.
• C. Add an action to the playbook that runs the SIEM query and returns the results.
• D. Modify the detection rule in the SIEM to include the query results as part of the detection.

Your organization recently implemented Google Security Operations (SecOps). You need to create a solution that allows the security team to monitor data ingestion into Google SecOps in real time. You also need to configure a solution that automatically sends a notification if one of the data sources stops ingesting dat a. You need to minimize the cost of these configurations.
What should you do?

• A. Use Google SecOps SIEM dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• B. Use Google SecOps SIEM dashboards to visualize the data ingestion and configure an alerting policy in Cloud Logging to send a notification in case of failure.
• C. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Cloud Monitoring to send a notification in case of failure.
• D. Create Looker dashboards to visualize the data ingestion, and configure an alerting policy in Looker to send a notification in case of failure.

You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC). You want to follow the Google-recommended approach.
What should you do?

• A. Implement a Cloud Run function that is triggered by IAM policy changes within the project and sends an alert to SCC using the Security Command Center API.
• B. Create a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories for IAM policy changes. When a change is detected identify the principal that made the change.
• C. Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects when a specified principal calls a method against a resource.
• D. Configure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a custom dashboard in SCC to visualize the data.

Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?

• A. Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
• B. Use a custom parser that outputs all fields as raw JSON for detection.
• C. Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
• D. Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.

A phishing campaign successfully convinces users to grant OAuth permissions to a malicious third-party application. Which control failure MOST likely allowed this?

• A. Weak endpoint protection
• B. Missing antivirus signatures
• C. Missing email sandboxing
• D. Lack of monitoring and restriction on OAuth consent grants