Free Google GCP-SOE-B Exam Dumps Questions & Answers

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

• A.Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
• B.Customize the Case Name format to include the DLP event type.
• C.Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
• D.Customize the Close Case dialog and add the five DLP event types as root cause options.

A SOC team notices repeated outbound HTTPS connections from a Compute Engine instance to an external IP every 60 seconds. CPU usage is normal and no malware signatures trigger. What is the BEST next analytical step?

• A.Power off the instance
• B.Notify executive leadership
• C.Identify the process and service account generating the traffic
• D.Block the destination IP immediately

You are reviewing the results of a UDM search in Google Security Operations (SecOps). The UDM fields shown in the default view are not relevant to your search. You want to be able to quickly view the relevant data for your analysis. What should you do?

• A.Download the search results as a CSV file, and manipulate the data to display relevant data in a spreadsheet.
• B.Create a Google SecOps SIEM dashboard based on the search you have run, and visualize the data in an appropriate table or graphical format.
• C.Select the events of interest, and choose the relevant UDM fields from the event view using the checkboxes. Copy, extract, and analyze the UDM fields, and refine the search query.
• D.Use the columns feature to select or remove columns that are relevant to your analysis.

You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?

• A.Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.
• B.Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
• C.Create a notification in Cloud Monitoring using a metric- absence condition based on sample policy for each collector_id.
• D.Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.

You work for a telecommunications company that wants to monitor their multi-region 5G network logs in Google Security Operations (SecOps). The logs are currently only available on- premises and are stored in a standalone network-attached storage (NAS) located in four different regions.
You need to ingest the logs into Google SecOps and tag each NAS as a specific log source to avoid IP address aliasing. What should you do?

• A.Configure feed management to pull data from each log's location, and configure an ingestion label for each log source.
• B.Configure a Bindplane agent that collects Syslog from each log's location and configure an ingestion label for each log source.
• C.Configure feed management to pull data from each log's location, and configure a namespace for each log source.
• D.Configure a Bindplane agent that collects Syslog from each log's location, and configure a namespace for each log source.