Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

Security-Operations-Engineer Professional Security Operations Engineer Exam

  • Google
  • 5 free sample questions

About this exam

Security-Operations-Engineer is the Google exam Professional Security Operations Engineer Exam. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
Security-Operations-Engineer
Vendor
Google
Practice questions
Not available yet
Free sample questions
5
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for Security-Operations-Engineer.

Question 1

You recently joined a company that uses Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You have alert fatigue from a recent red team exercise, and you want to reduce the amount of time spent sifting through noise. You need to filter out IoCs that you suspect were generated due to the exercise. What should you do?

  1. Option A:

    Ask Gemini to provide a list of IoCs from the red team exercise.

  2. Option B:

    Filter IoCs with an ingestion time that matches the time period of the red team exercise.

  3. Option C:

    Navigate to the IOC Matches page. Identify and mute the IoCs from the red team exercise.

  4. Option D:

    Navigate to the IOC Matches page. Review IoCs with an Indicator Confidence Score (IC-Score) label > = 80%.

Show answer and explanation

Correct answer: C

The IOC Matches page is the central location in Google Security Operations (SecOps) for reviewing all IoCs that have been automatically correlated against your organization ' s UDM data. This page is populated by the Applied Threat Intelligence service, which includes feeds from Google, Mandiant, and VirusTotal.

When security exercises (like red teaming or penetration testing) are conducted, they often use known malicious tools or infrastructure that will correctly trigger IoC matches, creating " noise " and contributing to alert fatigue. The platform provides a specific function to manage this: muting .

An analyst can navigate to the IOC Matches page, use filters (such as time, as mentioned in Option B) to identify the specific IoCs associated with the red team exercise, and then select the Mute action for those IoCs. Muting is the correct operational procedure for suppressing known-benign or exercise-related IoCs. This action prevents them from appearing in the main view and contributing to noise, while preserving the historical record of the match. Option D is a prioritization technique, not a suppression one.

(Reference: Google Cloud documentation, " View IoCs using Applied Threat Intelligence " ; " View alerts and IoCs " ; " Mute or unmute IoC " )

Here is the formatted answer as requested.

Question 2 (choose 2)

You are helping a new Google Security Operations (SecOps) customer configure access for their SOC team. The customer ' s Google SecOps administrators currently have access to the Google SecOps instance. The customer is reporting that the SOC team members are not getting authorized to access the instance, but they are able to authenticate to the third-party identity provider (IdP). How should you fix the issue?

Choose 2 answers

  1. Option A:

    Link Google SecOps to a Google Cloud project with the Chronicle API.

  2. Option B:

    Connect Google SecOps with the third-party IdP using Workforce Identity Federation.

  3. Option C:

    Grant the appropriate data access scope to the SOC team ' s IdP group in IAM.

  4. Option D:

    Grant the roles/chronicle.viewer role to the SOC team ' s IdP group in IAM.

  5. Option E:

    Grant the Basic permission to the appropriate IdP groups in the Google SecOps SOAR Advanced Settings.

Show answer and explanation

Correct answer: D, E

Comprehensive and Detailed Explanation

This scenario describes a common configuration task where authorization is failing despite successful authentication. The problem stems from the fact that Google SecOps uses a dual-authorization model: one for the main platform (SIEM/Chronicle) and a separate one for the SOAR module. The SOC team needs both.

The prompt states admins already have access , which confirms that prerequisite steps like linking the project (Option A) and configuring Workforce Identity Federation (Option B) are already complete. The problem is specific to the new SOC team ' s group .

    Fixing Instance Access (Option D):

The error " not getting authorized to access the instance " refers to the primary Google Cloud-level authorization. Access to the Google SecOps application itself is controlled by Google Cloud IAM roles on the linked project.1 The SOC team ' s group, which is federated from the third-party IdP, is represented as a principalSet in IAM. This principalSet must be granted an IAM role to allow sign-in. The roles/chronicle.viewer role is the minimum predefined role required to grant this application access.

    Fixing SOAR Access (Option E):

Simply granting the IAM role (Option D) is not enough for the SOC team to perform its job. That role only gets them into the main SIEM interface. The SOAR module (for case management and playbooks) has its own internal role-based access control system. An administrator must also navigate within the SecOps platform to the SOAR Advanced Settings > Users & Groups and grant the SOC team ' s federated group a SOAR-specific permission, like " Basic " or " Analyst. "

Both steps are required to fully " fix the issue " and provide the SOC team with functional access to the platform.

Exact Extract from Google Security Operations Documents:

Identity and Access Management: Access to a Google SecOps instance using a third-party IdP relies on Workforce Identity Federation, but authorization is configured in two distinct locations.

    Google Cloud IAM: Authorization to the main SecOps instance (including the SIEM interface) is controlled by Google Cloud IAM. 2 The federated identities (groups) from the third-party IdP are mapped to a principalSet. This principalSet must be granted an IAM role on the Google Cloud project linked to the SecOps instance. The roles/chronicle.viewer role is the minimum predefined role required to grant sign-in access.

    Google SecOps SOAR: Authorization for the SOAR module (for case management and playbooks) is managed independently. 3 An administrator must navigate to the SOAR Advanced Settings > Users & Groups and assign a SOAR-specific role (e.g., ' Basic ' or ' Analyst ' ) to the same federated IdP group.

[References:, Google Cloud Documentation: Google Security Operations > Documentation > Onboard > Configure a third-party identity provider, Google Cloud Documentation: Google Security Operations > Documentation > SOAR > SOAR Administration > Users and Groups, , , ]
See all 5 free sample questions