Free PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Google PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Test Question

Question 1 (Topic 1)

You use Google Security Operations (SecOps) curated detections and YARA-L rules to detect suspicious activity on Windows endpoints. Your source telemetry uses EDR and Windows Events logs. Your rules match on the principal.user.userid UDM field. You need to ingest an additional log source for this field to match all possible log entries from your EDR and Windows Event logs. What should you do?

Select an option, then click Submit answer.

○ Ingest logs from Windows Sysmon.
○ Ingest logs from Microsoft Entra ID.
○ Ingest logs from Windows PowerShell.
○ Ingest logs from Windows Procmon.

Question 2 (Topic 1)

You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

Select an option, then click Submit answer.

○ Add a threshold in the YARA-L condition: section to ensure that the rule only alerts after a certain number of connections.
○ Assign a risk score in the YARA-L outcome: section to prioritize alerts more effectively in the alert queue.
○ Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.
○ Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.

Reference / correct answer:

Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.

Most accepted answer: D. Update the YARA-L events: section to exclude the most common IP addresses involved in the network connection alerts to reduce the number of alerts.

Community votes: C=1, D=1

Selected Answer: D Because you are excluding only specific, validated benign IP addresses, the rule remains fully effective at monitoring the rest of the network and detecting actual excessive network connections from potentially malicious sources. And Answer A (Add a threshold in the condition section) doesn't seems right because a rule designed to detect "excessive" connections likely already relies on a threshold. Simply raising this threshold to reduce noise could compromise the rule's effectiveness, causing it to miss legitimate threats that fall just below the new, higher limit. upvoted 1 times

Selected Answer: C In Google SecOps (Chronicle), a rule that triggers on "excessive connections" often fires an individual alert for every single event that meets the criteria. This creates a "flood" of alerts in the UI for what is essentially one single malicious or suspicious behavior. By using the match: section with a timeframe (like 10 minutes), you tell the detection engine to aggregate all related events into a single detection. The Benefit: Instead of 500 alerts for 500 connections, you get one alert that contains all 500 events. This drastically reduces the alert volume (noise) without changing the logic of what you are actually detecting (effectiveness). upvoted 1 times b925054 1 week ago Be reminded that the match: section is used to group events over a specific time window to calculate an aggregate (like a count), not to aggregate alerts. If the rule is already detecting "excessive" behavior, it likely already utilizes a match window to perform that calculation. upvoted 1 times ...

Be reminded that the match: section is used to group events over a specific time window to calculate an aggregate (like a count), not to aggregate alerts. If the rule is already detecting "excessive" behavior, it likely already utilizes a match window to perform that calculation. upvoted 1 times

Question 3 (Topic 1)

You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into: User identity behavior - Lateral movement - Privilege escalation attempts - You need to determine which telemetry sources are ingested first. Which log source should you prioritize?

Select an option, then click Submit answer.

○ Cloud access security broker (CASB) logs
○ EDR logs
○ IAM logs
○ Network firewall logs

Free PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER – Google PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Test Question