Google Security Operations Engineer (Beta) Sample Questions:

1. Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the Next 24 hours. What should you do?

A) Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
B) Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
C) Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.
D) Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.

2. Your organization is a Google Security Operations (SecOps) customer. The compliance team requires a weekly export of case resolutions and SLA metrics of high and critical severity cases over the past week. The compliance team's post- processing scripts require this data to be formatted as tabular data in CSV files, zipped, and delivered to their email each Monday morning.
What should you do?

A) Generate a report in SOAR Reports, and schedule delivery of the report.
B) Build a detection rule with outcomes, and configure a Google SecOps SOAR job to format and send the report.
C) Build an Advanced Report in SOAR Reports, and schedule delivery of the report.
D) Use statistics in search, and configure a Google SecOps SOAR job to format and send the report.

3. Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?

A) Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
B) Use a custom parser that outputs all fields as raw JSON for detection.
C) Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
D) Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.

4. You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? (Choose two.)

A) Use a conditional statement to determine whether to treat the URL as suspicious or benign.
B) Create a widget that translates the JSON output to a severity score.
C) Verify that the response is accurate by manually checking the URL in VirusTotal
D) Pass the response back to the SIEM.
E) Use the number of detections from the response JSON in a conditional statement to set the severity.

5. You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on- premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?

A) Create a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture communicating with known command and control (C2) nodes. Review inbound traffic from those C2 domains that have only started appearing recently.
B) Activate a new Web Security Scanner scan in Security Command Center (SCC), and look for findings related to XSS.
C) Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound connection to a server was followed by a process on the server that spawned subprocesses previously not seen in the environment.
D) Ask the Gemini Agent in Google Security Operations (SecOps) to search for the latest vulnerabilities in the environment.

Solutions: