Google Cloud Professional Security Operations Engineer - Practice Questions¶
31 original scenario questions across the six sections of exam guide 2.0: Platform operations (~13%) 4 questions, Data management (~20%) 6, Threat hunting (~18%) 5, Detection engineering (~20%) 7, Incident response (~18%) 6 and Observability (~11%) 3. These are original questions, not vendor exam content.
Cert page: exams/gcp/security-operations-engineer/
Question 2 - Section 1: Platform operations¶
Scenario: A security team needs staff at partner companies to reach Google Cloud security tools through single sign-on using each partner's own identity provider, without copying those users into Google-managed accounts. What should they configure?
A. Workforce Identity Federation with a partner OIDC or SAML 2.0 provider B. Google Cloud Directory Sync from each partner directory C. A shared service account key given to every partner analyst D. Cloud Identity accounts created manually for each partner user
Answer
**Correct: A** **Why:** Workforce Identity Federation lets an external identity provider authenticate workforce users via OIDC or SAML 2.0 and avoids synchronising identities. Directory sync copies accounts, and shared keys destroy accountability.Question 3 - Section 1: Platform operations¶
Scenario: An investigation needs to show who read records in a Cloud Storage bucket last month, but no read events appear in Cloud Audit Logs. What is the most likely reason?
A. Data Access audit logs were not enabled for the service, since they are off by default except for BigQuery B. System Event logs replace Data Access logs automatically in newer Google Cloud projects C. Policy Denied logs overwrite read events whenever they are turned on for the same project D. Admin Activity logs expire after one week and can never be exported for analysis
Answer
**Correct: A** **Why:** Data Access logs record reads of user data and are off by default for all services except BigQuery, so they must be enabled in advance. Admin Activity logs record configuration changes, not data reads.Question 4 - Section 1: Platform operations¶
Scenario: A team runs two tools that both detect threats on virtual machines. A manager asks whether to keep both. What is the best way to justify keeping an overlapping tool?
A. Remove the tool with fewer alerts, on the grounds that fewer alerts must mean less noise for analysts B. Show a requirement that each tool uniquely satisfies and the coverage gap if either is removed C. Keep whichever tool is cheaper without comparing what each one detects or where they differ D. Argue that more tools always produce better security outcomes, so every overlapping tool should stay
Answer
**Correct: B** **Why:** Overlap is justified by requirements: what each tool covers that the other does not and what gap its removal creates. Counting tools or alerts says nothing about coverage.Question 5 - Section 1: Platform operations¶
Scenario: Which Google service writes findings about misconfigurations, vulnerabilities and threats in Google Cloud resources and supports posture management?
A. Security Command Center B. Looker Studio C. Cloud Monitoring uptime checks D. Google Cloud Directory Sync
Answer
**Correct: A** **Why:** Security Command Center produces findings from built-in services such as Security Health Analytics and Event Threat Detection and supports posture management. The others report, monitor availability or synchronise directories.Question 6 - Section 2: Data management¶
Scenario: Detections that rely on the target user field have stopped working for one log source after a vendor update. Health Hub shows parser errors rising. What should the engineer do first?
A. Rewrite every rule that uses the target user field so that it matches against raw log text instead B. Lower the severity of the affected rules so that fewer analysts are paged for the missing field C. Disable the log source until the vendor releases an official fix for the changed log format D. Create a parser extension that maps the new field to the UDM field and test it with samples
Answer
**Correct: D** **Why:** The problem is normalisation, so fix the mapping with a parser extension and test it. Rewriting rules to use raw text is brittle, and disabling the source or lowering severity hides the failure.Question 7 - Section 2: Data management¶
Scenario: An analyst wants to know whether a logged-in account belongs to a privileged finance user. Which kind of data supplies this?
A. The firewall log of the connection that followed B. The audit log that lists which API methods were called C. Event data from a single login log entry D. Entity data, such as organisational context for the user
Answer
**Correct: D** **Why:** Entity data describes users and assets and their attributes (role, department, privilege). Event data records that something happened but not what the user is.Question 8 - Section 2: Data management¶
Scenario: Two sources identify the same laptop, one by hostname and one by IP address. How can the platform combine their activity into one picture?
A. Aliasing fields so event and entity data match across identifiers B. Renaming the hostname in the source logs by hand every day C. Deleting the IP-based source because it is less precise D. Running a retrohunt with alerting enabled on both sources
Answer
**Correct: A** **Why:** Aliasing links different identifiers for the same entity so events and context can be matched. Renaming by hand or deleting a source does not scale or loses data.Question 9 - Section 2: Data management¶
Scenario: A team collects Windows Security, System and Application events with the Bindplane agent, but the Windows Event parser maps almost no fields and detections never match. The receiver for each channel was left at its default rendering. What is the most likely fix?
A. Switch the exporter to a different region so that the parser is re-applied B. Collect the channels in their raw, unrendered format so the Windows Event parser can read them C. Create a reference list of the missing field names and reference it in each rule D. Disable the Application channel because it is the cause of the parse failures
Answer
**Correct: B** **Why:** The Windows Event parser expects raw, unrendered events, which the Bindplane Windows receiver provides with its raw setting. Rendered text defeats the parser, so fields are never normalised and rules cannot match them.Question 10 - Section 2: Data management¶
Scenario: A threat intelligence feed was loaded into the Entity Context Graph once, and a week later live rules and retrohunts stop matching its indicators. The feed was not changed. What explains this?
A. Entity graph entries are time-bound, so the feed has to be re-ingested regularly to stay valid B. Indicators are removed from the graph whenever an analyst runs a UDM search C. Retrohunts delete the indicators they match after the first run D. Indicators from feeds can only match events collected from Google Cloud
Answer
**Correct: A** **Why:** By default a graph entry is valid for a limited window around its ingestion time, so feeds are re-ingested at least daily. Searches and retrohunts do not delete indicators, and matching is not limited to Google Cloud sources.Question 11 - Section 2: Data management¶
Scenario: The finance team complains about logging costs after Data Access audit logs and flow logs were enabled everywhere. What is the most appropriate approach?
A. Keep ingesting everything from every source because storage in the cloud is described as cheap B. Cut the number of log sources down to a smaller set chosen at random by the platform team C. Ingest what supports detections, investigations or compliance, filter low-value events and keep verbose logs in cheaper storage D. Turn off all audit logging across the organization so that the logging cost disappears entirely
Answer
**Correct: C** **Why:** Manage cost by justifying each source, filtering noise and tiering storage, while keeping what detections need. Turning off logging or ingesting everything are both poor trade-offs.Question 12 - Section 3: Threat hunting¶
Scenario: A hunter needs to run SQL aggregations over a large volume of audit logs to find service accounts calling an unusual number of distinct APIs over 30 days. Which tools suit this?
A. Cloud Monitoring uptime checks configured against each service account in the organization B. A manual review of console screenshots collected by each project owner over the month C. Log Analytics or BigQuery, which both run SQL over large log datasets D. A single quick filter in the Logs Explorer for one resource
Answer
**Correct: C** **Why:** Log Analytics and BigQuery provide SQL over large datasets for aggregation and trend analysis. Logs Explorer is suited to quick searches on known resources.Question 13 - Section 3: Threat hunting¶
Scenario: Intelligence reports a malicious domain used by a campaign that began three weeks ago. What should the team do first with the indicator?
A. Delete DNS logs older than a week to limit the exposure of the organization to disclosure B. Search retained telemetry for the domain across the last three weeks and earlier C. Wait for the vendor to release a curated detection that happens to cover the domain D. Add it to a rule that only evaluates events arriving from tomorrow onwards and stop there
Answer
**Correct: B** **Why:** New indicators must be applied to historical data to find activity that predated them. Forward-only rules miss the earlier period, and deleting logs destroys evidence.Question 14 - Section 3: Threat hunting¶
Scenario: A team wants to run an existing YARA-L rule's logic over the last two weeks of data. What should they do to avoid flooding the case queue?
A. Run a retrohunt with the rule's alerting status disabled, then review the results B. Run the retrohunt with alerting enabled so that every old match opens a case immediately C. Copy the rule to a new rule and enable alerting on both of the rules at the same time D. Run the retrohunt over a time range that is smaller than the rule's match window
Answer
**Correct: A** **Why:** A retrohunt with alerting enabled creates an alert for every historical detection, so the documentation recommends disabling alerting for the run. For multi-event rules, the range must be at least the match window.Question 15 - Section 3: Threat hunting¶
Scenario: A hunter notices a user with a steadily rising risk score from many small detections. How should the score be used?
A. As a replacement for reading the underlying detections B. As proof that the user is malicious and the account should be deleted C. As a prioritisation signal for whom to hunt first, verified against evidence D. As a number that can be ignored because scores are always wrong
Answer
**Correct: C** **Why:** Entity risk score highlights anomalous behaviour and helps prioritise, but it accumulates from rules that may be noisy, so verify. It is not proof or a replacement for analysis.Question 16 - Section 3: Threat hunting¶
Scenario: Which hunting hypothesis is specific and testable?
A. Attackers may be present somewhere in the environment and will probably do something harmful soon B. The organization has some security weaknesses that a determined attacker could eventually exploit C. A stolen service account key will be used from an unusual network to list storage buckets in the project D. Every identity in the organization is suspicious and all of them should be searched in the same way
Answer
**Correct: C** **Why:** A testable hypothesis names a behaviour and data that can confirm or refute it. The others are too vague to turn into a search.Question 17 - Section 4: Detection engineering¶
Scenario: Which YARA-L section calculates additional values, such as a risk score, for each detection?
A. options B. meta C. events D. outcome
Answer
**Correct: D** **Why:** The outcome section calculates extra values for each detection, such as risk scores. Meta holds descriptive details, events selects UDM events and options sets rule settings.Question 18 - Section 4: Detection engineering¶
Scenario: A rule must alert when at least five blocked logins are followed by an allowed login for the same user within ten minutes. Which rule type is needed?
A. A rule with only a meta section and an author B. A reference list of usernames with no rule logic C. A multi-event rule with a match window grouped by user D. A single-event rule with no match section
Answer
**Correct: C** **Why:** Counting events across a time window grouped by a variable needs a multi-event rule with a match section. A single-event rule evaluates one event at a time.Question 19 - Section 4: Detection engineering¶
Scenario: The security team wants a rule to flag connections from a set of high-risk IPv4 ranges that is updated weekly without editing the rule. Which feature fits?
A. Hard-coded address ranges in the events section B. A CIDR reference list referenced with the in operator C. A regex list of hostnames for the ranges D. A string reference list of individual addresses written as exact text
Answer
**Correct: B** **Why:** A CIDR reference list tests whether an IP falls within listed ranges and can be updated without editing the rule. Hard-coded values require rule changes, and string lists require exact matches.Question 20 - Section 4: Detection engineering¶
Scenario: Security Health Analytics findings show a firewall rule opened a sensitive port to the internet. Which detection design addresses posture changes like this?
A. Only a quarterly manual review of firewall rules by the networking team and an auditor, to be thorough B. A blanket block on every firewall change by every engineer, regardless of its purpose C. Ignoring configuration changes and reading only endpoint logs from the affected hosts D. A detection or posture control that alerts on the change from the baseline and routes it to the owner
Answer
**Correct: D** **Why:** Posture changes are best detected as drift from a baseline using SCC Security Health Analytics, posture management and SecOps rules, with routing to the owner. Quarterly reviews are too slow and blocking all changes is impractical.Question 21 - Section 4: Detection engineering¶
Scenario: A rule fires thousands of times a week, mostly for one backup server's service account. What is the best tuning action?
A. Delete the rule so that the backup server's account no longer generates any alerts B. Disable the rule for every service account in the organization, to be safe C. Raise the rule's severity so that analysts triage the backup server's alerts first D. Exclude that known-good entity precisely and keep the rule for everyone else
Answer
**Correct: D** **Why:** Tune with a precise exclusion and a recorded exception, keeping coverage for others. Deleting the rule or disabling classes of accounts creates blind spots.Question 22 - Section 4: Detection engineering¶
Scenario: An engineer wants a rule that fires when the same user triggers two different existing detections within two weeks, because neither rule is suspicious alone. Which approach fits?
A. Raise both rules to the same severity and let analysts correlate the alerts by hand B. Write a composite detection that takes the two rules' detections as input and matches on the user C. Add the user to a CIDR reference list used by both rules D. Write a single-event rule with no match section on the first rule's events
Answer
**Correct: B** **Why:** A composite rule takes detections from other rules as input and uses a match section to correlate them over a window of up to 14 days. A single-event rule or a list cannot correlate two detections over time.Question 23 - Section 4: Detection engineering¶
Scenario: Which SCC capability lets you raise a finding when specific bad IP addresses or domains appear in the logs it reads?
A. Event Threat Detection custom detectors for IOCs B. Workforce Identity Federation attribute mapping C. Looker Studio scheduled reports D. Cloud Audit Logs Data Access logging
Answer
**Correct: A** **Why:** Event Threat Detection supports custom detectors, using module templates, to detect specific IOCs and write findings. The other options report, record or authenticate.Question 24 - Section 5: Incident response¶
Scenario: Analysts confirm a compromised service account is exfiltrating data from a production project. Which action best contains it while preserving evidence?
A. Delete the production project immediately so that all activity in it stops at once B. Restrict or disable the service account's access and keys, snapshot affected disks, and keep the logs C. Reboot every instance in the project to clear memory and anything the attacker started, so the attacker is stopped D. Wait for the next quarterly review before changing any access, to avoid disrupting users
Answer
**Correct: B** **Why:** Containment should stop the harm reversibly while preserving evidence: restrict the credential, snapshot disks and retain logs. Deleting the project or rebooting destroys evidence, and waiting extends exposure.Question 25 - Section 5: Incident response¶
Scenario: Which playbook steps are the best candidates for full automation?
A. Shutting down all virtual machines in a folder B. Reputation lookups, enrichment and ticket creation C. Deleting user mailboxes after a phishing alert D. Disabling a production database service account on any single alert
Answer
**Correct: B** **Why:** Frequent, well understood, low-risk steps such as enrichment and ticket creation suit automation. Disruptive actions should have manual approval or high-confidence triggers.Question 26 - Section 5: Incident response¶
Scenario: In Google SecOps SOAR, what is the relationship between a case and an alert?
A. An alert is the top-level container holding one or more cases B. They are the same object with two names C. A case is the top-level container holding one or more alerts D. A case is a single event inside an alert
Answer
**Correct: C** **Why:** A case is the top-level container composed of one or more alerts ingested from various sources, and an alert is a notification containing one or more security events.Question 27 - Section 5: Incident response¶
Scenario: A playbook needs an analyst to approve disabling an account before it continues. Which feature provides this?
A. Run the next action automatically and review the account change afterwards B. A manual action that pauses the playbook until an analyst completes or skips it C. Send an email to the whole team and let the playbook continue without waiting D. Disable the account on every alert without asking, since speed always matters most
Answer
**Correct: B** **Why:** A manual action pauses the playbook until an analyst completes or skips it and appears in the Pending Actions widget.Question 28 - Section 5: Incident response¶
Scenario: Cases are often delayed when they pass between shifts. What improves the case management life cycle?
A. A handoff template with summary, evidence, actions taken, open tasks and next owner B. Auto-close every case at shift change and ask the next shift to reopen it C. Hide the case history from the receiving analyst so that they form their own view D. Assign every case to the most senior analyst regardless of shift or workload, to keep decisions consistent
Answer
**Correct: A** **Why:** A structured handoff lets the receiving analyst continue without rework. Hiding history, auto-closing and funnelling to one person create delays or lost information.Question 29 - Section 5: Incident response¶
Scenario: After an incident, the cause is an over-permissioned account that SCC had flagged for weeks. What is the proper outcome of root cause analysis?
A. Corrective changes to permissions and a process that routes such findings to owners with deadlines B. A report naming the analyst who missed the finding, with a recommendation for retraining, so that it does not recur C. Disabling Security Command Center so that it creates fewer findings to ignore D. Waiting for the next incident to see whether the same weakness is exploited again
Answer
**Correct: A** **Why:** Root cause analysis should lead to a fix and a process change, not blame. Disabling the tool removes the signal.Question 30 - Section 6: Observability¶
Scenario: Which dashboard metric best indicates that a detection programme is producing too much noise?
A. The total number of cases closed this quarter, shown as a single number B. The number of dashboards that analysts have created in the platform C. The count of rules that exist, regardless of how often any of them fires D. False positive rate and alert volume by rule, with a trend over time
Answer
**Correct: D** **Why:** False positive rate and alert volume per rule show noise and where to tune. The other numbers do not measure alert quality.Question 31 - Section 6: Observability¶
Scenario: An authentication log source stops sending events for six hours and nobody notices. Which feature would have raised an alert?
A. Case closure reasons reported on a weekly dashboard for the team lead B. A summary of the detections that fired over the last day on the console as an after-the-fact view C. A playbook failure count shown on the manager's monthly report D. Silent source detection configured with an interval suited to that source
Answer
**Correct: D** **Why:** Silent source detection alerts when a source sends no events within its expected interval, catching failures and possible tampering. Case or detection summaries do not reveal missing data.Question 32 - Section 6: Observability¶
Scenario: Which set of metrics best shows the health of the log ingestion pipeline?
A. Ingestion rate and newest event age per source, plus parser error rate B. The number of cases closed each quarter and their average age C. Total detections by rule and the false positive rate for each rule (a detection-quality metric) D. Analyst headcount per shift and the length of the escalation chain