Prep and try our GCP-SOE-B valid and latest training questions & answers

Your team has onboarded a new log source from a third-party DNS filtering solution. After ingestion, you observe that key UDM fields such as network.dns.questions.name and metadata.product_event_type are missing from the parsed events in Google Security Operations (SecOps). You suspect that the default parser does not fully align with the source format. You need to ensure these fields are available for downstream detection rules that rely on DNS query telemetry and event categorization. What should you do?

• A. Modify the ingestion source definition to remap raw fields directly to UDM by using the UDM sample output.
• B. Create a parser extension that maps the missing source fields to the correct UDM fields and attach it to the existing parser.
• C. Enable asset enrichment for the log source to infer missing fields based on correlated host activity.
• D. Use a custom parser that outputs all fields as raw JSON for detection.

You are using Google Security Operations (SecOps) to identify and report a repetitive sequence of brute force SSH login attempts on a Compute Engine image that did not result in a successful login. You need to gain visibility into this activity while minimizing impact on your ingestion quota.
Which log type should you ingest into Google SecOps?

• A. Security Command Center Premium (SCCP) findings
• B. Cloud IDS logs
• C. Cloud Audit Logs
• D. VPC Flow Logs

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

• A. Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
• B. Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team.
• C. Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
• D. Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.

An organization detects a successful login to a Google Cloud IAM user from an unfamiliar country, followed by the creation of multiple new service account keys within minutes. No malware alerts are triggered. What is the MOST appropriate immediate action?

• A. Disable the service accounts and continue monitorin
• B. Rotate only the affected user's password
• C. Wait for evidence of data access
• D. Revoke active credentials, disable the compromised identity, and initiate an incident response

You are a SOC manager at an organization that recently implemented Google Security Operations (SecOps). You need to monitor your organization's data ingestion health in Google SecOps. Data is ingested with Bindplane collection agents. You want to configure the following:
- Receive a notification when data sources go silent within 15 minutes.
- Visualize ingestion throughput and parsing errors. What should you do?

• A. Configure silent source alerts based on rule detections for anomalous data ingestion activity in Risk Analytics. Monitor and visualize the alert metrics in the Risk Analytics dashboard.
• B. Configure notifications in Cloud Monitoring when ingestion sources become silent in Bindplane. Monitor and visualize Google SecOps data ingestion metrics using Bindplane Observability Pipeline (OP).
• C. Configure silent source notifications for Google SecOps collection agents in Cloud Monitoring. Create a Cloud Monitoring dashboard to visualize data ingestion metrics.
• D. Configure automated scheduled delivery of an ingestion health report in the Data Ingestion and Health dashboard. Monitor and visualize data ingestion metrics in this dashboard.