100% Free Google Professional-Security-Operations-Engineer Practice Exam Questions Online 2026

Question 1

You have been tasked with creating a YARA-L detection rule in Google Security Operations (SecOps). The rule should identify when an internal host initiates a network connection to an external IP address that the Applied Threat Intelligence Fusion Feed associates with indicators attributed to a specific Advanced Persistent Threat 41 (APT41) threat group. You need to ensure that the external IP address is flagged if it has a documented relationship to other APT41 indicators within the Fusion Feed. How should you configure this YARA-L rule?

A : Configure the rule to trigger when the external IP address from the network connection event matches an entry in a manually pre-curated data table of all APT41-related IP addresses.

B : Configure the rule to establish a join between the live network connection event and Fusion Feed data for the common external IP address. Filter the joined Fusion Feed data for explicit associations with the APT41 threat group or related indicators.

C : Configure the rule to check whether the external IP address from the network connection event has a high confidence score across any enabled threat intelligence feed.

D : Configure the rule to detect outbound network connections to the external IP address. Create a Google SecOps SOAR playbook that queries the Fusion Feed to determine if the IP address has an APT41 relationship.

Answer: B

Question 2

You are managing the integration of Security Command Center (SCC) with downstream tooling. You need to

pull security findings from SCC and import those findings as part of Google Security Operations (SecOps)

SOAR actions. You need to configure the connection between SCC and Google SecOps.

A : Install the Google Rapid Response integration from the Google SecOps Marketplace. Gatherinformation about the findings from the appropriate server.

B : Install the SCC integration from the Google SecOps Marketplace. Grant the SCC API the appropriateIAM roles to integrate with the Google SecOps instance. Configure this integration using a generatedAPI key scoped to the SCC API.

C : Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired findingtypes. Grant the Google SecOps service account the appropriate IAM roles to read from thissubscription.

D : Create a Pub/Sub topic with a NotificationConfig object and a push subscription for the desired findingtypes. Create a new Google SecOps service account in the Google Cloud project, and grant this serviceaccount the appropriate IAM roles to read from this subscription. Export the credentials from IAM andimport the credentials into Google SecOps SOAR.

Answer: B

Question 3

You are helping a new Google Security Operations (SecOps) customer configure access for their SOC team. The customer's Google SecOps administrators currently have access to the Google SecOps instance. The customer is reporting that the SOC team members are not getting authorized to access the instance, but they are able to authenticate to the third-party identity provider (IdP). How should you fix the issue? Choose 2 answers

A : Link Google SecOps to a Google Cloud project with the Chronicle API.

B : Connect Google SecOps with the third-party IdP using Workforce Identity Federation.

C : Grant the appropriate data access scope to the SOC team's IdP group in IAM.

D : Grant the roles/chronicle.viewer role to the SOC team's IdP group in IAM.

E : Grant the Basic permission to the appropriate IdP groups in the Google SecOps SOAR Advanced Settings.

Answer: D,E

Question 4

You are responsible for monitoring the ingestion of critical Windows server logs to Google Security Operations (SecOps) by using the Bindplane agent. You want to receive an immediate notification when no logs have been ingested for over 30 minutes. You want to use the most efficient notification solution. What should you do?

A : Configure the Windows server to send an email notification if there is an error in the Bindplane process.

B : Create a new YARA-L rule in Google SecOps SIEM to detect the absence of logs from the server within a 30-minute window.

C : Configure a Bindplane agent to send a heartbeat signal to Google SecOps every 15 minutes, and create an alert if two heartbeats are missed.

D : Create a new alert policy in Cloud Monitoring that triggers a notification based on the absence of logs from the server's hostname.

Answer: D

Question 5

Your Google Security Operations (SecOps) case queue contains a case with IP address entities. You need to determine whether the entities are internal or external assets and ensure that internal IP address entities are marked accordingly upon ingestion into Google SecOps SOAR. What should you do?

A : Configure a feed to ingest enrichment data about the networks, and include these fields into your detection outcome.

B : Modify the connector logic to perform a secondary lookup against your CMDB and flag incoming entities as internal or external.

C : Indicate your organization's known internal CIDR ranges in the Environment Networks list in the settings.

D : Create a custom action to ping the IP address entity from your Remote Agent. If successful, the custom action designates the IP address entity as internal.

Answer: C

Free Google Professional-Security-Operations-Engineer Practice Exam Questions and Answers 2026