A security operations team is designing a playbook for automated malware containment. They need to integrate with a tool that can isolate infected endpoints quickly. Which integration should they select?

Email gateway to block the malware's command-and-control traffic

Threat intelligence platform to enrich the malware hash

Endpoint detection and response (EDR) tool

Ticketing system to create an incident ticket

A security team is implementing a playbook for a critical incident. The playbook must notify the on-call analyst immediately and escalate to management if the analyst does not acknowledge within 10 minutes. The team is concerned about notification fatigue for management. What should they do?

Notify management via email for every critical incident

Notify management via paging only if the analyst does not acknowledge

Notify management via chat for every critical incident

Notify management via ticketing system for every critical incident

After a recent incident, a postmortem revealed that a new attack pattern using living-off-the-land binaries (LOLBins) went undetected. The team wants to create a playbook to address this pattern. What should be the first step in designing the playbook?

Identify the key decision points and required data sources

Notify all stakeholders immediately

Automate all response steps to ensure speed

Integrate with a threat intelligence platform

Which mechanism is commonly used to notify analysts of a new high-severity incident in real time?

Creating a ticket in the IT service management tool

Updating the incident response plan document

Sending an email to a shared mailbox

Posting a message to a chat channel (e.g., Slack, Microsoft Teams)

Google CloudProfessional Security Operations Engineer

Domain 5Objective 2

5.2 Building, Implementing, and Using Response Playbooks PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Part of the Incident response domain, which accounts for 21% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

23questions here

5free pages

6concepts

21%of the exam

Questions 1–5

1application · medium
A security operations team is designing a playbook for automated malware containment. They need to integrate with a tool that can isolate infected endpoints quickly. Which integration should they select?
Select an answer first
2expert · hard
A security team is implementing a playbook for a critical incident. The playbook must notify the on-call analyst immediately and escalate to management if the analyst does not acknowledge within 10 minutes. The team is concerned about notification fatigue for management. What should they do?
Select an answer first
3application · medium
After a recent incident, a postmortem revealed that a new attack pattern using living-off-the-land binaries (LOLBins) went undetected. The team wants to create a playbook to address this pattern. What should be the first step in designing the playbook?
Select an answer first
4foundation · easy
Which mechanism is commonly used to notify analysts of a new high-severity incident in real time?
Select an answer first
5application · medium
A playbook for a low-severity incident includes a step to notify the affected user. The team wants to automate this notification. What is the most appropriate mechanism?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.