Your organization is required to audit who accessed sensitive data in Google Cloud Storage. You need to enable logging that captures every read and write operation on the bucket. What should you configure?

Enable Cloud Monitoring for the bucket.

Enable Data Access audit logs for the bucket in Cloud Audit Logs.

Enable Admin Activity audit logs for the bucket.

Enable VPC Flow Logs for the subnet that contains the bucket.

A security operations team uses Security Command Center (SCC) to manage findings. You need to allow a junior analyst to view findings and their details, but not modify the security marks or change the state of findings. The analyst should also be able to export findings to BigQuery for further analysis. What is the most appropriate IAM role to assign?

Security Center Findings Editor

Your organization uses Okta for identity management. You want to allow security analysts to access Google SecOps using their Okta credentials. You have configured Workforce Identity Federation. What additional step is required to ensure the analysts can access SecOps?

Grant the federated identities the appropriate IAM roles in the SecOps project.

Create a Google account for each analyst.

Create a service account for each analyst.

Enable API keys for the analysts.

Your organization uses Workforce Identity Federation to allow employees to access Google SecOps. You need to ensure that only employees in the 'Security' group can access SecOps. You have configured the federation with your IdP. What is the best way to enforce this?

Create a Google group and add the employees to it.

Use a service account for each employee.

Map the 'Security' group attribute from the IdP to a specific IAM role in SecOps.

Grant access to all federated users and rely on the IdP to restrict access.

A security analyst needs to access Google SecOps (Chronicle) using their corporate Google account. Which authentication method is used for a user to access the Google SecOps web interface?

OAuth 2.0 with Google as the identity provider

Username and password stored in the SecOps application

Google CloudProfessional Security Operations Engineer

Domain 1Objective 2

1.2 Configuring Access PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Part of the Platform operations domain, which accounts for 14% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

23questions here

5free pages

6concepts

14%of the exam

Questions 1–5

1application · medium
Your organization is required to audit who accessed sensitive data in Google Cloud Storage. You need to enable logging that captures every read and write operation on the bucket. What should you configure?
Select an answer first
2application · medium
A security operations team uses Security Command Center (SCC) to manage findings. You need to allow a junior analyst to view findings and their details, but not modify the security marks or change the state of findings. The analyst should also be able to export findings to BigQuery for further analysis. What is the most appropriate IAM role to assign?
Select an answer first
3application · medium
Your organization uses Okta for identity management. You want to allow security analysts to access Google SecOps using their Okta credentials. You have configured Workforce Identity Federation. What additional step is required to ensure the analysts can access SecOps?
Select an answer first
4expert · hard
Your organization uses Workforce Identity Federation to allow employees to access Google SecOps. You need to ensure that only employees in the 'Security' group can access SecOps. You have configured the federation with your IdP. What is the best way to enforce this?
Select an answer first
5foundation · easy
A security analyst needs to access Google SecOps (Chronicle) using their corporate Google account. Which authentication method is used for a user to access the Google SecOps web interface?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.