Your security automation runs on-premises and needs to access Google SecOps API. You have created a service account and downloaded its key file. You need to ensure the key is stored securely and the automation can authenticate. What is the best practice?

Share the key with the team via email.

Embed the key in the automation script.

Store the key in a secrets manager and configure the automation to retrieve it at runtime.

Your security team uses Security Command Center (SCC) to manage security findings. You need to ensure that only authorized users can access the SCC console. You have enabled Cloud Audit Logs to monitor access. What should you configure to ensure that only authorized users can access the SCC console?

Configure Cloud Identity-Aware Proxy.

Assign IAM roles to users in the SCC project.

Your security team uses a custom automation script that needs to pull threat intelligence data from Google Threat Intelligence (GTI) via API. The script runs on a Compute Engine VM. You want to authenticate the script securely without embedding user credentials. What should you do?

Use an OAuth client ID for a desktop app.

Create a service account, attach it to the VM, and grant it the required GTI API roles.

Use a user account and store its credentials in the script.

Create an API key and embed it in the script.

Google CloudProfessional Security Operations Engineer

Domain 1Objective 2

1.2 Configuring Access PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Part of the Platform operations domain, which accounts for 14% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

23questions here

5free pages

6concepts

14%of the exam

Questions 11–15

11expert · hard
Your security automation runs on-premises and needs to access Google SecOps API. You have created a service account and downloaded its key file. You need to ensure the key is stored securely and the automation can authenticate. What is the best practice?
Select an answer first
12foundation · easy
A security operations team wants to allow a service account to read raw logs stored in Google SecOps (Chronicle) for analysis, but NOT to modify any data. Which IAM role should be assigned?
Select an answer first
13application · medium
Your security team uses Security Command Center (SCC) to manage security findings. You need to ensure that only authorized users can access the SCC console. You have enabled Cloud Audit Logs to monitor access. What should you configure to ensure that only authorized users can access the SCC console?
Select an answer first
14foundation · easy
A data analyst needs to query findings data in Security Command Center but should NOT be able to export findings to BigQuery. Which IAM role should be assigned?
Select an answer first
15application · medium
Your security team uses a custom automation script that needs to pull threat intelligence data from Google Threat Intelligence (GTI) via API. The script runs on a Compute Engine VM. You want to authenticate the script securely without embedding user credentials. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.

1.2 Configuring Access PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–15

Your security automation runs on-premises and needs to access Google SecOps API. You have created a service account and downloaded its key file. You need to ensure the key is stored securely and the automation can authenticate. What is the best practice?

A security operations team wants to allow a service account to read raw logs stored in Google SecOps (Chronicle) for analysis, but NOT to modify any data. Which IAM role should be assigned?

A data analyst needs to query findings data in Security Command Center but should NOT be able to export findings to BigQuery. Which IAM role should be assigned?

Your security team uses a custom automation script that needs to pull threat intelligence data from Google Threat Intelligence (GTI) via API. The script runs on a Compute Engine VM. You want to authenticate the script securely without embedding user credentials. What should you do?

Keep studying — Platform operations