An analyst is reviewing logs to find activities that deviate from established baselines of normal behavior. Which detection technique is being applied?

Threat intelligence reconciliation

What is the primary benefit of using entity context data in detection rules?

To automatically remediate threats

To improve the accuracy of detections by considering relationships between entities

To eliminate the need for threat intelligence

To reduce the number of logs ingested

A company uses Security Command Center (SCC) with Security Health Analytics. They want to be alerted when a critical VM's firewall configuration changes from a secure to an insecure state, such as opening port 22 to the public. Which detection mechanism should they configure?

A dashboard that shows the current firewall rules for all critical VMs.

A Cloud Monitoring alert that triggers when the VM's CPU utilization exceeds a threshold.

A custom Event Threat Detection detector that monitors VPC flow logs for traffic on port 22.

A YARA-L rule that monitors SCC findings and alerts when a new finding of type 'Firewall misconfiguration' is created for the critical VM.

Google CloudProfessional Security Operations Engineer

Domain 4Objective 1

4.1 Developing and Implementing Mechanisms to Detect Risks and Identify Threats PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Part of the Detection engineering domain, which accounts for 22% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

27questions here

6free pages

9concepts

22%of the exam

Questions 21–25

21foundation · easy
An analyst is reviewing logs to find activities that deviate from established baselines of normal behavior. Which detection technique is being applied?
Select an answer first
22foundation · easy
A security administrator wants to create a custom detector in SCC Event Threat Detection that triggers on specific indicators of compromise (IOCs). What type of detector should they configure?
Select an answer first
23foundation · easy
What is the primary benefit of using entity context data in detection rules?
Select an answer first
24application · medium
A company uses Security Command Center (SCC) with Security Health Analytics. They want to be alerted when a critical VM's firewall configuration changes from a secure to an insecure state, such as opening port 22 to the public. Which detection mechanism should they configure?
Select an answer first
25foundation · easy
A detection engineer wants to improve the accuracy of detection rules by using information about entities and their relationships. Which Google SecOps feature provides this context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.

4.1 Developing and Implementing Mechanisms to Detect Risks and Identify Threats PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Questions 21–25

An analyst is reviewing logs to find activities that deviate from established baselines of normal behavior. Which detection technique is being applied?

A security administrator wants to create a custom detector in SCC Event Threat Detection that triggers on specific indicators of compromise (IOCs). What type of detector should they configure?

What is the primary benefit of using entity context data in detection rules?

A company uses Security Command Center (SCC) with Security Health Analytics. They want to be alerted when a critical VM's firewall configuration changes from a secure to an insecure state, such as opening port 22 to the public. Which detection mechanism should they configure?

A detection engineer wants to improve the accuracy of detection rules by using information about entities and their relationships. Which Google SecOps feature provides this context?

Keep studying — Detection engineering