1.1 Enhancing Detection and Response PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security architect proposes deploying both Cloud IDS and a third-party network intrusion detection system (NIDS) in the same VPC. Management questions the redundancy. Which justification best supports keeping both tools?

   • ACloud IDS is faster than the third-party NIDS, so it should be the primary and the NIDS should be removed.
   • BUsing two NIDS tools ensures that if one fails, the other automatically takes over with no configuration.
   • CBoth tools are required by the compliance framework, so they must be deployed even if they duplicate alerts.
   • DThe third-party NIDS provides specialized signatures for proprietary protocols, while Cloud IDS offers native Google Cloud integration and threat intelligence.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security architect is designing a detection architecture for a hybrid cloud environment. They need to integrate on-premises security tools with Google Cloud's Security Command Center (SCC) and Chronicle SecOps. They also need to ensure that the integration does not create a single point of failure. Which architecture best meets these requirements?

   • ADeploy a Cloud VPN between on-premises and Google Cloud, and use a Cloud Function to pull on-premises alerts and push them to Chronicle SecOps.
   • BUse a multi-region deployment with Cloud Functions and Pub/Sub to ingest on-premises alerts into Chronicle SecOps, and configure SCC to stream findings to Chronicle via the same Pub/Sub infrastructure.
   • CDeploy a redundant pair of Cloud IDS sensors on-premises and in Google Cloud, and forward all alerts to Chronicle SecOps via two separate Pub/Sub topics.
   • DUse a third-party SIEM as a central hub to aggregate on-premises and cloud alerts, then forward them to Chronicle SecOps.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Google Cloud service is commonly used to aggregate security findings from multiple sources, including SCC and Cloud IDS, into a single platform for detection and response?

   • ACloud Load Balancing
   • BGoogle SecOps (Chronicle)
   • CCloud Functions
   • DCloud Storage
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which telemetry source is most valuable for detecting network-based threats, such as malware command-and-control traffic, in a Google Cloud environment?

   • AGoogle Threat Intelligence (GTI)
   • BSecurity Command Center (SCC)
   • CCloud IDS
   • DCloud Audit Logs
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team evaluates their current detection tools and finds that they have no visibility into encrypted traffic. They suspect malware is using TLS to evade detection. Which mitigation should they consider to address this coverage gap?

   • AUse Google Threat Intelligence to block all TLS traffic to known malicious domains.
   • BDeploy Cloud IDS with TLS inspection enabled in the VPC.
   • CDisable TLS encryption on internal traffic to allow inspection.
   • DRely on VPC flow logs to detect malicious TLS traffic.
   Reveal Solution Discussion Select an answer first