從最新題庫、模擬考軟體到售後更新服務，Fast2test 提供 Google Cloud Certified - Professional Security Operations Engineer (PSOE) 一站式備考方案。Security-Operations-Engineer 共 143 道練習題，2026 年準備考試所需的一切，在這裡一次備齊。

Google Security-Operations-Engineer 考試概覽:

Google Security-Operations-Engineer 考試大綱主題:

Google Security-Operations-Engineer 考試疑問總整理

最新的 Google Cloud Certified Security-Operations-Engineer 免費考試真題：

問題 #1

A business unit in your organization plans to use Vertex AI to develop models within Google Cloud. The security team needs to implement detective and preventative guardrails to ensure that the environment meets internal security control requirements. How should you secure this environment?

A. Implement Assured Workloads by creating a folder for the business unit and assigning the relevant control package.
B. Create a posture consisting of predefined and custom organization policies and predefined and Security Health Analytics (SHA) custom modules. Scope this posture to the business unit folder.
C. Implement preconfigured and custom organization policies to meet the control requirements.
Apply these policies to the business unit folder.
D. Create a policy bundle representing the control requirements using Rego. Implement these policies using Workload Manager. Scope this scan to the business unit folder.

問題 #2

Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps. How should you achieve this?

A. Customize the Case Name format to include the DLP event type.
B. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
C. Customize the Close Case dialog and add the five DLP event types as root cause options.
D. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.

問題 #3

You are ingesting and parsing logs from an SSO provider and an on-premises appliance using Google Security Operations (SecOps). Users are tagged as "restricted" by an internal process.
Restrictions last five days from the most recent flagging time. You need to create a rule to detect when restricted users log into the appliance. Your solution must be quickly implemented and easily maintained. What should you do?

A. Store the identifiers of the flagged users in the detection rule logic. Actively monitor for newly flagged users, and add them to the detection rule logic.
B. Use a Google SecOps SOAR global context value to store a list of flagged users with their corresponding time to live values. Use a SOAR job to dynamically build and deploy a new version of the detection rule with the updated list of flagged users.
C. Store the flagged users in a data table column with their corresponding time to live values in a second column. Use row-based comparisons in your detection rule.
D. Ingest the user flags as custom enrichment data using a feed. Use a multi-event detection rule to find logins from users flagged in the entity graph.

問題 #4

You are developing a playbook to respond to phishing reports from users at your company. You configured a UDM query action to identify all users who have connected to a malicious domain.
You need to extract the users from the UDM query and add them as entities in an alert so the playbook can reset the password for those users. You want to minimize the amount of effort required by the SOC analyst. What should you do?

A. Implement an Instruction action from the Flow integration that instructs the analyst to add the entities in the Google SecOps user interface.
B. Create a case for each identified user with the user designated as the entity.
C. Configure a manual Create Entity action from the Siemplify integration that instructs the analyst to input the Entities Identifier parameter based on the results of the action.
D. Use the Create Entity action from the Siemplify integration. Use the Expression Builder to create a placeholder with the usernames in the Entities Identifier parameter.

問題 #5

You are using Google Security Operations (SecOps) to investigate suspicious activity linked to a specific user. You want to identify all assets the user has interacted with over the past seven days to assess potential impact. Your need to understand the user's relationships to endpoints, service accounts, and cloud resources. How should you identify user-to-asset relationships in Google SecOps?

A. Generate an ingestion report to identify sources where the user appeared in the last seven days.
B. Use the Raw Log Scan view to group events by asset ID.
C. Run a retrohunt to find rule matches triggered by the user.
D. Query for hostnames in UDM Search and filter the results by user.

問題與答案：