Google Cloud Certified - Professional Security Operations Engineer (PSOE) - Security-Operations-Engineer Free Exam Questions [2026]

QUESTION NO: 1
Your organization requires the SOC director to be notified by email of escalated incidents and their results before a case is closed. You need to create a process that automatically sends the email when an escalated case is closed. You need to ensure the email is reliably sent for the appropriate cases. What process should you use?

A. Use the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director.

B. Navigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director Use the Close Case action in the UI to close the case.

C. Write a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director.

D. Create a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

QUESTION NO: 2
You have been tasked with developing a new response process in a playbook to contain an endpoint. The new process should take the following actions:
- Send an email to users who do not have a Google Security Operations (SecOps) account to request approval for endpoint containment
- Automatically continue executing its logic after the user responds
You plan to implement this process in the playbook by using the Gmail integration. You want to minimize the amount of effort required by the SOC analyst. What should you do?

A. Generate an approval link for the containment action and include the placeholder in the body of the 'Send Email' action. Configure additional playbook logic to manage approved or denied containment actions.

B. Set the containment action to 'Manual' and assign the action to the user to execute or skip the containment action.

C. Set the containment action to 'Manual' and assign the action to the appropriate tier. Contact the user by email to request approval. The analyst chooses to execute or skip the containment action.

D. Use the 'Send Email' action to send an email requesting approval to contain the endpoint, and use the 'Wait For Thread Reply' action to receive the result. The analyst manually contains the endpoint.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

QUESTION NO: 3
Your Google Security Operations (SecOps) case queue contains a case with IP address entities.
You need to determine whether the entities are internal or external assets and ensure that internal IP address entities are marked accordingly upon ingestion into Google SecOps SOAR.
What should you do?

A. Modify the connector logic to perform a secondary lookup against your CMDB and flag incoming entities as internal or external.

B. Configure a feed to ingest enrichment data about the networks, and include these fields into your detection outcome.

C. Indicate your organization's known internal CIDR ranges in the Environment Networks list in the settings.

D. Create a custom action to ping the IP address entity from your Remote Agent. If successful, the custom action designates the IP address entity as internal.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

QUESTION NO: 4
You are configuring role-based data access controls for two groups of users in Google Security Operations (SecOps). Group A requires access to all data, and Group B requires access to all data except data from the "restricted" namespace. You need to configure access for these two groups. What should you do? (Choose two.)

A. Create a new data access scope to allow access to the "restricted" namespace data for Group A.
Assign this data scope to Group A in IAM.

B. Create a new data access scope in the Google SecOps SIEM settings to allow access to all data and exclude the "restrict" namespace data for Group B. Assign this data access scope to Group B in IAM.

C. Create a custom label with a UDM query to include all data except the "restricted" namespace data for Group B. Assign this data label to Group B in IAM.

D. Create a custom label with a UDM query to include all labels for Group A. Assign this data label to Group A in IAM.

E. Create a new data access scope in the Google SecOps SIEM settings to allow access to all data for Group A. Assign this data access scope to Group A in IAM.

Discussion 0

Correct Answer: B,E Vote an answer

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

QUESTION NO: 5
You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?

A. Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.

B. Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.

C. Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.

D. Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

QUESTION NO: 6
During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of
30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?

A. Change the default case assignment logic to route all phishing alerts to the Tier 2 team.

B. Update the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.

C. Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.

D. Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

QUESTION NO: 7
You are planning log onboarding for a Google Security Operations (SecOps) SIEM deployment in a cloud-heavy enterprise environment. The detection engineering team is requesting log sources that support visibility into:
- User identity behavior
- Lateral movement
- Privilege escalation attempts
You need to determine which telemetry sources are ingested first. Which log source should you prioritize?

A. Network firewall logs

B. IAM logs

C. EDR logs

D. Cloud access security broker (CASB) logs

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Actual4test members. You can sign-up / login (it's free).

QUALITY AND VALUE

Tested and Approved

Easy to Pass

Try Before Buy

RECENT DISCUSSIONS

Useful Links

Contact Us