CertifyDeckCargando contenido…
Professional Security Operations Engineer · Sample questions
10 real questions from the CertifyDeck Professional Security Operations Engineer bank, spread across the domains of the official Google Cloud Certified Professional Security Operations Engineer skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: D. log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="SetIamPolicy"
The log_id function selects a specific log, and cloudaudit.googleapis.com/activity is the Admin Activity audit log, which records API calls that write configuration or metadata, such as setting an IAM policy; filtering protoPayload.methodName narrows it to SetIamPolicy. The data_access log records reads and user data writes, not policy changes. The UDM-style query uses Google SecOps fields that Logs Explorer does not understand, and filtering Compute Engine error entries on textPayload misses audit logs, whose content is in protoPayload.
Correct answer: B. Create a Livehunt ruleset with the rule, enable it, and review the matches in the IoC Stream.
Livehunt applies your YARA rules to every file that Google Threat Intelligence analyzes and generates a notification when a file matches, and the IoC Stream view lists these notifications so you can study or export them. Daily Retrohunt jobs scan the historical corpus and add repetitive effort instead of continuous monitoring. A SecOps retrohunt searches your own telemetry rather than files analyzed by Google Threat Intelligence, and a Threat Profile recommends threats but doesn't run your rule.
Correct answer: A. Set the service account as the Workload Identity Email and grant the SecOps instance identity Service Account Token Creator on it.
The recommended method for this integration is Workload Identity: the Google SecOps instance identity is granted Service Account Token Creator on the service account and obtains short-lived tokens through impersonation, so no secret is stored. A JSON key works, but it is a static, long-lived secret that the policy forbids. A standard API key does not identify a principal, so IAM cannot authorize the finding updates, and the Owner role breaks least privilege and still leaves authentication unsolved.
Correct answer: C. An attribute condition on the provider, such as assertion.attributes.ipaddr.startsWith('198.51.100.').
An attribute condition is a CEL expression evaluated on the assertion, and only users whose attributes satisfy it can sign in through that workforce provider; the documentation uses exactly an ipaddr prefix check as the example. A data RBAC scope filters which events a signed-in user can see but does not block authentication. Attribute value audit logging only records the values, and a shorter session duration limits token validity without rejecting anyone.
Correct answer: A. Join NETWORK_DNS events with DOMAIN_NAME entities and filter on a low graph.entity.domain.prevalence.rolling_max.
The Entity Context Graph calculates prevalence as derived context; for domains, rolling_max is the maximum daily number of unique internal IP addresses accessing the domain over the previous 10 days, so a rule that joins DNS events with the domain entity and filters on a low value finds rare domains whether or not any feed lists them. Applied Threat Intelligence detections and the IoC Matches tab only cover indicators that a feed already knows. An allowlist in a reference list is exactly the list maintenance the team wants to avoid.
Correct answer: C. Write a YARA-L query for the chart with match on the hash, count_distinct of hosts and ascending order.
Dashboard charts are populated by YARA-L queries, and the statistics syntax supports match to group by a field such as target.process.file.sha256, outcome aggregations such as count_distinct of principal.hostname, and an order section, so sorting ascending surfaces the rarest hashes. The IoC Matches dashboard only shows indicators that a feed already flagged. Risk Analytics ranks entities by risk from findings, and the MITRE ATT&CK coverage dashboard shows detection coverage rather than binary prevalence.
Correct answer: A. On the Feed management page, open the action menu of the feed and select Debug with logs.
Debug with logs, in the action menu of a feed on the Feed management page, opens Logs Explorer in a new tab already filtered for that feed ID, so you see its activity entries and any error details. Raw log search and UDM search query the data that was ingested, which is exactly what is missing, and cannot show why collection failed. The Data Ingestion and Health dashboard shows volumes and errors by log type but not the feed's activity log entries in Cloud Logging.
Correct answer: B. Use the keys that auto-extraction places in the extracted map field, and include metadata.log_type in the searches.
When a log type has no parser, auto-extraction automatically pulls key-value pairs from JSON logs into the UDM map field extracted, which can be used in UDM search, dashboards and YARA-L rules; including metadata.log_type improves search performance. A custom parser is the more complete long-term option but requires the parser code the team wants to avoid. Log Replay re-applies an active parser and does not create mappings, and ingestion labels are metadata attached to logs, not a way to map JSON keys to UDM fields.
Correct answer: C. Assign each network a different asset namespace at ingestion, since enrichment links only assets in the same namespace.
Asset namespaces classify assets that share a network environment, for example to handle overlapping RFC 1918 ranges, and Google SecOps enriches asset events only with assets classified in the same namespace, so separate namespaces keep the aliasing of each network apart. Ingestion labels and data tables only help narrow searches; the underlying aliasing would still merge the assets. Data RBAC scopes control who can see data, not how assets are aliased.
Correct answer: C. Add a Condition flow after the action, with If previous action fails pointing to a branch that emails the identity team.
A Condition flow whose If previous action fails setting points to a dedicated branch lets the playbook continue and take a different set of actions, such as emailing the identity team, when the dependent lookup fails; Google uses this exact Resolve User Owner example. Stopping the playbook fails the keep-running requirement, Skip step continues but nobody is notified, and retries cannot help when the user simply does not exist.
Answer each question before opening the explanation, and write down why you discarded the other options. On Professional Security Operations Engineer, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official Professional Security Operations Engineer format.