Managing Operations in a Cloud Solution Environment

A company wants to automate patching of operating system vulnerabilities on their Compute Engine instances. They need a solution that supports both Windows and Linux and can schedule patch deployments with rolling updates. Which service should they use?

A security team needs to detect anomalous outbound traffic from Compute Engine instances. They want to enable logging and analyze the data. Which three steps should they take? (Choose three.)

A security team needs to detect and respond to a potential data exfiltration via VPC Flow Logs. They want to identify traffic to known malicious IP addresses in real-time. Which architecture should they use?

Your organization wants to monitor and audit IAM permission changes in real time. Which type of Cloud Audit Log is enabled by default and cannot be disabled?

Your company uses Security Command Center (SCC) Standard tier and wants to detect threats like cryptocurrency mining or anomalous network behavior in real-time. You need to recommend an upgrade to SCC Premium tier and configure the appropriate module. Which SCC Premium module should be enabled?

A security engineer needs to automatically remediate a high-severity finding in Security Command Center. The remediation involves restarting a Compute Engine instance. What is the recommended approach?

A security engineer needs to archive Cloud Audit Logs for regulatory compliance for 7 years. The logs should be immutable and cost-effective. Which solution should they choose?

A security team is designing an incident response workflow for container threats detected by Security Command Center Premium. They want to automatically capture forensic evidence from compromised GKE nodes. Which THREE steps should they include? (Choose THREE.)

A security team is setting up Binary Authorization for their GKE clusters. They want to enforce that only images signed by an approved attestor can be deployed. Which TWO of the following are required for this setup?

Which Security Command Center tier provides Event Threat Detection and Container Threat Detection?

A security engineer wants to export all Cloud Audit Logs from a Google Cloud project to a BigQuery dataset for long-term analysis. Which type of log sink should be configured?

A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?

An organization wants to use Chronicle for SIEM. They need to ingest logs from an on-premises firewall. Which method should they use?

A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?

An organization uses Security Command Center Premium tier. They want to receive notifications when a finding of type 'Cryptomining' is detected in their Compute Engine instances. What should they configure?

Your organization wants to use Chronicle SIEM to analyze security events from both Google Cloud and on-premises firewalls. They want to normalize firewall logs into a common schema. Which Chronicle feature should they use?

A security engineer wants to review all IAM permission changes made in the last 30 days. Which type of Cloud Audit Log should they query?

Which Google Cloud service should be used for long-term archival of Audit Logs that must be immutable and stored for 10 years for compliance?

A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?

A financial services company uses Security Command Center (SCC) Premium tier to monitor its GCP environment. The security team wants to automatically respond to high-severity threat findings, such as 'Cryptomining' from Event Threat Detection. The response should include isolating the affected VM by removing its external IP and applying a firewall rule to block egress traffic. Which two steps should the team implement? (Choose two.)

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

A company uses Security Command Center (SCC) Premium tier and wants to automatically trigger a Cloud Function to remediate a threat finding. Which approach should they use?

A security engineer is investigating a compromised Compute Engine VM. They need to take a forensic snapshot of the disk without losing any data, including deleted files, and ensure the snapshot is not tampered with. Which steps should they take?

A company wants to use Chronicle to ingest logs from their on-premises firewalls into Google Cloud. They need to normalize logs into a common schema for analysis. Which Chronicle capability should they use?

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

A company needs to archive Cloud Audit Logs for compliance purposes for 7 years. The logs are rarely accessed after the first year. Which storage option is the most cost-effective?

A security engineer wants to monitor all actions that create or modify resources in a Google Cloud project. Which type of audit log is enabled by default and cannot be disabled?

An organization uses Binary Authorization to enforce that only images signed by an approved attestor are deployed in GKE. They want to allow a specific set of images from a trusted registry to bypass the policy. Which Binary Authorization policy type should they use?

A security analyst wants to search for a specific IAM role change across all projects in the organization. Which tool can query Cloud Audit Logs across projects?

A startup uses Cloud SQL for MySQL and wants to implement automated daily backups with a 7-day retention period. The database is 50 GB and experiences moderate write traffic. The team wants to minimize cost and operational overhead. Which two actions should they take? (Choose two.)

A company wants to implement a vulnerability management program for their Google Cloud environment. They need to scan Compute Engine instances for OS vulnerabilities and container images for known vulnerabilities. Which two services should they use? (Choose two.)

An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?

During a forensic investigation, you need to analyze a Compute Engine instance that has been compromised. You want to preserve the disk state for analysis without affecting the running instance. Which action should you take?

Which type of Cloud Audit Logs must be explicitly enabled and incur additional cost?

An organization needs to scan container images stored in Artifact Registry for vulnerabilities before deployment. They want to use a managed service that integrates with their CI/CD pipeline. Which Google Cloud service should they use?

A DevOps team wants to enforce that only container images signed by a specific authority can be deployed in a GKE cluster. They plan to use Binary Authorization. Which configuration is required?

An organization uses Binary Authorization with multiple attestors. They want to allow a deployment only if at least two attestors have signed the image. Which policy type should be used?

Which of the following is a feature available only in Security Command Center Premium tier, not in Standard tier?

A company needs to archive their VPC Flow Logs for 10 years for compliance. They also need to run occasional queries on the logs. What is the most cost-effective approach?

During an incident response, a security engineer needs to analyze a Pub/Sub message that was produced by a Cloud Function triggered by a SCC finding. The message has been acknowledged and deleted from the subscription. How can the engineer retrieve the message again?

A security team wants to scan a web application hosted on Compute Engine for vulnerabilities like XSS and outdated libraries. They want the scan to be authenticated to cover areas behind login. Which Google Cloud service and configuration should they use?

A gaming company deploys a multiplayer game backend on Google Kubernetes Engine (GKE) with multiple microservices. The operations team needs to collect structured logs from containers, analyze them in real-time for anomalies, and store them for 30 days for compliance. They also need to monitor custom application metrics (e.g., player count per game server). Which three Google Cloud services should they use? (Choose three.)

A company wants to scan all container images stored in Artifact Registry for vulnerabilities before deployment. Which Google Cloud service should they use?

Your organization uses VPC Flow Logs for network forensics. During an incident, you need to analyze traffic to a compromised instance for the last 72 hours. The Flow Logs are stored in Cloud Logging. Which approach allows you to query the logs most efficiently?

A developer wants to be notified when a new vulnerability is found in a container image stored in Artifact Registry. Which service should they configure?

Your organization uses VM Manager for patch management. You need to configure patch deployments to run weekly on all Windows VMs. Which two resources must be configured? (Choose two.)

An organization uses Binary Authorization with a GKE cluster that enforces attestation. A developer builds a container and pushes it to Artifact Registry. The image must be signed before it can be deployed. Which steps are required to allow this image to run on the cluster?

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

A security team uses Security Command Center Premium to detect threats. They want to receive real-time notifications when a finding of type 'Threat' with severity 'CRITICAL' or 'HIGH' is created. Which approach should they use?

A security engineer wants to export Cloud Audit Logs to a third-party SIEM in real time. Which log sink destination should they configure?

Which Security Command Center tier includes Event Threat Detection and Container Threat Detection?

A company runs containerized applications on GKE and uses Binary Authorization. They want to enforce that only images from a specific Artifact Registry repository can be deployed, and those images must be signed by a trusted attestor. Which THREE configurations are required?

Which Google Cloud SIEM solution ingests logs from various sources, normalizes them into the Unified Data Model (UDM), and allows detection using YARA-L rules?

A security analyst needs to mute a recurring false positive finding in Security Command Center so that it no longer appears in the active findings list. The analyst wants to keep the finding for historical reference. What should they do?

A company wants to use Cloud Audit Logs to monitor for security incidents. They need to retain logs for 6 months for analysis and then archive them for 5 years. Which TWO steps should they take?

A company is using Security Command Center (SCC) Standard tier and wants to detect threats like crypto mining attacks and anomalous IAM activity in their GCP environment. Which built-in service should they enable?

A security team wants to automatically detect anomalies in user behavior across Google Workspace and Google Cloud. Which TWO Security Command Center features can help?

Your company has hundreds of GKE clusters across multiple projects. You need to ensure that all clusters have Container Threat Detection enabled. Which approach is most scalable?

An organization wants to detect and respond to potential data exfiltration attempts via VPC Flow Logs. They plan to export VPC Flow Logs to BigQuery for analysis. Which TWO actions should they take to enable this? (Choose TWO.)

An organization wants to use Security Command Center to detect misconfigurations in their Google Cloud resources. They need a service that can automatically check for common security issues like open firewall ports and IAM policy violations. Which SCC feature should they enable?

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

Which Security Command Center (SCC) tier provides built-in compliance monitoring for standards like CIS and PCI DSS?

A security team wants to analyze VPC Flow Logs to investigate a potential data exfiltration incident. The logs are currently stored in Cloud Logging. What is the MOST efficient method to query and visualize the network traffic patterns?

An organization wants to use Web Security Scanner to find vulnerabilities in their web application. Which TWO finding types can Web Security Scanner detect?

A company uses Chronicle as their SIEM. They need to ingest logs from an on-premises firewall that does not support direct integration with Chronicle. What is the recommended approach to ingest these logs?

A security team wants to use Web Security Scanner to find vulnerabilities in their web application hosted on Compute Engine. They need to scan the public-facing URL weekly and receive a report of findings. Which configuration is required?

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?

A company is using Security Command Center (SCC) Premium tier and wants to automatically remediate certain high-severity findings. Which two services can be used together to achieve this? (Choose two.)

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

A company wants to enforce that all GKE clusters in their organization use Binary Authorization with a specific attestor. They have multiple projects and want to set this policy centrally. Which approach should they use?

A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)

A security engineer is investigating a potential data exfiltration incident. They suspect that a compromised VM is sending sensitive data to an external IP. Which three data sources should they examine to trace the exfiltration? (Choose three.)

An organization needs to centralize audit logs from multiple Google Cloud projects into a BigQuery dataset for long-term analysis. They also want to retain raw logs in Cloud Storage for archival purposes. What is the most efficient way to accomplish this?

You need to configure automated remediation for high-severity SCC findings. When a finding of type 'VULNERABILITY' with severity 'HIGH' is created, a Cloud Function should execute a script to patch the vulnerable VM. Which architecture is correct?

A company enforces Binary Authorization on a GKE cluster. They want to require that all container images be signed by a specific attestor located in a different project. What must be configured?