Free GCP-PSOE sample questions

Correct answer: Assign the 'Chronicle Viewer' role to the Tier 1 group.

The 'Chronicle Viewer' role provides read-only access to the Google Security Operations platform. This allows analysts to search UDM data, view detections, and access dashboards without granting permissions to modify configurations, rules, or parsers, aligning perfectly with the Principle of Least Privilege for Tier 1 analysts.

Correct answer: Enable the native 'Security Command Center' ingestion integration directly within the Google Security Operations settings.

Google Security Operations (SecOps) provides a native, direct integration for Security Command Center (SCC). Enabling this feature in the SecOps settings allows findings to flow directly without the need for intermediate infrastructure like Pub/Sub or Forwarders, reducing latency and operational complexity.

Correct answer: The analyst has not been assigned a specific User Role within the SOAR Settings in the Google Security Operations console.

Google Security Operations SOAR maintains its own internal Role-Based Access Control (RBAC) separate from the main Google Cloud IAM roles used for the SIEM/Search interface. Even if a user has IAM access to the platform, they must be explicitly provisioned and assigned a role within the SOAR module settings to access SOAR features like playbooks and cases.

Correct answers: Use a Service Account Key JSON file downloaded from Google Cloud.; Use Workload Identity Federation to exchange an on-premises credential for a Google Cloud access token.

For on-premises workloads where Workload Identity Federation is not configured, a Service Account Key (JSON) is a standard method to authenticate to Google Cloud APIs.

Workload Identity Federation is the recommended best practice for external workloads. It allows the on-prem service to exchange external credentials (like OIDC or SAML) for a Google Cloud access token without managing long-lived service account keys.

Correct answer: Ensure Cloud IDS logs are ingested into Google SecOps and normalized into UDM, enabling correlation on common fields like `principal.ip`.

To correlate data in Google SecOps, disparate log sources must be ingested and normalized into the Unified Data Model (UDM). Once Cloud IDS logs are mapped to UDM fields (e.g., `principal.ip` or `target.ip`), they can be joined with endpoint logs sharing those same IPs in detection rules or searches.

Correct answer: True

Ingestion labels in Google SecOps can be used to tag data streams. These labels can then be leveraged in ingestion filters to include or exclude specific data, effectively managing costs and data relevance.