Sign in

Free PSOE sample questions

Real questions from the Professional Security Operations Engineer 2026 practice bank, with the correct answer and an explanation for each one. No junk, no filler.

Try them in the simulator Same questions, with study, timed and flashcard modes.

Showing 10 of 20 free sample questions.

Question 1Choose one

You are writing a YARA-L detection rule to identify potential brute-force attacks. You want to trigger a detection when a user fails to login 10 times within a 5-minute window, followed by a successful login. Which section of the YARA-L rule is responsible for defining the time window logic?

Question 2Choose one

While investigating an incident in Google SecOps, you need to determine if a specific file hash has been seen in your environment over the past 12 months. However, your hot storage retention is only 6 months. Which feature should you use to search older data?

Question 3Choose one

A financial services company processes sensitive transactions. You need to configure a Google SecOps SOAR playbook that requires human approval before isolating a critical payment server during a suspected incident. Which playbook action should you utilize?

Question 4Choose 2

Select TWO primary benefits of using Workforce Identity Federation when configuring access to Google Cloud security tools for your operations team.

Question 5Choose one

You are investigating a data exfiltration incident. You have identified a suspicious IP address communicating with your Compute Engine instances. You want to visualize the flow of traffic to understand which internal assets communicated with this IP over the last 48 hours. Which Google SecOps feature provides this visualization?

Question 6Choose one

True or False: In Google SecOps, the 'silent source detection' feature automatically alerts you when a log source that was previously sending data stops sending data for a specified period.

Question 7Choose one

You are creating a dashboard in Looker Studio to visualize security metrics from Google SecOps. You need to join security alerts with HR data to display alerts by department. The HR data is updated daily and stored in a CSV file in Cloud Storage. What is the most efficient way to achieve this?

Question 8Choose one

A new zero-day vulnerability has been announced. The CISO asks you to determine if any internal hosts have communicated with a list of 50 known bad IP addresses associated with this threat over the past 30 days. Which Google SecOps feature is designed to perform this retrospective analysis most efficiently?

Question 9Choose one

You are configuring a Google SecOps SOAR playbook to handle phishing alerts. You need to extract the URL from the alert, scan it with VirusTotal, and if the reputation score is bad, block the domain on the firewall. Which SOAR concept handles the data transfer of the URL from the 'Trigger' phase to the 'VirusTotal Action' phase?

Question 10Choose one

Case Study: A retail company uses Google Cloud for their e-commerce platform. They have enabled Cloud Audit Logs for all services. Recently, they noticed a spike in 'Permission Denied' errors in the logs. You suspect an internal service account has been compromised and is attempting to access resources it shouldn't. Which specific log stream and filter in Logs Explorer would best help you isolate the source of these failed API calls?

10 more free samples are waiting

Create a free account to unlock the whole PSOE sample bank, or get full access to all 299 practice questions in the simulator.

Create account