Professional Security Operations Engineer

Last checked October 22, 2026 against the official Google Cloud exam page.

1. Question 1Platform operations

   A security team must keep Admin Activity audit logs for two years. The logs already land in the _Required bucket, which keeps them for 400 days. What is the most cost-effective way to keep them longer?

   1. AExport the logs to a BigQuery dataset with a two-year table expiration that is set on each query job that reads them
   2. BIncrease the retention of the _Required bucket to two years, since the bucket retention can be set to any value by the owner
   3. CDisable the _Default bucket so that the audit logs stay longer in _Required, which holds the logs for the full period needed
   4. DRoute Admin Activity logs with a log sink to a Cloud Storage bucket with a retention policy and lifecycle rules for two years
   Show answer and explanationHide answer

   Correct answer: D

   Admin Activity logs are kept 400 days in the _Required bucket, whose retention is fixed, so a sink to Cloud Storage with a retention policy and lifecycle rules is the cheap way to keep them longer. The bucket retention cannot be raised to two years, and disabling _Default does not change what _Required keeps.

2. Question 2Detection engineering

   A YARA-L rule must alert when one user logs in from two countries within an hour. Which YARA-L construct supports this?

   1. AA Pub/Sub topic that replays the logs every hour, so that the rule reads each event once in every window
   2. BA regular expression on the raw message only, since each login event is independent of the events before it
   3. CA JSON schema attached to the log source that declares the country field as a numeric code for each login
   4. DA match section with a time window, and a condition that counts distinct country values for the same user
   Show answer and explanationHide answer

   Correct answer: D

   A YARA-L rule can group events by user over a time window and count distinct values, which is how impossible travel is detected. A single regular expression cannot compare events, and a schema or a replay topic does not evaluate the logic of the rule.

3. Question 3Threat hunting

   A threat hunter wants every process and host that connected to a known-bad IP address over the last 30 days in Google SecOps. Which query approach fits?

   1. AA Cloud Logging filter that matches the IP address in exported logs, run once per day against the Cloud Storage bucket
   2. BA UDM search over ingested network events for the IP address field, scoped to the last 30 days of retained data
   3. CA Terraform plan that compares the IP list with the firewall rules and shows which rules would have to change
   4. DA Dataflow job that loads the IP list into Pub/Sub and writes every match to a new topic for later review by hand
   Show answer and explanationHide answer

   Correct answer: B

   A UDM search in Google SecOps queries normalised events across the retention window, so one search can find every process or host that touched the IP. A Logging filter covers only logs still in Cloud Logging, and Terraform and Dataflow do not search events at all.

4. Question 4Data management

   A BigQuery table contains customer email addresses, and analysts should see masked values unless they hold a fine-grained reader role. Which control fits?

   1. ACloud KMS customer-managed keys on the dataset, which hide the stored values from analysts who do not hold the key
   2. BA Cloud Storage bucket lock on the dataset location, so that the masked values cannot be changed by any user at all
   3. CA VPC Service Controls perimeter that limits the analysts to requests that come from one specific subnet of the company
   4. DPolicy tags in Data Catalog with a data masking rule, so users without the fine-grained reader role see masked values
   Show answer and explanationHide answer

   Correct answer: D

   Policy tags classify columns, and a data masking rule returns masked values to users who lack the fine-grained reader role on the tag. KMS keys protect data at rest and do not mask values for authorised readers, while perimeters and bucket locks address other risks.

5. Question 5Incident response

   A compromised VM must be cut off from the network, but its disk must be kept for forensic analysis. What is the best first step?

   1. ADelete the VM so that the malware is removed, and then rebuild the instance from the latest standard operating system image
   2. BChange the firewall rules to deny all traffic to and from the VM, then take a snapshot of its disk for later analysis
   3. CStop the VM and delete its boot disk so that the malware cannot restart when the instance is brought back online later
   4. DGive the VM a public IP address so that responders can connect to it directly and inspect the running processes on it
   Show answer and explanationHide answer

   Correct answer: B

   Denying traffic isolates the host without destroying anything, and a snapshot preserves the disk for forensic analysis. Deleting the VM or its boot disk destroys evidence, and a public IP increases exposure for a host that is already compromised.