Free Professional Security Operations Engineer practice test: 30 questions with answers

Admin Activity logs are kept 400 days in the _Required bucket, whose retention is fixed, so a sink to Cloud Storage with a retention policy and lifecycle rules is the cheap way to keep them longer. The bucket retention cannot be raised to two years, and disabling _Default does not change what _Required keeps.

A VPC Service Controls perimeter blocks API calls that would move data across the perimeter boundary, even when the caller has valid IAM permissions. Cloud Armor filters HTTP traffic to load balancers, and the other two controls do not stop data being copied out through BigQuery APIs.

The disableServiceAccountKeyCreation constraint blocks new user-managed keys across the resources it covers, which pushes teams toward short-lived credentials. The external IP, location and domain constraints each control a different risk and do not stop key creation.

Binary Authorization checks each image against an attestation policy at deploy time, so unsigned or unapproved images are rejected by GKE. Cloud Armor and firewall rules handle network traffic, and Workload Identity controls how workloads authenticate to Google APIs.

IAM Recommender uses observed permission usage to suggest narrower roles, which lets the team remove Owner without guessing what deployments need. Rotating keys or adding another Owner keeps the excess privilege, and moving the role upward widens it.

A YARA-L rule can group events by user over a time window and count distinct values, which is how impossible travel is detected. A single regular expression cannot compare events, and a schema or a replay topic does not evaluate the logic of the rule.

A scoped exclusion removes the known false positive while keeping coverage for everyone else, which is the lowest-risk tuning. Disabling the rule removes coverage, raising severity increases noise, and renaming the account does not change the logic that matches it.

Event Threat Detection writes its detections as findings in Security Command Center, which include the detail, severity and affected resource needed for triage. Billing, serial console and DNS logs do not describe the detection itself.

Parsers map each source's fields into the Unified Data Model, so one detection can run across sources that name fields differently. Reference lists hold lookup values, playbooks automate responses, and Cloud Armor rules act on web requests rather than log schemas.

Running the rule over historical events shows what it would have matched, so the engineer can tune it before it pages anyone. Live alerting tests the on-call team rather than the rule, applying infrastructure code does not measure detection quality, and a single clean VM cannot reveal false negatives.

A UDM search in Google SecOps queries normalised events across the retention window, so one search can find every process or host that touched the IP. A Logging filter covers only logs still in Cloud Logging, and Terraform and Dataflow do not search events at all.

Google Threat Intelligence gives context on hashes, IPs and domains, such as associated actors and campaigns, which helps prioritise the investigation. The other options show the organisation's own exposure or inventory data and carry no external threat context.

Workspace audit logs record sign-in and admin activity for the domain, and forwarding them to Google SecOps lets the analyst search and correlate them. The other sources do not record Workspace sign-ins, so they cannot answer the question.

Grouping by parent and child process and sorting by count surfaces pairs seen only a few times, which is a common sign of unusual activity. Cloud Armor covers web requests, deleting logs destroys evidence, and disk scans do not reveal execution relationships over time.

Audit logs show identity-driven actions such as new keys and role grants, and flow logs show the network paths that lateral movement uses. Billing alerts, marketplace records and console preferences do not reflect movement between resources.

Policy tags classify columns, and a data masking rule returns masked values to users who lack the fine-grained reader role on the tag. KMS keys protect data at rest and do not mask values for authorised readers, while perimeters and bucket locks address other risks.

CMEK gives the customer control over key rotation and disablement in Cloud KMS, and disabling a key makes the protected data unreadable. Default keys are managed by Google, and vendor-held client-side keys or object versioning do not give the customer that control.

Granting secretAccessor on a single secret limits reads to one identity, and audit logs record accesses for review. Editor is far broader than needed, environment variables in templates are visible to anyone who can read the template, and a public secret is exposed to everyone.

A VPC Service Controls perimeter stops data being copied to resources outside it, and Sensitive Data Protection finds and transforms personal data before it spreads. Broad roles, public buckets and disabling audit logs each increase exposure or remove visibility.

An authorized view lets a partner query the aggregated output without holding any permission on the base table, which is the separation the requirement describes. A full copy or dataset-wide viewer role exposes the base data, and an external connection does not solve the access question.

Denying traffic isolates the host without destroying anything, and a snapshot preserves the disk for forensic analysis. Deleting the VM or its boot disk destroys evidence, and a public IP increases exposure for a host that is already compromised.

A playbook step that suspends the account through the identity API contains the compromise quickly, and an approval gate protects senior accounts from false positives. Email leaves the account active, scheduled mass disabling is indiscriminate, and browser blocking does not revoke access from other sessions or clients.

Recording identifiers before containment preserves what the investigation needs, and disabling the key stops its use without deleting the evidence. Deleting the key or the logs destroys the record, and disabling without notes loses details needed to scope the incident.

The alert time and affected identities scope the incident, confirmed retention ensures the logs needed for the investigation still exist, and chain of custody keeps collected evidence usable. Personal contact details shared on social media and untested production changes do not help the investigation and can damage it.

A locked retention policy stops deletion until the retention period ends, and versioning keeps earlier copies if an attacker overwrites objects. Broad editor roles make attack easier, and a short lifecycle rule or public access both remove protection.

Cloud Monitoring collects request and error metrics from Cloud Run, and dashboards and alerting policies on those metrics give the team error-rate visibility. Budget alerts track spend, DNS logs record lookups, and vulnerability scans check images rather than live traffic.

An aggregated sink at the organisation level routes logs from all child projects to one destination, and the source retention still applies. Manual copies and laptop scripts are unreliable and slow, and turning off logs in the sources removes records the business needs.

A metric absence condition alerts when the expected series produces no data for the set duration, which is exactly a check for log silence. Restarting the VM, budget alerts and Armor rules do not detect the absence of data.

Combining the data_access log name with the BigQuery service name selects exactly the read and write entries needed for the sink. Admin activity entries, error severity and Compute Engine resource types select the wrong logs.

A log-based counter metric counts the matching entries and exposes the result as a time series for charts and alerts. Exclusions remove entries, short retention limits history, and spreadsheets are manual and slow.