Google Cloud Certified Professional Security Operations Engineer Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  Its not C. The scenario describes a triage/prioritization failure — too many alerts firing, analysts drowning, real positives getting buried in the pile. That's a volume and prioritization problem. IOC matching (IPs, domains, hashes) doesn't fix that — it's a detection mechanism, not a context/prioritization one. It changes whether a rule fires, not how a SOC analyst decides which of the already-firing alerts to work first.

• Chose C2

  From CMDB you will just solve priority not volume. D helps with detection logic, C is the right one as this directly helps with volume by validating suspicious entities.

• Chose A3

  Correct tag and label will help to prioritize and reduce false +ve