A security architect is designing a data lake for security analytics. They need to ensure that both event data and entity data are stored appropriately to support detection and investigation. Which design decision best supports this requirement?

Store event data in a time-series database and entity data in a relational database, and join them at query time using aliasing fields.

Store all data in a single flat file format and load it into memory for analysis.

Store event data and entity data in separate data lakes with no ability to join them.

Store entity data in a time-series database and event data in a relational database.

Which of the following is an example of an event data source used for security monitoring?

Active Directory user attributes

Identity provider group memberships

Which of the following is a primary source of entity data that provides organizational context such as user roles, group memberships, and department information?

Intrusion detection system alerts

Google CloudProfessional Security Operations Engineer

Domain 2Objective 2

2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Part of the Data management domain, which accounts for 14% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

32questions here

7free pages

7concepts

14%of the exam

Questions 21–25

21expert · hard
A security architect is designing a data lake for security analytics. They need to ensure that both event data and entity data are stored appropriately to support detection and investigation. Which design decision best supports this requirement?
Select an answer first
22foundation · easy
Which of the following is an example of an event data source used for security monitoring?
Select an answer first
23application · medium
A security analyst is investigating a possible brute-force attack on a web application. Which event data source would provide the most relevant information about the authentication attempts?
Select an answer first
24foundation · easy
Which of the following is a primary source of entity data that provides organizational context such as user roles, group memberships, and department information?
Select an answer first
25application · medium
A security team wants to enrich network flow logs with the application name associated with each connection. The application inventory maps IP addresses to application names. Which aliasing field should be used to join the network flow logs with the application inventory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.

2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Questions 21–25

A security architect is designing a data lake for security analytics. They need to ensure that both event data and entity data are stored appropriately to support detection and investigation. Which design decision best supports this requirement?

Which of the following is an example of an event data source used for security monitoring?

A security analyst is investigating a possible brute-force attack on a web application. Which event data source would provide the most relevant information about the authentication attempts?

Which of the following is a primary source of entity data that provides organizational context such as user roles, group memberships, and department information?

A security team wants to enrich network flow logs with the application name associated with each connection. The application inventory maps IP addresses to application names. Which aliasing field should be used to join the network flow logs with the application inventory?

Keep studying — Data management