A security team needs to ingest firewall logs from an on-premises network into Google SecOps. The firewall can only send syslog over UDP. Which ingestion approach should the team use?

Configure a syslog forwarder to receive the UDP syslog and forward it to Google SecOps using the Cloud Logging API.

Configure the firewall to send syslog directly to a Google Cloud Pub/Sub topic.

Use a Cloud Function to listen on a UDP port and forward logs to Google SecOps.

Use the Google SecOps ingestion API to directly receive UDP syslog from the firewall.

A company uses Google Cloud and wants to ingest Cloud Audit Logs into Google SecOps. They also want to minimize the amount of data ingested by excluding logs from a non-production project. What is the best way to achieve this?

Create a log sink that exports only the production project's audit logs to a Pub/Sub topic, then configure Google SecOps to ingest from that topic.

Configure Google SecOps to ingest from the Cloud Logging API directly, filtering out the non-production project.

Export all audit logs to a Cloud Storage bucket and then manually upload them to Google SecOps.

Enable audit logs for all projects and use a parser to filter out non-production logs after ingestion.

What is the purpose of modifying an existing parser in Google SecOps?

To adapt it to a slightly different log format from the same vendor

To increase the speed of log ingestion

To reduce the storage cost of logs

To change the destination of the logs

In Google SecOps, what is the purpose of creating an ingestion label?

To tag ingested logs with metadata for filtering and routing

To compress logs to reduce storage costs

To encrypt logs during ingestion

To authenticate the source of the logs

Which technique is commonly used to normalize log data in Google SecOps?

Using the Universal Data Model (UDM)

Using machine learning to classify logs

Using a relational database to store logs

Using a SIEM-specific query language

Google CloudProfessional Security Operations Engineer

Domain 2Objective 1

2.1 Ingesting Logs for Security Tooling PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Part of the Data management domain, which accounts for 14% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

29questions here

6free pages

8concepts

14%of the exam

Questions 6–10

6foundation · easy
A security team needs to ingest firewall logs from an on-premises network into Google SecOps. The firewall can only send syslog over UDP. Which ingestion approach should the team use?
Select an answer first
7application · medium
A company uses Google Cloud and wants to ingest Cloud Audit Logs into Google SecOps. They also want to minimize the amount of data ingested by excluding logs from a non-production project. What is the best way to achieve this?
Select an answer first
8foundation · easy
What is the purpose of modifying an existing parser in Google SecOps?
Select an answer first
9foundation · easy
In Google SecOps, what is the purpose of creating an ingestion label?
Select an answer first
10foundation · easy
Which technique is commonly used to normalize log data in Google SecOps?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.