2.1 Ingesting Logs for Security Tooling PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is concerned about the cost of ingesting all logs into Google SecOps. They have a mix of high-value security logs and verbose application logs that are rarely used for detection. What is the most cost-effective approach that still maintains security visibility?

   • AIngest only the logs that are required for detection and response, and exclude verbose logs that are not used for security monitoring.
   • BUse a third-party tool to compress logs before ingestion to reduce size.
   • CIngest all logs but set a very short retention period to minimize storage costs.
   • DIngest all logs into Google SecOps and rely on storage tiering to reduce costs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company ingests logs from multiple sources: firewall, Windows Event Logs, and custom applications. They want to enable cross-source correlation in Google SecOps. What is the most important step to achieve this?

   • AUse the same parser for all log sources.
   • BEnsure all logs are normalized to a consistent schema, such as the Universal Data Model (UDM).
   • CIngest all logs into a single bucket in Cloud Storage.
   • DAssign the same label to all ingested logs.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is evaluating a Google SecOps parser for a new log source. The parser is listed as 'beta' and does not extract all fields correctly. The analyst needs to use the logs for detection. What should the analyst do?

   • ACreate a new parser from scratch to replace the beta parser.
   • BUse the parser as-is and rely on raw log search for missing fields.
   • CModify the parser to fix the field extraction issues and test it with sample logs.
   • DWait for the parser to be updated by Google before using it.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the goal of data normalization in Google SecOps?

   • ATo map different log formats to a common schema
   • BTo compress logs to save storage
   • CTo encrypt logs for security
   • DTo delete duplicate logs
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In Google SecOps, what is the purpose of a parser?

   • ATo compress log data to reduce storage
   • BTo route logs to different destinations
   • CTo encrypt log data during transmission
   • DTo convert raw log data into a structured format that can be analyzed
   Reveal Solution Discussion Select an answer first