A security team wants to tag all logs from a specific compliance scope (e.g., PCI DSS) to make it easier to run compliance reports. They have already ingested the logs. What should they do?

Store PCI logs in a separate Cloud Storage bucket.

Apply a label 'compliance_scope: PCI' to the relevant logs.

Modify the parser to add the compliance scope to the log message.

Create a separate Google SecOps instance for PCI logs.

A security team wants to enable Google SecOps to detect potential malicious activity in their Google Cloud environment. They have already enabled Cloud Logging for their projects. What is the most efficient way to start ingesting relevant logs into Google SecOps?

Enable the Security Command Center integration with Google SecOps to automatically forward findings and selected logs.

Use the Google Cloud CLI to manually copy log files from Cloud Logging to Google SecOps on a daily basis.

Create a log sink in Cloud Logging that exports all logs to a Pub/Sub topic, then configure Google SecOps to subscribe to that topic.

Enable the Security Command Center Event Threat Detection service, which automatically sends all logs to Google SecOps without additional configuration.

When evaluating an existing parser in Google SecOps for a new log source, what is the first thing to check?

Whether the parser is compatible with all log sources

Whether the parser is the newest version

Whether the parser is open-source

Whether the parser can correctly extract the key fields from the log format

Which strategy can help reduce log ingestion costs in Google SecOps?

Filtering out low-value logs before ingestion

Increasing the retention period

Storing logs in a cheaper storage class

Using a higher compression algorithm

A security team ingests logs from multiple sources that use different field names for the same concept (e.g., 'src_ip', 'source_ip', 'src'). They want to enable effective correlation in Google SecOps. What is the best approach?

Create a separate label for each source IP field name.

Use the UDM mapping in parsers to map all source IP fields to the standard 'src.ip' field.

Store logs in separate buckets and correlate manually.

Use a search query that checks all possible field names.

Google CloudProfessional Security Operations Engineer

Domain 2Objective 1

2.1 Ingesting Logs for Security Tooling PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Part of the Data management domain, which accounts for 14% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

29questions here

6free pages

8concepts

14%of the exam

Questions 16–20

16application · medium
A security team wants to tag all logs from a specific compliance scope (e.g., PCI DSS) to make it easier to run compliance reports. They have already ingested the logs. What should they do?
Select an answer first
17application · medium
A security team wants to enable Google SecOps to detect potential malicious activity in their Google Cloud environment. They have already enabled Cloud Logging for their projects. What is the most efficient way to start ingesting relevant logs into Google SecOps?
Select an answer first
18foundation · easy
When evaluating an existing parser in Google SecOps for a new log source, what is the first thing to check?
Select an answer first
19foundation · easy
Which strategy can help reduce log ingestion costs in Google SecOps?
Select an answer first
20expert · hard
A security team ingests logs from multiple sources that use different field names for the same concept (e.g., 'src_ip', 'source_ip', 'src'). They want to enable effective correlation in Google SecOps. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.