A company is planning to ingest logs into Google SecOps. They have a limited budget and want to reduce costs without losing critical security visibility. They have identified that a large portion of their logs are verbose debug logs from a development environment. What is the best strategy?

Exclude the development environment logs from ingestion and focus on production logs that are relevant for security.

Ingest all logs but compress them before sending to Google SecOps.

Ingest all logs but set a very short retention period to reduce storage costs.

Ingest all logs and use a parser to filter out debug logs after ingestion.

A security team wants to make it easier to search for logs from a specific business unit in Google SecOps. They have already ingested logs from various sources. What should they do?

Store logs from different business units in separate buckets.

Create a separate Google SecOps instance for each business unit.

Apply a custom label to the ingested logs that identifies the business unit.

Modify the parser to include the business unit in the log message text.

A security team is setting up Google SecOps for a new environment. They want to ensure they have the logs needed to detect unauthorized access attempts. Which logs should they prioritize ingesting?

Only Cloud Audit Logs from the Google Cloud project.

Only application logs from custom applications.

Only DNS logs from the corporate DNS server.

Authentication logs from identity providers and VPC flow logs.

A company uses a third-party SIEM and wants to migrate to Google SecOps. They have a large volume of historical logs stored in Cloud Storage. They want to ingest these logs into Google SecOps for analysis. What is the most efficient way to do this?

Use the Google SecOps API to bulk ingest logs from Cloud Storage.

Create a log sink that exports the historical logs to a Pub/Sub topic and configure Google SecOps to ingest from that topic.

Use a Google SecOps feed to ingest logs directly from Cloud Storage.

Manually download the logs and upload them through the Google SecOps console.

In Google SecOps, what is the purpose of applying labels to ingested data?

To enhance searchability and correlation

Google CloudProfessional Security Operations Engineer

Domain 2Objective 1

2.1 Ingesting Logs for Security Tooling PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Part of the Data management domain, which accounts for 14% of the PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER exam.

29questions here

6free pages

8concepts

14%of the exam

Questions 21–25

21expert · hard
A company is planning to ingest logs into Google SecOps. They have a limited budget and want to reduce costs without losing critical security visibility. They have identified that a large portion of their logs are verbose debug logs from a development environment. What is the best strategy?
Select an answer first
22application · medium
A security team wants to make it easier to search for logs from a specific business unit in Google SecOps. They have already ingested logs from various sources. What should they do?
Select an answer first
23application · medium
A security team is setting up Google SecOps for a new environment. They want to ensure they have the logs needed to detect unauthorized access attempts. Which logs should they prioritize ingesting?
Select an answer first
24application · medium
A company uses a third-party SIEM and wants to migrate to Google SecOps. They have a large volume of historical logs stored in Cloud Storage. They want to ingest these logs into Google SecOps for analysis. What is the most efficient way to do this?
Select an answer first
25foundation · easy
In Google SecOps, what is the purpose of applying labels to ingested data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER” is a trademark of its owner, used for identification only.