2.1 Ingesting Logs for Security Tooling PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   Which type of log is essential for detecting unauthorized access attempts in a Google Cloud environment?

   • ACloud DNS Logging
   • BVPC Flow Logs
   • CCloud Audit Logs
   • DFirewall Rules Logging
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is setting up Google SecOps for a new client. They need to detect brute-force attacks. Which logs are essential to ingest?

   • AOnly Cloud Audit Logs from the cloud provider.
   • BAuthentication logs from the identity provider and firewall logs.
   • COnly application logs from the web server.
   • DOnly DNS logs from the internal DNS server.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of assessing which logs are necessary for detection and response in security tools?

   • ATo ensure relevant data is collected while minimizing noise and cost
   • BTo eliminate the need for manual analysis
   • CTo maximize the volume of data ingested
   • DTo comply with all regulatory requirements
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In Google SecOps, what is the recommended way to handle a custom log format that is not supported by existing parsers?

   • AUse a generic parser that ignores unknown fields
   • BCreate a custom parser using the parser development tools
   • CIngest the logs as raw text and analyze them manually
   • DModify the log source to output a standard format
   Reveal Solution Discussion Select an answer first