Security-Operations-Engineer Exam Study Guide Free Practice Test LAST UPDATED DATE Jun 07, 2026
The New Security-Operations-Engineer 2026 Updated Verified Study Guides & Best Courses
NEW QUESTION # 60
You are the SOC manager at a large enterprise that uses Google Security Operations (SecOps).
You need to create a report that shows the Return on Investment (ROI) attributed to analyst activities in Google SecOps SOAR for the previous month. The report should include the time saved and efficiency gains from using SOAR's features. You need to generate this report using the most efficient and accurate approach while providing the required level of detail. What should you do?
- A. Develop a Google SecOps SOAR playbook that automatically aggregates analyst performance metrics, incorporates custom weighted factors for different case types, calculates ROI based on predefined formulas, and generates a PDF report on a monthly schedule.
- B. Use the ROI - Analysts Benchmark report in SOAR Reports. Configure the report to display data for the desired time period, and filter by individual analysts.
- C. Use the filters and visualizations in the Management - SOC Status report in SOAR Reports to extract case-specific performance data.
- D. Create a custom Google SecOps SOAR search query that filters for all cases handled by specific analysts in the last month. Export the results to a spreadsheet for analysis and ROI calculation.
Answer: B
Explanation:
The most efficient and accurate method is to use the ROI - Analysts Benchmark report in SOAR Reports. This built-in report automatically calculates time saved and efficiency gains from SOAR features, allows filtering by analyst and time period, and avoids the need for manual queries or custom playbook development while delivering the required ROI insights.
NEW QUESTION # 61
Your organization has a standard set of Google Security Operations (SecOps) playbooks that are applied to alerts in different circumstances. One playbook uses an "All" trigger that should always be applied if no other more specific playbooks have triggered. You need to ensure that the more specific playbook is attached and not the generic "All" playbook when multiple triggers match.
What should you do?
- A. Set the priority of the "All" playbook to a higher value than the priority of the specific playbook to ensure the "All" trigger is evaluated after the previous priorities.
- B. Change the "All" trigger to be more precise so that it doesn't trigger when the other playbook is needed.
- C. In the Outcomes section of the detection rule that is firing your alert, add a specific field to search for the specific playbook to base the trigger on.
- D. Create a tagging rule in the Google SecOps SOAR settings, and use a tag trigger to trigger the specific playbook.
Answer: A
Explanation:
Set the priority of the "All" playbook to a higher value than the priority of the specific playbook. In Google SecOps, playbook triggers are evaluated by priority. By assigning a higher numerical priority (which means lower precedence) to the "All" playbook, you ensure that more specific playbooks with lower numerical priorities (higher precedence) will be attached and executed first when multiple triggers match, and the generic "All" playbook will only be used if no specific playbook applies.
NEW QUESTION # 62
Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?
- A. Configure a rule exclusion for the target.domain field.
- B. Configure a rule exclusion for the target.ip field.
- C. Configure a rule exclusion for the principal.ip field.
- D. Configure a rule exclusion for the network.asset.ip field.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
The correct solution is Option B. This is a common false positive tuning scenario.
The "high priority network indicators" rule set triggers when it sees a connection to or from a known- malicious IP or domain. The problem states the false positives are coming from the on-premises proxy servers.
This implies that the proxy server itself is initiating traffic that matches these indicators. This is often benign, legitimate behavior, such as:
* Resolving a user-requested malicious domain via DNS to check its category.
* Performing an HTTP HEAD request to a malicious URL to scan it.
* Fetching its own threat intelligence or filter updates.
In all these cases, the source of the network connection is the proxy server. In the Unified Data Model (UDM), the source IP of an event is stored in the principal.ip field.
To eliminate these false positives, you must create a rule exclusion (or add a not condition to the rule) that tells the detection engine to ignore any events where the principal.ip is the IP address of your trusted proxy servers. This will not affect the rule's ability to catch a workstation behind the proxy (whose IP would be the principal.ip) connecting through the proxy to a malicious target.ip.
Exact Extract from Google Security Operations Documents:
Curated detection exclusions: Curated detections can be tuned by creating exclusions to reduce false positives from known-benign activity. You can create exclusions based on any UDM field.
Tuning Network Detections: A common source of false positives for network indicator rules is trusted network infrastructure, such as proxies or DNS servers. This equipment may generate traffic to malicious domains or IPs as part of its normal operation (e.g., DNS resolution, content filtering lookups). In this scenario, the traffic originates from the infrastructure device itself. To filter this noise, create an exclusion where the principal.ip field matches the IP address (or IP range) of the trusted proxy server. This prevents the rule from firing on the proxy's administrative traffic while preserving its ability to detect threats from end-user systems.
References:
Google Cloud Documentation: Google Security Operations > Documentation > Detections > Curated detections > Tune curated detections with exclusions Google Cloud Documentation: Google Security Operations > Documentation > Detections > Overview of the YARA-L 2.0 language
NEW QUESTION # 63
Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?
- A. Configure and deploy a Bindplane collection agent.
- B. Configure a third-party API feed in Google SecOps.
- C. Configure direct ingestion from your Google Cloud organization.
- D. Configure and deploy a Google SecOps forwarder.
Answer: D
Explanation:
To ingest logs from an on-premises source like MySQL into Google Security Operations (SecOps), you need a secure and supported way to forward those logs to the cloud. The recommended method is to deploy a Google SecOps forwarder on-premises. The forwarder collects logs from local sources (databases, syslog, etc.) and securely sends them to SecOps.
NEW QUESTION # 64
You are configuring role-based data access controls for two groups of users in Google Security Operations (SecOps). Group A requires access to all data, and Group B requires access to all data except data from the "restricted" namespace. You need to configure access for these two groups. What should you do? (Choose two.)
- A. Create a new data access scope to allow access to the "restricted" namespace data for Group A.
Assign this data scope to Group A in IAM. - B. Create a custom label with a UDM query to include all labels for Group A. Assign this data label to Group A in IAM.
- C. Create a new data access scope in the Google SecOps SIEM settings to allow access to all data for Group A. Assign this data access scope to Group A in IAM.
- D. Create a new data access scope in the Google SecOps SIEM settings to allow access to all data and exclude the "restrict" namespace data for Group B. Assign this data access scope to Group B in IAM.
- E. Create a custom label with a UDM query to include all data except the "restricted" namespace data for Group B. Assign this data label to Group B in IAM.
Answer: C,D
Explanation:
Create a data access scope in SecOps SIEM to allow Group A access to all data, and assign it via IAM. This ensures Group A has full visibility.
Create a data access scope that allows Group B to access all data except the "restricted" namespace, and assign it via IAM. Data access scopes in SecOps control what data each group can view, enabling precise role-based access control.
NEW QUESTION # 65
Your third-party application data is published in a Pub/Sub topic located in a separate Google Cloud project from your Google Security Operations (SecOps) instance. Your attempts to push data from the Pub/Sub topic to Google SecOps have failed. You need to send this data into Google SecOps in a low-latency, robust way. What should you do?
- A. Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.
- B. Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.
- C. Push the data to Cloud Logging, and modify the export filter in direct ingestion.
- D. Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.
Answer: D
Explanation:
The recommended low-latency and robust method to ingest third-party Pub/Sub data into Google Security Operations (SecOps) is to create a Cloud Run function subscribed to the Pub/Sub topic.
The function can process each message and forward it securely using a Google SecOps Ingestion API key. This design handles cross-project integration cleanly, provides fault tolerance and scalability, and ensures near real-time ingestion into SecOps.
NEW QUESTION # 66
You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?
- A. Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
- B. Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
- C. Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
- D. Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Answer: D
Explanation:
To detect data exfiltration attempts from sensitive Cloud Storage buckets and BigQuery datasets using ETD, you only need "data read" audit logs. These logs capture access and read events (which indicate potential exfiltration). Enabling them only for the designated sensitive resources minimizes Cloud Logging costs while still providing the necessary visibility for detections.
NEW QUESTION # 67
A security analyst wants to detect lateral movement between Compute Engine instances using valid credentials. Which data source is MOST useful?
- A. Cloud Load Balancer logs
- B. Identity-aware Proxy logs
- C. VPC Flow Logs
- D. Compute Engine serial console output
Answer: C
Explanation:
VPC Flow Logs reveal internal east-west traffic patterns that can expose lateral movement behavior.
NEW QUESTION # 68
You are a SOC manager guiding an implementation of your existing incident response plan (IRP) into Google Security Operations (SecOps). You need to capture time duration data for each of the case stages. You want your solution to minimize maintenance overhead. What should you do?
- A. Create a Google SecOps dashboard that displays specific actions that have been run, identifies which stage a case is in, and calculates the time elapsed since the start of the case.
- B. Write a job in the IDE that runs frequently to check the progress of each case and updates the notes with timestamps to reflect when these changes were identified.
- C. Configure Case Stages in the Google SecOps SOAR settings, and use the Change Case Stage action in your playbooks that captures time metrics when the stage changes.
- D. Configure a detection rule in SIEM Rules & Detections to include logic to capture the event fields for each case with the relevant stage metrics.
Answer: C
Explanation:
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
This requirement is a core, out-of-the-box feature of the Google SecOps SOAR platform. The solution with the minimal maintenance overhead is always the native, built-in one. The platform is designed to measure SOC KPIs (like MTTR) by tracking Case Stages.
A SOC manager first defines their organization's incident response stages (e.g., "Triage," "Investigation,"
"Remediation") in the SOAR settings. Then, as playbooks are built, the Change Case Stage action is added to the workflow. When a playbook runs, it triggers this action, and the SOAR platform automatically timestamps the exact moment a case transitions from one stage to the next.
This creates the precise time-duration data needed for metrics. This data is then automatically available for the built-in dashboards and reporting tools (as mentioned in Option A, which is the result of Option B). Option D (custom IDE job) and Option C (detection rule) are incorrect, high-maintenance, and non-standard ways to accomplish a task that is a fundamental feature of the SOAR platform.
(Reference: Google Cloud documentation, "Google SecOps SOAR overview"; "Get insights from dashboards and reports"; "Manage playbooks")
NEW QUESTION # 69
You are responsible for managing threat intelligence and IOC lists in your organization. You have compiled a list of IOCs from recent incidents. You want to quickly and efficiently share the IOCs with other teams for collaboration and integration into their operational processes. What should you do?
- A. Create a new threat graph in Google Threat Intelligence, and share the graph with the other teams.
- B. Add the IOCs to a collection in Google Threat Intelligence, and share the collection with the other teams.
- C. Export the IOCs from Google Threat Intelligence in CSV or JSON format, and email the file to the other teams.
- D. Create a list in Google Security Operations (SecOps), and grant the required access to the other teams.
Answer: D
Explanation:
The most efficient and collaborative approach is to create a reference list in Google SecOps and grant access to the other teams. This allows teams to directly use the IOCs in detection rules, playbooks, and investigations without manual file transfers, ensuring the data is consistently available and up-to-date across operational processes.
NEW QUESTION # 70
You are developing a security strategy for your organization. You are planning to use Google Security Operations (SecOps) and Google Threat Intelligence (GTI). You need to enhance the detection and response across multi-cloud and on-premises systems. How should you integrate these products? (Choose two.)
- A. Ingest GTI IOCs into Google SecOps as security events.
- B. Use Google SecOps SOAR integrations with GTI for event enrichment.
- C. Ingest on-premises and cloud security logs into Google SecOps SIEM as events.
- D. Use Google SecOps SOAR integrations with GTI for entity enrichment.
- E. Ingest on-premises and cloud security logs into Google SecOps SIEM as entities.
Answer: B,C
Explanation:
Ingest on-premises and cloud security logs into Google SecOps SIEM as events - This provides visibility across all environments (multi-cloud and on-prem) and forms the foundation for detection.
Use Google SecOps SOAR integrations with GTI for event enrichment - GTI adds global threat context (IOCs, actor campaigns, TTPs) to ingested events, enhancing detection and response.
NEW QUESTION # 71
During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of
30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?
- A. Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the Tier 2 analysts, and the SOC manager every five minutes until the case is manually reassigned.
- B. Change the default case assignment logic to route all phishing alerts to the Tier 2 team.
- C. Build a playbook that automatically ingests reported phishing emails, enriches entities with threat intelligence, determines the impact and assigns the case for review.
- D. Update the playbook to automatically close phishing cases after 60 minutes if no manual response has occurred.
Answer: A
Explanation:
To ensure timely escalation for high-priority phishing incidents, you should configure a SOAR notification loop that sends escalating alerts to Tier 1 analysts, Tier 2 analysts, and the SOC manager at regular intervals until the case is reassigned or acted upon. This enforces SLA compliance and ensures that delays do not allow threats to propagate, optimizing the case management workflow without relying solely on manual escalation.
NEW QUESTION # 72
You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?
- A. Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data.
- B. Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious.
- C. Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time.
- D. Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.
Answer: D
Explanation:
The most effective and efficient approach is to ingest threat intelligence platform (TIP) logs and build a multi-event rule in Google SecOps that correlates domains found in your NDR logs with your TIP's known malicious domains. This method quickly narrows detection scope to high- confidence IOCs, reduces noise, and minimizes cost and complexity compared to manual enrichment or additional monitoring services.
NEW QUESTION # 73
A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts. The rule was designed to detect suspicious Cloud Storage enumeration by triggering an alert whenever the storage.
objects.list API operation is called using the api.operation UDM field. However, a legitimate backup automation tool that uses the same API, causing the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while still detecting potentially malicious usage. How should you modify the rule to improve its accuracy?
- A. Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
- B. Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
- C. Add principal.user.email != "[email protected]" to the rule condition to exclude the automation account.
- D. Adjust the rule severity to low to deprioritize alerts from automation tools.
Answer: C
Explanation:
Comprehensive and Detailed Explanation
The correct solution is Option D. The problem is that a known, trusted principal (the backup tool's service account) is performing a legitimate action (storage.objects.list) that happens to look like the suspicious behavior the rule is designed to catch.
The most precise and effective way to reduce these false positives without weakening the rule's ability to catch malicious actors is to create an exception for the trusted principal.
By adding principal.user.email != "[email protected]" (or the equivalent principal.user.userid) to the events or condition section of the YARA-L rule, the rule will now only evaluate events where the actor is not the known-good backup bot.
* Option A is incorrect because it just lowers the priority of the false positive; it doesn't stop it from being generated.
* Option B is incorrect because the legitimate tool might also perform repeated calls, leading to the same false positive.
* Option C is incorrect because api.service_name = "storage.googleapis.com" is less specific than api.
operation = "storage.objects.list" and would likely increase the number of false positives by triggering on any storage API call.
Exact Extract from Google Security Operations Documents:
Reduce false positives: When a detection rule generates false positives due to known-benign activity (e.g., from an administrative script or automation tool), the best practice is to add a not condition to the rule to exclude the trusted entity.8 You can filter on UDM fields to create exceptions. For example, to prevent a rule from firing on activity from a specific service account, you can add a condition to the events section such as:
and $e.principal.user.userid != "[email protected]" This technique, often called "allow-listing" or "suppression," improves the rule's accuracy by focusing only on unknown or untrusted principals.
References:
Google Cloud Documentation: Google Security Operations > Documentation > Detections > Overview of the YARA-L 2.0 language > Add not conditions to prevent false positives
NEW QUESTION # 74
You received an IOC from your threat intelligence feed that is identified as a suspicious domain used for command and control (C2). You want to use Google Security Operations (SecOps) to investigate whether this domain appeared in your environment. You want to search for this IOC using the most efficient approach. What should you do?
- A. Enable Group by Field in scan view to cluster events by hostname.
- B. Enter the IOC into the IOC Search feature, and wait for detections with this domain to appear in the Case view.
- C. Configure a UDM search that queries the DNS section of the network noun.
- D. Run a raw log search to search for the domain string.
Answer: C
Explanation:
The most efficient approach is to configure a UDM search that queries the DNS section of the network noun. This allows you to directly search normalized DNS queries and responses for the suspicious domain across all relevant logs, ensuring comprehensive and accurate results while minimizing noise and manual review.
NEW QUESTION # 75
Your organization uses Google Security Operations (SecOps) for security analysis and investigation. Your organization has decided that all security cases related to Data Loss Prevention (DLP) events must be categorized with a defined root cause specific to one of five DLP event types when the case is closed in Google SecOps.
How should you achieve this?
- A. Customize the Close Case dialog and add the five DLP event types as root cause options.
- B. Create case tags in Google SecOps SOAR where each tag contains a unique definition of each of the five DLP event types, and have analysts assign them to cases manually.
- C. Customize the Case Name format to include the DLP event type.
- D. Create a Google SecOps SOAR playbook that automatically assigns case tags where each tag contains the unique definition of one of the five DLP event types.
Answer: A
Explanation:
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
To enforce a specific categorization requirement at the time of case closure, you must customize the Close Case dialog. This feature in Google SecOps SOAR allows administrators to mandate specific fields that analysts must complete before a case can be resolved.
The documentation on Case Management states: "You can customize the Close Case dialog box to require analysts to provide specific information before closing a case... You can add custom fields, such as Root Cause, and define the values that populate the list." By adding the "five DLP event types" as options in the Root Cause dropdown within the Close Case settings, you ensure that analysts cannot close a DLP case without selecting one of these defined types. Options A, B, and C relate to tagging or naming during the active investigation phase and do not enforce the data entry requirement strictly "when the case is closed" as requested.
References: Google Security Operations Documentation > Case Management > Customize the Close Case dialog
NEW QUESTION # 76
Your company wants to enhance its detection capabilities to prevent insider threat incidents. You need to be alerted when a privileged Google Group is modified to allow access to the general public. You need to identify and enable the optimal log source, and configure the alert. What should you do?
- A. Enable IAM Admin Activity audit logs, and export the logs to Google Security Operations (SecOps). Write a YARA-L rule in Google SecOps to capture any changes to relevant IAM policies.
- B. Enable VPC Flow Logs for the default VPC network. Configure a log-based alert in Cloud Logging to detect anomalous traffic patterns associated with Google Groups API endpoints.
- C. Enable Google Drive log events. Create a reporting rule that triggers when a file sharing event occurs with the visibility set to anyone with the link.
- D. Enable data sharing for Google Workspace Admin Audit logs, and ensure that Event Threat Detection is enabled for your organization.
Answer: D
Explanation:
To detect insider threats involving Google Group privilege modifications, you need Google Workspace Admin Audit logs, which capture group membership and sharing changes. By enabling data sharing of these logs with SCC and ensuring Event Threat Detection (ETD) is enabled, SCC will automatically generate findings for risky modifications, such as making a privileged group publicly accessible. This provides the optimal log source and automated alerting with minimal effort.
NEW QUESTION # 77
Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?
- A. Use the web interface-based custom parser feature in Google SecOps to copy the parser, and modify it to map both fields to UDM.
- B. Use the Extract Additional Fields tool in Google SecOps to convert the raw log entries to additional fields.
- C. Write a code snippet, and deploy it in a parser extension to map both fields to UDM.
- D. Deploy a third-party data pipeline management tool to ingest the logs, and transform the updated fields into fields supported by the default parser.
Answer: B
Explanation:
The quickest and lowest-impact solution is to use the Extract Additional Fields tool in Google SecOps. This allows you to map the new and renamed fields from the raw logs into UDM fields without modifying the default parser or deploying custom code, ensuring the logs are fully parsed and available for downstream detections.
NEW QUESTION # 78
You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?
- A. Enable "data read" and "data write" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
- B. Enable "data read" and "data write" audit logs for all Cloud Storage buckets and BigQuery datasets throughout the organization.
- C. Enable VPC Flow Logs for the VPC networks containing resources that access the sensitive Cloud Storage buckets and BigQuery datasets.
- D. Enable "data read" audit logs only for the designated sensitive Cloud Storage buckets and BigQuery datasets.
Answer: D
Explanation:
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
This question is a balance between enabling detection and managing cost. Event Threat Detection (ETD) identifies threats by analyzing logs, and the specific detection for data exfiltration requires Data Access audit logs.
Data Access audit logs are disabled by default because they are high-volume and can be expensive. The key requirement is to "minimize Cloud Logging costs" while still enabling the detection for specific sensitive resources.
Data exfiltration is a "data read" operation. Therefore, to meet the requirements, the organization only needs to enable "data read" audit logs. Enabling "data write" logs (Option B) is unnecessary for this detection and would add needless cost. Enabling logs for all resources (Option C) would be prohibitively expensive and violates the "minimize cost" constraint. While ETD does use VPC Flow Logs (Option D) for many network- based detections, they do not provide the resource-level detail (i.e., which bucket or dataset was accessed) required for this specific data exfiltration finding. Therefore, enabling "data read" logs only for the sensitive resources is the most precise, cost-effective solution.
(Reference: Google Cloud documentation, "Event Threat Detection overview"; "Enable Event Threat Detection"; "Cloud Logging - Data Access audit logs")
NEW QUESTION # 79
You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?
- A. Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.
- B. Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.
- C. Create a Google SecOps SIEM dashboard to show the ingestion metrics for each log_type and collector_id.
- D. Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.
Answer: A
Explanation:
The best solution is to create a Cloud Monitoring notification with a metric-absence condition for each collector_id. A metric-absence alert triggers when expected ingestion metrics are missing within a defined period (e.g., five minutes), which quickly identifies silent sources or failed collectors. This provides near real-time detection of ingestion health issues in the SecOps pipeline.
NEW QUESTION # 80
......
Get Prepared for Your Security-Operations-Engineer Exam With Actual 143 Questions: https://itcertspass.itcertmagic.com/Google/real-Security-Operations-Engineer-exam-prep-dumps.html