🔍

PSOE — all questions

38 practice questions with answers and explanations.

PSOE Question 1

Single page →
Topic 1 · Question 1

You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?

  • ADetect on events where network.ApplicationProtocol is HTTP.
  • BDetect on events where target.port is 5555.
  • CDetect on events where principal.port is 5555. (correct answer)
  • DDetect on events where network.ip_protocol is TCP.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Detect on events where principal.port is 5555. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 2

Single page →
Topic 1 · Question 2

You are an incident responder at your organization using Google Security Operations (SecOps) for monitonng and investigation. You discover that a critical production server, which handles financial transactions, shows signs of unauthorized file changes and network scanning from a suspicious IP address. You suspect that persistence mechanisms may have been installed. You need to use Google SecOps to immediately contain the threat while ensuring that forensic data remains available for investigation. What should you do first?

  • AUse the firewall integration to submit the IP address to a network block list to inhibit internet access from that machine.
  • BDeploy emergency patches, and reboot the server to remove malicious persistence.
  • CUse the EDR integration to quarantine the compromised asset. (correct answer)
  • DUse VirusTotal to enrich the IP address and retrieve the domain. Add the domain to the proxy block list.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the EDR integration to quarantine the compromised asset. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 3

Single page →
Topic 1 · Question 3

Your organization uses Google Security Operations (SecOps). You discover frequent file downloads from a shared workspace within a short time window. You need to configure a rule in Google SecOps that identifies these suspicious events and assigns higher risk scores to repeated anomalies. What should you do?

  • AConfigure a rule that flags file download events with the highest risk score, regardless of time frame.
  • BCreate a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame. (correct answer)
  • CConfigure a single-event YARA-L detection rule that assigns a risk outcome score and is triggered when a user downloads a large number of files in 24 hours.
  • DEnable default curated detections, and use automatic alerting for single file download events.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.

Explanation

YARA-L defines event-driven detection rules over normalized security telemetry in Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 4

Single page →
Topic 1 · Question 4

You are implementing Google Security Operations (SecOps) at your organization. You discover that the current detection rules are too noisy. Due to the high volume of alerts, some true positives might be missed. You want to ingest additional context sources to reduce false positives in your security detections and to improve the overall positive ratio of the alerts. What should you do?

  • AIngest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules. (correct answer)
  • BIngest dark web forum handlers from your threat intelligence system to match dark web principals within the detection rules.
  • CIngest IOCs from your threat intelligence system to validate the IP addresses, domains and hashes with the detection rules.
  • DIngest tactics, techniques, and procedures (TTPs) from your threat intelligence system to validate the processes and tools with the detection rules.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Ingest high-value asset (HVA) data from your configuration management database (CMDB) system to increase the priority of the alerts based on the sensitivity of the assets found in the detection rules. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 5

Single page →
Topic 1 · Question 5

You are developing a new detection rule in Google Security Operations (SecOps). You are defining the YARA-L logic that includes complex event, match, and condition sections. You need to develop and test the rule to ensure that the detections are accurate before the rule is migrated to production. You want to minimize impact to production processes. What should you do?

  • ADevelop the rule logic in the UDM search, review the search output to inform changes to filters and logic, and copy the rule into the Rules Editor.
  • BUse Gemini in Google SecOps to develop the rule by providing a description of the parameters and conditions, and transfer the rule into the Rules Editor.
  • CDevelop the rule in the Rules Editor, define the sections the rule logic, and test the rule using the test rule feature. (correct answer)
  • DDevelop the rule in the Rules Editor, define the sections of the rule logic, and test the rule by setting it to live but not alerting. Run a YARA-L retrohunt from the rules dashboard.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Develop the rule in the Rules Editor, define the sections the rule logic, and test the rule using the test rule feature. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 6

Single page →
Topic 1 · Question 6

Your organization has recently acquired Company A, which has its own SOC and security tooling. You have already configured ingestion of Company A's security telemetry and migrated their detection rules to Google Security Operations (SecOps). You now need to enable Company A's analysts to work their cases in Google SecOps. You need to ensure that Company A's analysts: do not have access to any case data originating from outside of Company A. are able to re-purpose playbooks previously developed by your organization's employees. You need to minimize effort to implement your solution. What is the first step you should take?

  • AAcquire a second Google SecOps SOAR tenant for Company A.
  • BProvision a new service account for Company A.
  • CDefine a new SOC role for Company A.
  • DCreate a Google SecOps SOAR environment for Company A. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a Google SecOps SOAR environment for Company A.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 7

Single page →
Topic 1 · Question 7

Your organization uses Cloud Identity as their identity provider (IdP) and is a Google Security Operations (SecOps) customer You need to grant a group of users access to the Google SecOps instance with read-only access to all resources, including detection engine rules. How should this be configured?

  • ACreate a Google Group and add the required users. Grant the roles/chronicle.Viewer IAM role to the group on the project associated with your Google SecOps Instance. (correct answer)
  • BCreate a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
  • CCreate a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
  • DCreate a workforce identity pool at the organization level Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps Instance.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Google Group and add the required users. Grant the roles/chronicle.Viewer IAM role to the group on the project associated with your Google SecOps Instance.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 8

Single page →
Topic 1 · Question 8

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours. What should you do?

  • AWrite a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
  • BLoad network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
  • CReview Security Health Analytics (SHA) findings in Security Command Center (SCC).
  • DWrite a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. YARA-L defines event-driven detection rules over normalized security telemetry in Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 9

Single page →
Topic 1 · Question 9

You are managing a Google Security Operations (SecOps) implementation for a regional customer. Your customer informs you that logs are appearing in the platform after a consistent six-hour delay. After some research, you determine that there is a log time zone issue. You want to fix this problem. What should you do?

  • AModify the default parser and include a default time zone.
  • BCreate a parser extension to correct the time zone. (correct answer)
  • CCreate a custom parser to correct the time zone.
  • DModify the UI settings to correct the time zone.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a parser extension to correct the time zone.

Explanation

A parser extension adjusts source parsing and field mappings while preserving normalized UDM output. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 10

Single page →
Topic 1 · Question 10

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?

  • AUse the UDM lookup feature to identify relevant process-related UDM fields and values.
  • BRun a UDM search, and review aggregations for relevant process-related UDM fields.
  • CReview the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
  • DGenerate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 11

Single page →
Topic 1 · Question 11

Your company recently adopted Security Command Center (SCC) but is not using Google Security Operations (SecOps). Your organization has thousands of active projects. You need to detect anomalous behavior in your Google Cloud environment by windowing and aggregating data over a given time period, based on specific log events or advanced calculations. You also need to provide an interface for analysts to triage the alerts. How should you build this capability?

  • ASend the logs to Cloud SQL, and run a scheduled query against these events using a Cloud Run scheduled job. Configure an aggregated log filter to stream event-driven logs to a Pub/Sub topic. Configure a trigger to send an email alert when new events are sent to this feed.
  • BSink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send these alerts to the Pub/Sub topic. Write the alerts as findings using the SCC API. (correct answer)
  • CUse log-based metrics to generate event-driven alerts for the detection scenarios. Configure a Cloud Monitoring alert policy to send email alerts to your security operations team.
  • DCreate a series of aggregated log sinks for each required finding, and send the normalized findings as JSON files to Cloud Storage. Use the write event to generate an alert.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Sink the logs to BigQuery, and configure Cloud Run functions to execute a periodic job and generate normalized alerts in a Pub/Sub topic for findings. Use log-based metrics to generate event-driven alerts and send the...

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage. Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 12

Single page →
Topic 1 · Question 12

You manage a large fleet of Compute Engine instances. Security Health Analytics (SHA) has generated a CONFIDENTIAL_COMPUTING_DISABLED finding within Security Command Center (SCC). You need to quickly remediate this finding. What should you do?

  • ADelete the offending VM instance, and mute the finding.
  • BDelete the offending VM instance, and disable the SHA detector.
  • CDelete the offending VM instance, and manually mark the finding as inactive. (correct answer)
  • DDelete the offending VM instance, and allow the finding to be automatically marked as inactive.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Delete the offending VM instance, and manually mark the finding as inactive. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 13

Single page →
Topic 1 · Question 13

You are a security analyst at an organization that uses Google Security Operations (SecOps). You notice suspicious login attempts on several user accounts. You need to determine whether these attempts are part of a coordinated attack as quickly as possible. What action should you take first?

  • AEnable default curated detections to automatically block suspicious IP addresses.
  • BUse UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts. (correct answer)
  • CRemove user accounts that have repeated invalid login attempts.
  • DLook for correlations across impacted users in the Risk Analytics dashboard.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.

Explanation

UDM Search queries normalized Unified Data Model events so analysts can correlate activity consistently across log sources. The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 14

Single page →
Topic 1 · Question 14

You work for a large international company that has several Compute Engine instances running in production. You need to configure monitoring and alerting for Compute Engine instances tagged with compliance=pci that have an external IP address assigned. What should you do?

  • ACreate a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance=pci tag is assigned an external IP address.
  • BDeploy the compute.vmExternalIpAccess organization policy constraint to prevent specific projects or folders with the compliance=pci tag from creating Compute Engine instances with external IP addresses.
  • CCreate a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance=pci tag. (correct answer)
  • DUse the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance=pci tag exists on the instances.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance=pci tag.

Explanation

Security Health Analytics detects cloud misconfigurations and compliance risks from asset configuration data. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 15

Single page →
Topic 1 · Question 15 · Select all that apply

Your organization recently implemented Google Security Operations (SecOps) with Applied Threat Intelligence enabled. You were notified by the networking team about potentially anomalous communications to external domains in the last 30 days. You plan to start your threat hunting by looking at communications to external domains. You are ingesting the following logs into Google SecOps: Firewall logs - Proxy logs - DNS logs - DHCP logs - What should you do? (Choose two.)

  • APerform a UDM search across the logs for domains with geolocations that were first seen in the last 30 days.
  • BPerform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days. (correct answer)
  • CPerform a raw log search across the logs for domains with low prevalence that were first seen in the last 30 days.
  • DIdentify the domains with the higher normalized risk in Risk Analytics. Drill down into those entities to determine their prevalence and if they were first seen in the last 30 days.
  • ENavigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days. Option E: Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.

Explanation

UDM Search queries normalized Unified Data Model events so analysts can correlate activity consistently across log sources. The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 16

Single page →
Topic 1 · Question 16

You are tasked with building a workflow in Google Security Operations (SecOps) SOAR. The documentation you are using requires a logical split that has eight different possible paths. You need to break the workflow into eight separate workflows using an automatic and efficient approach. What should you do?

  • ACreate eight playbooks for each workflow. Configure the triggered playbook to end on an instruction action that tells the analyst to pick a workflow from the playbooks tab and attach that workflow to the alert.
  • BCreate eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to the alert. (correct answer)
  • CCreate a playbook that uses a flow condition. Add four more branches to have a total of five branches and an "Else" branch. On the "Else" branch, include another flow condition. Include the remaining three branches with the logic required.
  • DCreate a playbook that uses a Multi-Choice Question flow and a second Multi-Choice Question for the additional answer choices. Add instructions describing which logic to use in the instruction or question fields. Have the analyst select the appropriate answer to move the flow into the right branch.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create eight playbooks for each workflow. Create a job that identifies your recently opened cases, applies the needed logic to determine which of the eight workflows should be attached, and attaches that workflow to t...

Explanation

A SOAR playbook automates enrichment, triage, containment, notification, and case-handling steps. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 17

Single page →
Topic 1 · Question 17

You are investigating whether an advanced persistent threat (APT) actor has operated in your organization's environment undetected. You have received threat intelligence that includes: A SHA256 hash for a malicious DLL A known command and control (C2) domain A behavior pattern where rundll32.exe spawns powershell.exe with obfuscated arguments Your Google Security Operations (SecOps) instance includes logs from EDR, DNS, and Windows Sysmon. However, you have recently discovered that process hashes are not reliably captured across all endpoints due to an inconsistent Sysmon configuration. You need to use Google SecOps to develop a detection mechanism that identifies the associated activities. What should you do?

  • AWrite a multi-event YARA-L detection rule that correlates the process relationship and hash, and run a retrohunt based on this rule.
  • BBuild a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting. (correct answer)
  • CCreate a single-event YARA-L detection rule based on the file hash, and run the rule against historical and incoming telemetry to detect the DLL execution.
  • DUse Google SecOps search to identify recent uses of rundll32.exe, and tag affected assets for watchlisting.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Build a reference list that contains the hash and domain, and link the list to a high-frequency rule for near real-time alerting.

Explanation

A reference list supplies maintained indicators or values that detection rules can match and update without rewriting rule logic. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 18

Single page →
Topic 1 · Question 18

You are creating a playbook for the SOC. The SOC requires that each Google Security Operations (SecOps) role sees different information for the alert that the playbook runs on. You need to ensure that the playbook presents the relevant information for each Google SecOps role. What should you do?

  • AAdd a view to the playbook for each Google SecOps role. (correct answer)
  • BAdd the Case Comment action to the playbook for each Google SecOps role.
  • CAdd the Create Siemplify Task action to the playbook to assign a task to each Google SecOps role.
  • DAdd the Add General insight action to the playbook for each Google SecOps role.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Add a view to the playbook for each Google SecOps role.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. A SOAR playbook automates enrichment, triage, containment, notification, and case-handling steps. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 19

Single page →
Topic 1 · Question 19

You are conducting a proactive threat hunt in Google Security Operations (SecOps). You observe multiple login events with the same principal.user.userid field that originate from different countries within a short time window. You need to validate whether the account has been compromised. What should you do?

  • AUse the entity graph to correlate the user's risk score with linked assets, and review any active alerts. (correct answer)
  • BPerform a YARA-L 2.0 search for login events and their associated principal.location.country field. Use an outcome field to aggregate the number of failed logins.
  • CPerform a UDM search for login events, and pivot to group results by user and country of origin.
  • DRun a YARA-L retrohunt rule that detects users who are logging in from multiple regions using multiple entity contexts.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use the entity graph to correlate the user's risk score with linked assets, and review any active alerts.

Explanation

The entity graph connects users, assets, indicators, and alerts so analysts can investigate related activity and risk. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

PSOE Question 20

Single page →
Topic 1 · Question 20

You are using a Google-managed image on a Compute Engine instance in Google Cloud to run an application. You need to ingest the application's log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time required to move this data into Google SecOps. What should you do?

  • AUse the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging. Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.
  • BDeploy a Bindplane agent on the image to collect and send the logs to Google SecOps. (correct answer)
  • CCreate a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.
  • DUse the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. Bindplane collects, processes, and routes telemetry from supported sources into Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.

Showing questions 1–20 of 38 · Page 1 of 2