Google Cloud Professional Security Operations Engineer PSOE — Question 13

The correct answer is B. Option B: Use UDM Search to query historical logs for recent IOCs associated with the suspicious login attempts.

Explanation

UDM Search queries normalized Unified Data Model events so analysts can correlate activity consistently across log sources. The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.