Google Cloud Professional Security Operations Engineer PSOE — Question 15

The correct answer is B, E. Option B: Perform a UDM search across the logs for domains with low prevalence that were first seen in the last 30 days. Option E: Navigate to the IOC Matches page and filter based on domain type over the last 30 days. Look for the first seen and last seen timestamps for the reported domains. Investigate these domains using the IOC drilldown link.

Explanation

UDM Search queries normalized Unified Data Model events so analysts can correlate activity consistently across log sources. The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.