Google Cloud Professional Security Operations Engineer PSOE — Question 23

The correct answer is A. Option A: Write a code snippet, and deploy it in a parser extension to map both fields to UDM.

Explanation

The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. A parser extension adjusts source parsing and field mappings while preserving normalized UDM output. This option keeps traffic private / properly secured as required. The other options (B, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.