Google Cloud Professional Security Operations Engineer PSOE — Question 35

The correct answer is C. Option C: Use a manual action in Google SecOps SOAR to perform a UDM search matching on the file hash in Google SecOps SIEM.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. UDM Search queries normalized Unified Data Model events so analysts can correlate activity consistently across log sources. The Unified Data Model normalizes security telemetry into a consistent schema for search, detection, and correlation. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.