Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ106

Data management

You are setting up role-based data-access controls for two user groups in Google Security Operations (SecOps). Group A needs access to all data, while Group B needs access to all data except data from the "restricted" namespace. You must configure access for these two groups. What should you do?

Choose two
  • A Create a custom label with a UDM query to include all labels for Group Assign this data label to Group A in IAM.
  • B Create a custom label with a UDM query to include all data except the "restricted" namespace data for Group Assign this data label to Group B in IAM.
  • C Create a new data access scope to allow access to the "restricted" namespace data for Group A. Assign this data scope to Group A in IAM.
  • D Create a new data access scope in the Google SecOps SIEM settings to allow access to all data for Group A. Assign this data access scope to Group A in IAM.
  • E Create a new data access scope in the Google SecOps SIEM settings to allow access to all data and exclude the "restrict" namespace data for Group B. Assign this data access scope to Group B in IAM.
Explanation

Google SecOps data access scopes can be configured with allowAll for global data access and with denied labels, including an asset namespace, to exclude matching data. Therefore, Group A needs an allow-all data access scope, and Group B needs an allow-all scope that denies the restricted namespace.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!