Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ43

Observability

You are running an application on a Compute Engine instance in Google Cloud by using a Google-managed image. You need to ingest the application’s log output into Google Security Operations (SecOps). The log output is standard and has a valid label and parser in Google SecOps. Your solution must minimize the cost and time needed to move this data into Google SecOps. What should you do?

  • A Use the Ops Agent embedded in the Compute Engine image to pull the logs into Cloud Logging. Use the direct ingestion mechanism to ingest the logs from Google Cloud into Google SecOps.
  • B Deploy a Bindplane agent on the image to collect and send the logs to Google SecOps.
  • C Create a script on the workload that reads the logs and uses the Google SecOps Ingestion API to push them to Google SecOps.
  • D Use the Ops Agent embedded in the Compute Engine image to pull the logs into a Cloud Storage bucket. Create a feed in Google SecOps to ingest the logs.
Explanation

The Bindplane agent is designed to collect logs from servers, including host and application log sources, and forward them to Google SecOps. Configuring it with the existing ingestion label allows the corresponding supported parser to normalize the logs without building a custom ingestion integration or adding Cloud Storage as an intermediate destination. Google Cloud direct ingestion does not support Compute Engine application logs or custom label assignment.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!