Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ59

Platform operations

Third-party application data is published to a Pub/Sub topic in a Google Cloud project separate from your Google Security Operations (SecOps) instance. Attempts to push data from that Pub/Sub topic to Google SecOps have failed. You need to deliver this data to Google SecOps in a robust, low-latency manner. What should you do?

  • A Push the data to Cloud Logging, and modify the export filter in direct ingestion.
  • B Enable the Chronicle API in the project that owns the Pub/Sub topic to push the subscription to Google SecOps.
  • C Create a Cloud Run function that is subscribed to the Pub/Sub topic and uses a Google SecOps Ingestion API key to push the data into Google SecOps.
  • D Send Pub/Sub messages to a Cloud Storage bucket. Create an ingestion feed in Google SecOps to read from the bucket. Grant Storage Admin IAM access to the service account.
Explanation

A Cloud Run function subscribed to Pub/Sub provides an event-driven and durable ingestion component that can forward each message directly to Google SecOps using its Ingestion API credentials. Google documents Cloud Run functions for Pub/Sub ingestion and states that the Pub/Sub implementation continuously monitors the subscription and ingests newly available messages through the Ingestion API.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!