Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ72

Platform operations

You are assisting a new Google Security Operations (SecOps) customer with configuring access for its SOC team. The Google SecOps administrators already have access to the instance. The customer reports that new Google SecOps users are not being authorized to access the instance, although they can authenticate with the third-party identity provider (IdP). How should you resolve the issue?

Choose two
  • A Link Google SecOps to a Google Cloud project with the Chronicle API.
  • B Integrate Google SecOps with the third-party IdP using Workforce Identity Federation.
  • C Grant the appropriate data access scope to the SOC team's IdP group in IAM.
  • D Grant the roles/chronicle.viewer role to the SOC team's IdP group in IAM.
  • E Grant the Basic permission to the appropriate IdP groups in the Google SecOps SOAR Advanced Settings.
Explanation

A third-party IdP login must be followed by authorization in the Google SecOps-bound Google Cloud project. Granting the SOC team’s IdP group the Chronicle API Viewer role (roles/chronicle.viewer) enables access to the Google SecOps application. Google SecOps also requires SOAR-side user access configuration; mapping the appropriate IdP groups to the Basic permission group in SOAR Advanced Settings supplies the platform permission mapping needed for those users to be provisioned with access. Data access scopes limit accessible data after access is granted and do not authorize entry to the instance.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!