Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A security operations team is designing a centralized telemetry analysis architecture in Google Cloud to investigate suspicious network events. VPC Flow Logs, Cloud Next Generation Firewall (Cloud NGFW) logs, and Cloud IDS events are aggregated into a central user-defined Cloud Logging bucket named sec-network-logs-bucket located in us-central1.
The team has the following requirements:
Which sequence of actions should the security engineer take to meet these requirements?
gcloud logging read queries within a scheduled Cloud Function, write parsed anomalies to a Cloud Storage bucket, and configure storage object notification alerts.This architecture uses a scheduled Cloud Function to repeatedly call the gcloud logging read CLI or Cloud Logging REST API (entries.list), formats detected anomalies as JSON files in Cloud Storage, and triggers alerts via object creation notifications.
entries.list API has strict rate limits and is not designed for heavy, aggregate analytical queries across millions of network records.The requirement was to write periodic batch exports of raw log entries into Cloud Storage for long-term cold archive retention.
This approach routes logs through a Pub/Sub topic to a custom Cloud Run microservice that parses log payloads and writes them to BigQuery tables using the BigQuery Storage Write API, while using uptime checks for health monitoring.
The team required custom real-time stream transformation, tokenization, or payload enrichment before sending logs to an on-premises SIEM.
This approach uses a standard Cloud Logging sink to export new incoming log entries into BigQuery storage tables, enables BigQuery BI Engine for in-memory caching, and configures log-based metrics within Cloud Monitoring for alerting.
The organization required permanent data warehouse transformation pipelines outside of Cloud Logging or needed sub-second BI Engine memory acceleration across petabytes of historical data.
gcloud logging buckets update sec-network-logs-bucket --location=us-central1 --enable-analytics, create a linked dataset using gcloud logging links create LINK_ID --bucket=sec-network-logs-bucket --location=us-central1, and configure a SQL-based alerting policy evaluated with the BigQuery engine.Log Analytics enhances Google Cloud Logging buckets by enabling the execution of BigQuery-standard SQL queries directly over ingested log entries. By creating a linked BigQuery dataset using gcloud logging links create, Cloud Logging exposes the bucket's log views (such as _AllLogs) as read-only views within BigQuery without replicating, moving, or double-billing for the stored log entries.
gcloud logging buckets update ... --enable-analytics upgrades the log bucket in place, allowing security analysts to use BigQuery-standard SQL directly against structured network telemetry.gcloud logging links create) allows tools like Looker Studio, BigQuery Studio, and external SIEM connectors to query the log views as native BigQuery datasets.conditionSql) that execute scheduled analytical queries to detect multi-event network traffic anomalies.REGEXP_EXTRACT), and joins across log views.Upgrading the existing bucket to use Log Analytics and creating a linked dataset directly addresses all operational, visualization, and alerting requirements within Google Cloud's native observability architecture.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated