PCSE Practice Question: Managing Operations in a Cloud Solution Environment
A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration
Chronicle uses YARA-L rules to detect patterns across different log sources. UDM normalizes logs into a common schema. The rule can reference events from multiple log types (e.g., authentication logs and network logs) and define temporal relationships.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ingest Cloud Audit Logs and VPC Flow Logs into Chronicle via forwarders or native integration
Why this is correct
These log sources provide authentication events and network traffic data.
- ✓
Deploy a forwarder to send on-premises authentication logs to Chronicle
Why this is correct
Chronicle supports third-party log ingestion via forwarders to cover on-premises systems.
- ✗
Configure a BigQuery export of VPC Flow Logs for long-term analysis
Why it's wrong here
Chronicle provides its own storage; BigQuery export is not needed for real-time detection.
- ✗
Enable the Standard tier of Security Command Center to generate finding notifications
Why it's wrong here
SCC is not required for Chronicle detections; Chronicle ingests logs directly.
- ✓
Create a YARA-L rule that matches on a UDM 'authentication' event with unusual geo-location followed by a 'network' event with large bytes out
Why this is correct
YARA-L rules can define multi-event sequences with time windows using UDM fields.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.