PCSE Practice Question: Managing Operations in a Cloud Solution Environment
An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
YARA-L detection rule
YARA-L is the detection language for Chronicle. It allows multi-event correlation across data sources, including timestamps and grouping by source IP. UDM is the data model. Dashboards are visual. Reference lists are for static data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dashboard and alerting
Why it's wrong here
Dashboards are for visualization, not automated detection.
- ✗
Reference list
Why it's wrong here
Reference lists provide static data for matching, not time-based correlation.
- ✗
Unified Data Model (UDM)
Why it's wrong here
UDM is a schema for log normalization, not a detection rule language.
- ✓
YARA-L detection rule
Why this is correct
YARA-L rules can correlate events across multiple data sources and time windows.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.