SECURITY-OPERATIONS-ENGINEER practice question 13 of 15

You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion pipeline's forwarders and collection agents, and detect silent sources within five minutes. What should you do?

Domain Managing operations within a cloud solution environment

Answer options

A: Create an ingestion notification for health metrics in Cloud Monitoring based on the total ingested log count for each collector_id.

B: Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id. Correct answer

C: Create a Looker dashboard that queries the BigQuery ingestion metrics schema for each log_type and collector_id.

D: Create a Google SecOps dashboard that shows the ingestion metrics for each iog_cype and collector_id.

Correct Answer:

B. Create a notification in Cloud Monitoring using a metric-absence condition based on sample policy for each collector_id.

Explanation

The most effective way to detect a "silent source" is to monitor for the absence of expected data. A Cloud Monitoring metric-absence alerting policy is specifically designed for this scenario. It triggers an alert when no data points are received for a particular metric time series (identified here by collectorid) within a specified duration. By setting this duration to five minutes, you create a proactive and automated notification system that precisely meets the requirement of detecting silent forwarders or agents in a timely manner.

Why Incorrect

A. An alert on total log count might not trigger if a forwarder goes offline completely and stops sending metrics altogether, including a metric with a zero value. Metric-absence detects the lack of the metric itself.
C. A Looker dashboard is a passive visualization tool. It requires manual observation to detect an issue and does not provide the proactive, automated alerting required by the scenario.
D. Similar to a Looker dashboard, the native Google SecOps dashboard is for visualization and investigation, not for creating automated, time-sensitive alerts based on the absence of data.

References

1. Google Cloud Documentation

"Alerting on metric absence": This document explicitly states

"You can use a metric-absence alerting policy to notify you when a resource stops sending data... For example

if you have a process that is expected to write a data point to a time series every minute

you can create a policy that notifies you if you don't see a data point for five minutes." This directly maps to the question's scenario.

Source: Google Cloud Documentation

Cloud Monitoring

"Alerting on metric absence".

2. Google Cloud Documentation

"Create metric-absence alerting policies (UI)": This guide details the configuration steps. In the "Configure alert trigger" section

it shows how to set the "Alert trigger" to "Metric Absence" and configure the "Absence duration" (e.g.

5 minutes)

confirming the technical feasibility of the correct answer.

Source: Google Cloud Documentation

Cloud Monitoring

"Create metric-absence alerting policies (UI)".

3. Google Cloud Documentation

"Chronicle ingestion metrics": This page lists the metrics available for monitoring Google SecOps ingestion

such as chronicle.googleapis.com/ingestion/logentrycount. It also specifies the available metric labels

including collectorid

which allows for creating distinct time series for each forwarder or agent

as required by the question.

Source: Google Cloud Documentation

Chronicle

"Chronicle ingestion metrics".

Keep practicing

Take the free SECURITY-OPERATIONS-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test