Exam Security-Operations-Engineer Topic 3 Question 45 Discussion
Actual exam question for Google's Security-Operations-Engineer exam
Question #: 45
Topic #: 3
Question #: 45
Topic #: 3
Your organization plans to ingest logs from an on-premises MySQL database as a new log source into its Google Security Operations (SecOps) instance. You need to create a solution that minimizes effort. What should you do?
Suggested Answer: D Vote an answer
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
The standard, native, and minimal-effort solution for ingesting logs from on-premises sources into Google Security Operations (SecOps) is to use the Google SecOps forwarder. The forwarder is a lightweight software component (available as a Linux binary or Docker container) that is deployed within the customer's network. It is designed to collect logs from a variety of on-premises sources and securely forward them to the SecOps platform.
The forwarder can be configured to monitor log files directly (which is a common output for a MySQL database) or to receive logs via syslog. Once the forwarder is installed and its configuration file is set up to point to the MySQL log file or syslog stream, it handles the compression, batching, and secure transmission of those logs to Google SecOps. This is the intended and most direct ingestion path for on-premises telemetry.
Option C is incorrect because the log source is on-premises, not within the Google Cloud organization. Option B (API feed) is the wrong mechanism; feeds are used for structured data like threat intelligence or alerts, not for raw telemetry logs from a database. Option A (Bindplane) is a third-party partner solution, which may involve additional configuration or licensing, and is not the native, minimal-effort tool provided directly by Google SecOps for this task.
(Reference: Google Cloud documentation, "Google SecOps data ingestion overview"; "Install and configure the SecOps forwarder")
The standard, native, and minimal-effort solution for ingesting logs from on-premises sources into Google Security Operations (SecOps) is to use the Google SecOps forwarder. The forwarder is a lightweight software component (available as a Linux binary or Docker container) that is deployed within the customer's network. It is designed to collect logs from a variety of on-premises sources and securely forward them to the SecOps platform.
The forwarder can be configured to monitor log files directly (which is a common output for a MySQL database) or to receive logs via syslog. Once the forwarder is installed and its configuration file is set up to point to the MySQL log file or syslog stream, it handles the compression, batching, and secure transmission of those logs to Google SecOps. This is the intended and most direct ingestion path for on-premises telemetry.
Option C is incorrect because the log source is on-premises, not within the Google Cloud organization. Option B (API feed) is the wrong mechanism; feeds are used for structured data like threat intelligence or alerts, not for raw telemetry logs from a database. Option A (Bindplane) is a third-party partner solution, which may involve additional configuration or licensing, and is not the native, minimal-effort tool provided directly by Google SecOps for this task.
(Reference: Google Cloud documentation, "Google SecOps data ingestion overview"; "Install and configure the SecOps forwarder")
by Edith at Nov 21, 2025, 04:38 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).