Exam Security-Operations-Engineer Topic 4 Question 23 Discussion
Actual exam question for Google's Security-Operations-Engineer exam
Question #: 23
Topic #: 4
Question #: 23
Topic #: 4
Your organization's Google Security Operations (SecOps) tenant is ingesting a vendor's firewall logs in its default JSON format using the Google-provided parser for that log. The vendor recently released a patch that introduces a new field and renames an existing field in the logs. The parser does not recognize these two fields and they remain available only in the raw logs, while the rest of the log is parsed normally. You need to resolve this logging issue as soon as possible while minimizing the overall change management impact. What should you do?
Suggested Answer: D Vote an answer
Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
The correct, low-impact solution for augmenting a Google-managed parser is to use a parser extension. The problem states that the base parser is still working, but needs to be supplemented to map two new fields.
Copying the entire parser (Option A) is a high-impact, high-maintenance solution ("Customer Specific Parser"). This action makes the organization responsible for all future updates and breaks the link to Google's managed updates, which is not a minimal-impact solution.
The intended, modern solution is the parser extension. This feature allows an engineer to write a small, targeted snippet of Code-Based Normalization (CBN) code that executes after the Google-managed base parser. This extension code can access the raw_log and perform the specific logic needed to extract the two unmapped fields and assign them to their proper Universal Data Model (UDM) fields.
This approach is the fastest to deploy and minimizes change management impact because the core parser remains managed and updated by Google, while the extension simply adds the custom logic on top. Option B,
"Extract Additional Fields," is a UI-driven feature, but the underlying mechanism that saves and deploys this logic is the parser extension. Option D is the more precise description of the technical solution.
(Reference: Google Cloud documentation, "Manage parsers"; "Parser extensions"; "Code-Based Normalization (CBN) syntax")
The correct, low-impact solution for augmenting a Google-managed parser is to use a parser extension. The problem states that the base parser is still working, but needs to be supplemented to map two new fields.
Copying the entire parser (Option A) is a high-impact, high-maintenance solution ("Customer Specific Parser"). This action makes the organization responsible for all future updates and breaks the link to Google's managed updates, which is not a minimal-impact solution.
The intended, modern solution is the parser extension. This feature allows an engineer to write a small, targeted snippet of Code-Based Normalization (CBN) code that executes after the Google-managed base parser. This extension code can access the raw_log and perform the specific logic needed to extract the two unmapped fields and assign them to their proper Universal Data Model (UDM) fields.
This approach is the fastest to deploy and minimizes change management impact because the core parser remains managed and updated by Google, while the extension simply adds the custom logic on top. Option B,
"Extract Additional Fields," is a UI-driven feature, but the underlying mechanism that saves and deploys this logic is the parser extension. Option D is the more precise description of the technical solution.
(Reference: Google Cloud documentation, "Manage parsers"; "Parser extensions"; "Code-Based Normalization (CBN) syntax")
by Hugh at Dec 07, 2025, 05:10 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).