Which step ensures external analysts can access the SecOps environment with read-only access to all resources, including detection engine rules?

• A. Define a new SOC role for Company A
• B. Acquire a second SecOps tenant for Company A
• C. Provision a new service account for Company A
• D. Create a Google Group and grant the roles/chronicle.viewer IAM role to the group on the project

Answer: (A)

Granting read-only access across the SecOps environment is best achieved by creating a custom SOC (Security Operations) role in IAM that defines exactly which resources and permissions external analysts need to view, including the ability to read detection engine rules. A custom role lets you include all the necessary read permissions across all SecOps resources in one place and prevents any write privileges, aligning with least-privilege best practices. Once this role is defined, you attach it to the external analysts—typically via a Google Group—to simplify ongoing membership management and ensure consistent access.

The other approaches fall short: using a separate SecOps tenant creates isolated environments rather than providing unified access; a service account is meant for automated workloads rather than human analysts; and granting a group only the Chronicle viewer role covers Chronicle resources in isolation and does not guarantee read-only access to the entire SecOps environment or to detection engine rules across all resources.