Valid Security-Operations-Engineer Dumps shared by EduDump.com for Helping Passing Security-Operations-Engineer Exam! EduDump.com now offer the newest Security-Operations-Engineer exam dumps, the EduDump.com Security-Operations-Engineer exam questions have been updated and answers have been corrected get the newest EduDump.com Security-Operations-Engineer dumps with Test Engine here:
You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?
Correct Answer: A
This question is a balance between enabling detection and managing cost. Event Threat Detection (ETD) identifies threats by analyzing logs, and the specific detection for data exfiltration requires Data Access audit logs. Data Access audit logs are disabled by default because they are high-volume and can be expensive. The key requirement is to "minimize Cloud Logging costs" while still enabling the detection for specific sensitive resources. Data exfiltration is a "data read" operation. Therefore, to meet the requirements, the organization only needs to enable "data read" audit logs. Enabling "data write" logs (Option B) is unnecessary for this detection and would add needless cost. Enabling logs for all resources (Option C) would be prohibitively expensive and violates the "minimize cost" constraint. While ETD does use VPC Flow Logs (Option D) for many network- based detections, they do not provide the resource-level detail (i.e., which bucket or dataset was accessed) required for this specific data exfiltration finding. Therefore, enabling "data read" logs only for the sensitive resources is the most precise, cost-effective solution. (Reference: Google Cloud documentation, "Event Threat Detection overview"; "Enable Event Threat Detection"; "Cloud Logging - Data Access audit logs")
