Valid Security-Operations-Engineer Dumps shared by EduDump.com for Helping Passing Security-Operations-Engineer Exam! EduDump.com now offer the newest Security-Operations-Engineer exam dumps, the EduDump.com Security-Operations-Engineer exam questions have been updated and answers have been corrected get the newest EduDump.com Security-Operations-Engineer dumps with Test Engine here:
You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?
Correct Answer: C
The backdoor is running on TCP port 5555 on the server, meaning the server is the source of the traffic. In Google Security Operations (SecOps), the field principal.port represents the source port of the traffic, while target.port represents the destination. Since you want to identify traffic originating from the compromised server, filtering on principal.port = 5555 is the most effective approach.