Security-Operations-Engineer Exam Dumps | Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need

<< Prev Question Next Question >>

Question 31/63

Your company uses Google Security Operations (SecOps) Enterprise and is ingesting various logs. You need to proactively identify potentially compromised user accounts. Specifically, you need to detect when a user account downloads an unusually large volume of data compared to the user's established baseline activity. You want to detect this anomalous data access behavior using the least amount of effort. What should you do?

A. Inspect Security Command Center (SCC) default findings for data exfiltration in Google SecOps.

B. Create a log-based metric in Cloud Monitoring, and configure an alert to trigger if the data downloaded per user exceeds a predefined limit. Identify users who exceed the predefined limit in Google SecOps.

C. Develop a custom YARA-L detection rule in Google SecOps that counts download bytes per user per hour and triggers an alert if a threshold is exceeded.

D. Enable curated detection rules for User and Endpoint Behavioral Analytics (UEBA), and use the Risk Analytics dashboard in Google SecOps to identify metrics associated with the anomalous activity.

Question 31/63

LEAVE A REPLY

Download PDF File