Exam Security-Operations-Engineer Topic 2 Question 136 Discussion

Actual exam question for Google's Security-Operations-Engineer exam
Question #: 136
Topic #: 2
You have noticed that a Google Security Operations (SecOps) detection rule that detects excessive network connections is triggering too frequently and creating too many false positive alerts. You want to improve the rule to reduce the noise without reducing the effectiveness of the rule. What change to the detection rule should you implement?

Suggested Answer: A Vote an answer

To reduce false positives for a rule detecting excessive network connections, you should add a threshold in the YARA-L condition: section. This ensures that the rule triggers only after a specified number of connections, filtering out normal or benign activity while maintaining the effectiveness of detecting truly excessive network behavior.

by Bertram at Jun 03, 2026, 10:28 PM

Limited Time Offer

15%

Off

Get Premium Security-Operations-Engineer Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10