Exam Security-Operations-Engineer Topic 2 Question 31 Discussion

Actual exam question for Google's Security-Operations-Engineer exam
Question #: 31
Topic #: 2
Your organization uses the curated detection rule set in Google Security Operations (SecOps) for high priority network indicators. You are finding a vast number of false positives coming from your on-premises proxy servers. You need to reduce the number of alerts. What should you do?

Suggested Answer: A Vote an answer

Since the false positives are originating from your on-premises proxy servers, you should exclude their IPs from triggering alerts. In Google SecOps curated detections, the network.asset.ip field represents the IP address of the internal asset generating traffic. Configuring a rule exclusion on this field ensures that alerts from the proxy server IPs are suppressed, reducing false positives without affecting other detections.

by shubhang at Dec 30, 2025, 03:29 AM

Limited Time Offer

15%

Off

Get Premium Security-Operations-Engineer Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
shubhang
2025-12-30 03:29:14
Selected Answer: B
network.asset.ip field. is invalid field
upvoted 1 times
...
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10