Exam Security-Operations-Engineer Topic 4 Question 56 Discussion

Actual exam question for Google's Security-Operations-Engineer exam
Question #: 56
Topic #: 4

You have identified a new threat actor group that has several IOCs in Google Threat Intelligence.
You want to use some of these IOCs in several detection rules in Google Security Operations (SecOps) to help identify suspicious activity. You want to use the most effective approach. What should you do?

A. Identify the detection rules that apply to the new IOCs, and update the YARA-L logic to reference the threat actor group. B. Add the IOCs to a new or existing reference list, and update the YARA-L logic of detection rules to include the reference list. C. Save the IOCs in a new collection in Google Threat Intelligence. Share this list with other members of the security team to facilitate their searches and rule creation. D. Configure a new data feed in Google SecOps that includes the IOCs. Update the YARA-L logic to reference the new IOCs against applicable UDM fields.

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business