Exam Security-Operations-Engineer Topic 5 Question 2 Discussion

Actual exam question for Google's Security-Operations-Engineer exam
Question #: 2
Topic #: 5

You are building a detection rule in Google Security Operations (SecOps) to alert on requests to potentially malicious domains. You are planning to use the logs from your network detection and response (NDR) solution but you need to reduce noise and narrow the scope of detections. You want to minimize cost and deploy the solution quickly. What should you do?

A. Ingest logs from a domain monitoring service, and build a multi-event rule that correlates the domains found in your NDR logs with your domain monitoring data. B. Build a Google SecOps SOAR playbook that enriches domain entities in alerts with VirusTotal information and auto-closes cases when no domains are classified as malicious. C. Build a multi-event rule that correlates the domains found in your NDR logs with WHOIS context in the entity graph and sets the risk score based on domain creation time. D. Ingest logs from your threat intelligence platform (TIP), and build a multi-event rule that correlates the domains found in your NDR logs with your threat intelligence data.

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business