Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Question 3 of 12
Free Preview · 12 of 39 · questions 1–12 of 39 are free. Sign up free to sync your progress across devices.
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
https://docs.cloud.google.com/chronicle/docs/yara-l/getting-started#build-multievent-rule https://docs.cloud.google.com/chronicle/docs/yara-l/yara-l-2-0-examples#multiple-event-rule
B is closest to the question -"Single file download events" -Curated UEBA "Anomalous Outbound Bytes by Device" rules assign fixed risk score. Custom rules can assign higher risk scores dynamically
Frequency-based YARA-L rules are designed to correlate multiple related events over time. Assigning a risk outcome score allows Google SecOps to increase risk as anomalies repeat, which aligns exactly with your requirement to give higher risk scores to repeated suspicious activity.