PSOE Question 1

Question

You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?
A. Detect on events where network.ApplicationProtocol is HTTP.
B. Detect on events where target.port is 5555.
C. Detect on events where principal.port is 5555.
D. Detect on events where network.ip_protocol is TCP.

Accepted Answer

Marked answer: C. Detect on events where principal.port is 5555.

Preparing Practice Exam…

PSOE Question 1

Community Discussion