PSOE Question 3

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  https://docs.cloud.google.com/chronicle/docs/yara-l/getting-started#build-multievent-rule https://docs.cloud.google.com/chronicle/docs/yara-l/yara-l-2-0-examples#multiple-event-rule

• Chose B2

  B is closest to the question -"Single file download events" -Curated UEBA "Anomalous Outbound Bytes by Device" rules assign fixed risk score. Custom rules can assign higher risk scores dynamically

• Chose B2

  Frequency-based YARA-L rules are designed to correlate multiple related events over time. Assigning a risk outcome score allows Google SecOps to increase risk as anomalies repeat, which aligns exactly with your requirement to give higher risk scores to repeated suspicious activity.