PSOE Question 9

Question

Your team is responsible for cybersecurity for a large multinational corporation. You have been tasked with identifying unknown command and control nodes (C2s) that are potentially active in your organization's environment. You need to generate a list of potential matches within the next 24 hours. What should you do?
A. Write a rule in Google Security Operations (SecOps) that scans historic network outbound connections against ingested threat intelligence Run the rule in a retrohunt against the full tenant.
B. Load network records into BigQuery to identify endpoints that are communicating with domains outside three standard deviations of normal.
C. Review Security Health Analytics (SHA) findings in Security Command Center (SCC).
D. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

Accepted Answer

Marked answer: D. Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

PSOE Question 9

Community Discussion

Preparing Practice Exam…

PSOE Question 9

Community Discussion