Câu 28: Google Cloud Professional Security Operations Engineer

Your organization uses Google Security Operations (SecOps). You need to identify the most commonly occurring processes and applications across your organization's large number of servers so you can implement baselines and exclusion lists on a regular basis. You want to use the most efficient approach. What should you do?

1. A. Use the UDM lookup feature to identify relevant process-related UDM fields and values.
2. B. Run a UDM search, and review aggregations for relevant process-related UDM fields. — đáp án hiện tại
3. C. Review the Google SecOps SIEM Rules & Detections, and identify the most common processes appearing in alerts that are marked as false positives.
4. D. Generate a Google SecOps SIEM dashboard based on relevant UDM fields, such as processes, that provides the counts for process names and files.