Câu 30: Google Cloud Professional Security Operations Engineer

Your organization uses Security Command Center (SCC) and relies on Compute Engine instances to run business-critical workloads. SCC has flagged a particular instance for exhibiting a high volume of outbound network connections to geographically diverse and unknown IP addresses. You need to determine whether the instance has been compromised by malware. What should you do?

1. A. Examine the IAM roles assigned to the service account that are associated with the instance. Revoke any permissions that could have facilitated malware installation.
2. B. Review the Google Cloud Service Health dashboard to identify any ongoing Google Cloud platform incidents that could be causing unusual network traffic from the instance.
3. C. Disable and re-enable the instances' network interface and determine whether the unusual network behavior is resolved.
4. D. Analyze Event Threat Detection findings. Review the events and the outbound network connections associated with the instance. — đáp án hiện tại