Câu 29: Google Cloud Professional Security Operations Engineer

A Google Security Operations (SecOps) detection rule is generating frequent false positive alerts. The rule was designed to detect suspicious Cloud Storage enumeration by triggering an alert whenever the storage.objects.list API operation is called using the api.operation UDM field. However, a legitimate backup automation tool that uses the same API, causing the rule to fire unnecessarily. You need to reduce these false positives from this trusted backup tool while still detecting potentially malicious usage. How should you modify the rule to improve its accuracy?

1. A. Add principal.user.email != "[email protected]" to the rule condition to exclude the automation account. — đáp án hiện tại
2. B. Replace api.operation with api.service_name = "storage.googleapis.com" to narrow the detection scope.
3. C. Convert the rule into a multi-event rule that looks for repeated API calls across multiple buckets.
4. D. Adjust the rule severity to LOW to deprioritize alerts from automation tools.