Câu 21: Google Cloud Professional Security Operations Engineer

You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

1. A. Use the outcomes section of your detection logic to pull UDM enrichment fields from the event data. Apply logic to determine the total risk outcome, and store the risk score as the risk_score variable — đáp án hiện tại
2. B. Use the match section of your detection logic to filter out irrelevant entities. Store the remaining entities as the risk_score variable.
3. C. Configure a feed in Google SecOps SIEM to ingest GTI data to automatically enrich the appropriate entities.
4. D. Create a Google SecOps SOAR playbook to query GTI that uses the VirusTotal integration to enrich the alert. Modify the risk_score context value to match.