Google Cloud Professional Security Operations Engineer PSOE — Question 26

The correct answer is C. Option C: Include a 10 minute timeframe for the same source and destination of network connections in the YARA-L match: section to aggregate the alerts.

Explanation

YARA-L defines event-driven detection rules over normalized security telemetry in Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, B, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.