Google Cloud Professional Security Operations Engineer PSOE — Question 3

The correct answer is B. Option B: Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.

Explanation

YARA-L defines event-driven detection rules over normalized security telemetry in Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, C, D) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.