Google Cloud Professional Security Operations Engineer PSOE — Question 8

The correct answer is D. Option D: Write a YARA-L rule in Google Security Operations (SecOps) that compares network traffic of endpoints to low prevalence domains against recent WHOIS registrations.

Explanation

Google Security Operations provides cloud-scale SIEM, threat detection, investigation, and SOAR capabilities for security teams. YARA-L defines event-driven detection rules over normalized security telemetry in Google Security Operations. This option keeps traffic private / properly secured as required. The other options (A, B, C) are less suitable because they add operational overhead, cost, or complexity, or they do not fully satisfy the stated requirement.