Exam Security-Operations-Engineer Topic 5 Question 73 Discussion

Actual exam question for Google's Security-Operations-Engineer exam
Question #: 73
Topic #: 5
You are writing a detection rule in Google Security Operations (SecOps) SIEM that sends a risk score to the alert. You have access to Google Threat Intelligence (GTI) data through your Google SecOps subscription. You need to ensure that the threat score output in the detection logic informs the alert's risk score and is available for future detections. What should you do?

Suggested Answer: A Vote an answer

The correct method is to use the outcomes section of the YARA-L detection logic to apply logic on UDM enrichment fields (including GTI data), calculate the total risk outcome, and store it in the risk_score variable. This ensures the risk score is attached to the alert and available for correlation in future detections.

by Duke at Oct 15, 2026, 02:32 AM

Limited Time Offer

15%

Off

Get Premium Security-Operations-Engineer Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10