PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #122
You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated…
The correct answer is C. Detect on events where principal.port is 5555.. The backdoor is running on TCP port 5555 on the server, meaning the server is the source of the traffic. In Google Security Operations (SecOps), the field principal.port represents the source port of the traffic, while target.port represents the destination. Since you want to ide
Question
You are responsible for identifying suspicious activity and security events at your organization. You have been asked to search in Google Security Operations (SecOps) for network traffic associated with an active HTTP backdoor that runs on TCP port 5555. You want to use the most effective approach to identify traffic originating from the server that is running the backdoor. What should you do?
Options
- ADetect on events where network.ApplicationProtocol is HTTP.
- BDetect on events where target.port is 5555.
- CDetect on events where principal.port is 5555.
- DDetect on events where network.ip_protocol is TCP.
How the community answered
(35 responses)- A11% (4)
- B9% (3)
- C77% (27)
- D3% (1)
Explanation
The backdoor is running on TCP port 5555 on the server, meaning the server is the source of the traffic. In Google Security Operations (SecOps), the field principal.port represents the source port of the traffic, while target.port represents the destination. Since you want to identify traffic originating from the compromised server, filtering on principal.port = 5555 is the most effective
Topics
Community Discussion
No community discussion yet for this question.