To detect when a user account downloads unusually large volumes relative to baseline with minimal effort, which approach should you implement?

• A. Inspect SCC default findings for data exfiltration.
• B. Create a log-based metric in Cloud Monitoring and alert on predefined limits.
• C. Develop a custom YARA-L detection rule counting download bytes per user per hour.
• D. Enable curated detection rules for UEBA and use the Risk Analytics dashboard.

Answer: (D)

Leveraging User and Entity Behavior Analytics (UEBA) with the Risk Analytics dashboard is the most efficient way to catch unusual download activity. UEBA learns how each user typically behaves and continuously looks for deviations from that baseline. When you enable curated UEBA detection rules, you get prebuilt detectors tuned for common risky patterns, including anomalous data access or large download bursts. The Risk Analytics dashboard then surfaces these anomalies with risk scores and prioritized alerts, so you can quickly identify and investigate accounts that are downloading far more data than expected, without having to craft custom rules or thresholds from scratch.

This approach is preferable to relying on static thresholds, handcrafted rules, or reactive findings because it scales automatically across many users, adapts to normal variations in behavior, and reduces manual tuning. Other options involve heavier setup or maintenance: static log metrics require defining and tweaking limits; custom YARA-L rules demand ongoing rule management and may not align with cloud log data patterns; and default findings alone are reactive and may miss subtle, baselined anomalies.