To ensure DLP-related changes are detectable in SecOps, which option supports capturing admin actions and supporting automated detection?

• A. Enable Google Drive log events and a reporting rule for public link visibility.
• B. Enable IAM Admin Activity audit logs, export to SecOps, write a YARA-L rule for changes.
• C. Enable VPC Flow Logs and log-based alert for Google Groups API endpoints traffic.
• D. Enable data sharing for Google Workspace Admin Audit logs; ensure ETD is enabled.

Answer: (B)

Capturing admin actions through audit logs and enabling automated detection is the combo that makes DLP-related changes visible and actionable in SecOps. IAM Admin Activity audit logs record when administrators modify resources or security configurations, including DLP policy changes. Exporting these logs to SecOps centralizes the data so automated systems can monitor them in real time. Writing a YARA-L rule provides a concrete, machine-readable detection method that looks for specific change patterns related to DLP configurations, enabling automatic alerts or responses when such changes occur.

The other options touch on related areas like data sharing, public-link exposure, or network activity, but they don’t provide both the admin-action visibility and an automated detection mechanism focused on DLP changes.