Which Unified Data Model (UDM) field search specifies a security action?

Sound the Alarm: Detection and Response | Weekly challenge 4 Quiz | 

Which Unified Data Model (UDM) field search specifies a security action?

• action
• security_result.action
• metadata.event_type
• block