ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 126 - Professional Google Workspace Administrator discussion

Report
Export

A disgruntled employee has left your company and deleted all their email messages and files in Google Drive. The security team is aware that some intellectual property may have surfaced on a public social media site. What is the first step to start an investigation into this leak?

A.
Delete the user's account in the Admin Console.
Answers
A.
Delete the user's account in the Admin Console.
B.
Transfer data between end user Workspace accounts.
Answers
B.
Transfer data between end user Workspace accounts.
C.
Instruct a Google Vault admin to create a matter, and place all the user data on 'hold.'
Answers
C.
Instruct a Google Vault admin to create a matter, and place all the user data on 'hold.'
D.
Use Google Vault to export all the user data and share among the security team.
Answers
D.
Use Google Vault to export all the user data and share among the security team.
Suggested answer: C

Explanation:

Access Google Vault: The Vault admin should log in to Google Vault.

Create a New Matter: In Google Vault, create a new matter specifically for this investigation related to the disgruntled employee.

Place Data on Hold: Place all the user's email and Drive data on hold to ensure it is preserved. This prevents the data from being permanently deleted or altered.

Search for Data: Use Google Vault's search functionality to locate relevant emails and documents that may pertain to the leak.

Export Data if Needed: If necessary, export the preserved data for further analysis and review by the security team.

Collaborate with Security Team: Share the findings with the security team to aid in their investigation of the data leak.

Google Vault Help - Create and Manage Matters

Google Vault Help - Place Data on Hold

asked 18/09/2024
Linda Jannina Sourander
38 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first