Google Workspace Associate Administrator — Question 25

A user in your organization received a spam email that they reported for further investigation. You need to find out more details and the scope of this incident as quickly as possible. What should you do?

Answer options

• A. Conduct a Vault search to find this email and identify if additional users were affected.
• B. Conduct a search to find all emails sent by the sender by using the Gmail API.
• C. Conduct an Email reports search to find this email and all of the email’s recipients.
• D. Conduct a search in the security investigation tool to find this email, and identify whether additional users were affected.

Correct answer: D

Explanation

Option D is correct because the security investigation tool is specifically designed to analyze security incidents and identify affected users. Option A, while useful, does not provide the same level of security analysis. Option B focuses only on the sender's emails and misses the context of the incident, while Option C limits the search to the email's recipients without assessing the broader implications.