Google Workspace Professional Administrator — Question 27

A recent legal investigation requires all emails and Google Drive documents from a specific user to be retrieved. As the administrator, how can you fulfill the legal team's request?

Answer options

• A. Use Security Investigation Tool to Search Google Drive events for all of the user's documents, and use Google Admin > Reports > Email Log Search to find their emails.
• B. Search Google Drive for all of the user’s documents, and ask them to forward all of their emails.
• C. Use the Gmail API and Google Drive API to automatically collect and export data.
• D. Utilize Google Vault to hold, search, and export data of interest.

Correct answer: D

Explanation

The correct answer is D because Google Vault is specifically designed for legal holds, searches, and exports of data, making it the best choice for compliance with legal requests. Options A and C, while they suggest useful tools, do not provide the comprehensive legal hold capabilities that Vault offers. Option B is insufficient as it relies on user cooperation and does not ensure complete data retrieval.