Google Workspace Professional Administrator — Question 43

A disgruntled employee has left your company and deleted all their email messages and files in Google Drive. The security team is aware that some intellectual property may have surfaced on a public social media site. What is the first step to start an investigation into this leak?

Answer options

• A. Delete the user's account in the Admin Console.
• B. Transfer data between end user Workspace accounts.
• C. Instruct a Google Vault admin to create a matter, and place all the user data on ‘hold.’
• D. Use Google Vault to export all the user data and share among the security team.

Correct answer: C

Explanation

The correct answer is C because creating a matter in Google Vault and placing user data on hold ensures that all relevant information is preserved for investigation. Deleting the user's account (A) would eliminate access to needed data, and transferring data (B) or exporting it (D) does not secure the data for legal purposes.