Google Workspace Professional Administrator — Question 47
A user does not follow their sign-in pattern and signs in from an unusual location. As an admin, what should you do in response to this alert for this user during this investigation?
Answer options
- A. Add Two Factor Authentication to the Domain
- B. First, suspend the account and then investigate
- C. Enhance your security alerts for tracking sign-in patterns
- D. Investigate the account for unauthorized activity in the Login and Security Audit Log
Correct answer: D
Explanation
The correct response is to investigate the account for unauthorized activity in the Login and Security Audit Log, as this allows the admin to directly assess if any malicious actions have occurred. Suspending the account and enhancing alerts might be preventive measures, but they do not provide immediate insights into the user's activity. Adding Two Factor Authentication improves security but does not address the specific incident at hand.