An employee at your organization may be sharing confidential documents with unauthorized external parties. You must quickly determine if any sensitive information has been leaked. What should you do?

Question

Options

• AReview the employee's Drive log events in the security investigation tool.
• BAudit Drive access by using the Admin SDK Reports API.
• CReview the employee's user log events within the security investigation tool.
• DCreate a custom report of the user's external sharing by using the security dashboard.

• A
  76% (13)
• B
  6% (1)
• C
  12% (2)
• D
  6% (1)

Explanation

Drive log events in the Security Investigation Tool record all file-level actions: views, downloads, sharing events, permission changes, and external access grants. Reviewing these events for the specific employee gives a targeted, chronological audit trail of exactly which files were shared and with whom. Option B (Admin SDK Reports API) can surface similar data but requires building an API query and is slower for an urgent investigation. Option C (user log events) tracks account-level actions like logins and password changes, not file sharing activity. Option D (custom security dashboard report) is used for aggregate trend analysis, not rapid individual-user forensics.

No community discussion yet for this question.