You recently noticed a suspicious trend in your organization's Google Drive usage. Several users have shared sensitive documents outside the organization, potentially violating your company's data…

Question

Options

• AReview the organization's sharing policies in the Admin console, and update the policies to prevent
• BUse the security health page to identify misconfigured sharing settings in Drive.
• CUse the security investigation tool to analyze Drive logs and identify the users.
• DCreate an activity rule in the Security Center to alert you of future external sharing events.

• A
  4% (1)
• B
  13% (3)
• C
  79% (19)
• D
  4% (1)

Explanation

The security investigation tool (found in the Google Workspace Admin console under Security > Investigation Tool) allows administrators to query audit logs across Google services, including Drive. You can filter Drive log events by action type (e.g., 'share', 'change ACL') and by visibility (external sharing) to pinpoint exactly which users shared which files, with whom, and when. This gives you the forensic evidence needed to identify responsible users and the scope of the violation. Option A (updating policies) prevents future violations but does not investigate past ones. Option B (security health page) shows configuration posture, not historical activity. Option D (activity rule) creates future alerts but does not retroactively surface what already happened.

No community discussion yet for this question.