An employee has leaked confidential salary information to an external party. You need to preserve their messages in Vault for investigation. What should you do?

Question

Options

• ASearch and export all external messages.
• BCreate a matter and place a hold on the employee's email.
• CCreate a custom retention policy and review audit logs.
• DUse the security investigation tool first, then create a hold.

• A
  15% (6)
• B
  74% (29)
• C
  8% (3)
• D
  3% (1)

Explanation

Google Vault is the correct tool for legal preservation. Creating a matter organizes the investigation, and placing a hold on the employee's email ensures that all existing and future messages are preserved and cannot be deleted-even if a retention policy would otherwise remove them. This is the proper legal hold procedure. Exporting messages (A) alone does not prevent future deletion. Custom retention policies (C) manage data lifecycle but don't create a legal hold. Using the security investigation tool before a hold (D) risks evidence being deleted in the meantime.

No community discussion yet for this question.