A user in your organization received a spam email that they reported for further investigation. You need to find out more details and the scope of this incident as quickly as possible. What should…

Question

Options

• AConduct a Vault search to find this email and identify if additional users were affected.
• BConduct a search to find all emails sent by the sender by using the Gmail API.
• CConduct an Email reports search to find this email and all of the email's recipients.
• DConduct a search in the security investigation tool to find this email, and identify whether additional

• A
  16% (5)
• B
  3% (1)
• C
  6% (2)
• D
  74% (23)

Explanation

The Security Investigation Tool in Google Admin console is purpose-built for rapid incident response. It allows admins to search for a specific email across the entire organization, identify all recipients, view message details, and take remediation actions (like mass deletion) in one workflow-making it the fastest option for scoping an incident. Google Vault (A) is designed for legal holds and e-discovery, not speed-focused incident triage. The Gmail API (B) requires custom scripting and is slower. Email reports (C) provide aggregate statistics, not the granular per-message investigation needed here.

No community discussion yet for this question.