A user reports receiving a phishing email that appears to come from your company's CEO. You need to determine if any other users received the same email and if any of them clicked a link. Which tool should you use first?

Investigation tool in the security center

Which of the following is a primary purpose of the Google Workspace audit log?

To store user emails for legal hold

To automatically block malicious emails

To record administrative and user activities for security analysis

To provide real-time chat support

Your company wants to be alerted whenever a user in the finance department downloads a large number of files from Google Drive within a short time, as this could indicate data exfiltration. You need to set up a monitoring solution that triggers an alert. What should you configure?

A security health check for Drive settings

An activity rule for Drive log events

A custom search in the investigation tool

Where in the Google Workspace Admin console would an administrator go to get a high-level view of security risks and threats across the organization?

Apps > Google Workspace > Gmail

Your security team notices a spike in alerts about users receiving emails with malicious attachments. You need to identify which users have opened the attachments. What should you do?

Create an activity rule for attachment opens

Use the investigation tool to search Gmail logs for attachment opens

Check the alert center for attachment alerts

Review the security health page

Google CloudAssociate Google Workspace Administrator

Domain 4Objective 2

4.2 Reporting, Auditing, and Investigating Security Risks and Events ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR Practice Questions (Page 5)

Part of the Managing security policies and access controls domain, which accounts for ~20% of the ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR exam.

27questions here

6free pages

6concepts

~20%of the exam

Questions 21–25

21application · medium
A user reports receiving a phishing email that appears to come from your company's CEO. You need to determine if any other users received the same email and if any of them clicked a link. Which tool should you use first?
Select an answer first
22foundation · easy
Which of the following is a primary purpose of the Google Workspace audit log?
Select an answer first
23application · medium
Your company wants to be alerted whenever a user in the finance department downloads a large number of files from Google Drive within a short time, as this could indicate data exfiltration. You need to set up a monitoring solution that triggers an alert. What should you configure?
Select an answer first
24foundation · easy
Where in the Google Workspace Admin console would an administrator go to get a high-level view of security risks and threats across the organization?
Select an answer first
25application · medium
Your security team notices a spike in alerts about users receiving emails with malicious attachments. You need to identify which users have opened the attachments. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR” is a trademark of its owner, used for identification only.