An administrator suspects that a user's account was compromised and that the attacker reset the password. You need to find out when the password was changed and from which IP address. What should you do?

Search the admin audit log for the user's password change events

Create an activity rule for password changes

Your security team wants to receive alerts for suspicious login activity, such as logins from multiple countries in a short time. They also want to be able to view and manage these alerts in one place. What should you do?

Enable all alerts in the alert center

Use the investigation tool to search for login events

Create an activity rule for login events and review alerts in the alert center

Check the security health page for login issues

Google CloudAssociate Google Workspace Administrator

Domain 4Objective 2

4.2 Reporting, Auditing, and Investigating Security Risks and Events ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR Practice Questions (Page 6)

Part of the Managing security policies and access controls domain, which accounts for ~20% of the ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR exam.

27questions here

6free pages

6concepts

~20%of the exam

Questions 26–27

26application · medium
An administrator suspects that a user's account was compromised and that the attacker reset the password. You need to find out when the password was changed and from which IP address. What should you do?
Select an answer first
27application · medium
Your security team wants to receive alerts for suspicious login activity, such as logins from multiple countries in a short time. They also want to be able to view and manage these alerts in one place. What should you do?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR” is a trademark of its owner, used for identification only.

4.2 Reporting, Auditing, and Investigating Security Risks and Events ASSOCIATE-GOOGLE-WORKSPACE-ADMINISTRATOR Practice Questions (Page 6)

Questions 26–27

An administrator suspects that a user's account was compromised and that the attacker reset the password. You need to find out when the password was changed and from which IP address. What should you do?

Your security team wants to receive alerts for suspicious login activity, such as logins from multiple countries in a short time. They also want to be able to view and manage these alerts in one place. What should you do?

Keep studying — Managing security policies and access controls