[Troubleshooting] You receive a high-priority alert in the Google Workspace Alert Center indicating a potential data exfiltration attempt. The alert details a large number of files downloaded from a shared drive by an external user. What is the FIRST action you should take?
Select the correct option, and then click Submit.
- Review the shared drive’s access logs and user activity.
- Revoke the external user’s access to the shared drive.
- Disable external sharing for the entire organization.
- Immediately contact the security team to initiate an incident response.
- Assess the sensitivity of the downloaded files.