What action should be taken to configure alerting related to phishing attacks?

What action should be taken to configure alerting related to phishing attacks?
A . Set up a Token audit log event alert.
B . Set up an Admin audit log event alert.
C . Set up an email settings changed alert.
D . Set up a suspicious login event alert.

Answer: D

Explanation:

Reference: https://support.google.com/a/answer/9104586?hl=en