Associate Cloud Workspace Administrator · Free Practice Question Medium
Question 30
As part of a compliance initiative, your company mandates that third-party applications accessing Google Workspace data through APIs must adhere to specific security requirements. Using Google's API Controls, which approach should you adopt to ensure that only compliant applications can access data while others are blocked?
-
A
Restrict API access to a range of IP addresses.
-
B
Implement a Content Compliance rule in Google Workspace.
-
C
Whitelist approved OAuth 2.0 client IDs and block all others.
-
D
Use Access Context Manager to set fine-grained access control based on attributes like device security status.
Reveal correct answer
Correct answer: C
A. Restricting API access to a range of IP addresses is not the most suitable approach for ensuring that only compliant applications can access Google Workspace data through APIs. This method may limit access based on network location, but it does not provide the level of control needed to enforce specific security requirements for third-party applications.
B. Implementing a Content Compliance rule in Google Workspace is not the most effective approach to ensuring that only compliant applications can access data through APIs. Content Compliance rules are typically used to enforce policies related to email content and attachments, rather than controlling access to APIs.
C. Whitelisting approved OAuth 2.0 client IDs is the correct approach to ensure that only compliant applications can access Google Workspace data through APIs. By blocking all other client IDs, you can restrict access to only those applications that meet the specific security requirements mandated by your company.
D. Using Access Context Manager to set fine-grained access control based on attributes like device security status is a valid approach to controlling access to Google Workspace data. However, this method may not be the most efficient way to ensure that only compliant applications can access data through APIs, as it focuses more on access control based on contextual attributes rather than specifically vetting third-party applications.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
