G Professional Collaboration Engineer Practice Exam

Which log should be used to investigate data leakage through a third-party application connected to G Suite?

1. Admin audit log

2. SAML audit log

3. Drive usage audit log

4. OAuth Token audit log

The correct answer is: OAuth Token audit log

To investigate data leakage through a third-party application connected to G Suite, the most appropriate log to use is the OAuth Token audit log. This log captures events related to OAuth tokens, which are used by third-party applications to gain access to G Suite services on behalf of a user. By analyzing the OAuth Token audit log, an administrator can identify which third-party applications have accessed user data, the specific scopes of access granted, and any suspicious activity associated with token usage. This log is particularly valuable in the context of security and compliance, as it provides insights into how external applications interact with G Suite data. It helps administrators monitor and control the behavior of third-party apps to prevent unauthorized access or data leakage. Other logs, while useful for different purposes, do not specifically address the risk of data leakage through third-party applications. For example, the Admin audit log primarily tracks administrative actions taken by admins, while the SAML audit log focuses on authentication events related to SAML-based single sign-on. The Drive usage audit log is concerned with file activity within Google Drive, making it less relevant for understanding third-party application access. Therefore, the OAuth Token audit log is the most suitable choice for investigating this specific concern regarding data leakage.