How to Restrict Document Access by Company in Google Workspace?

PWA By islever Editorial Last updated

Short answer

D Set up Google Drive trust rules to prevent access to documents from individual companies.

Question

You work at a large global holding firm with multiple companies that are united under one Google Workspace deployment. You must ensure that employees can only access documents at the company in which they are employed. What should you do?
  1. Create a User group for each company and change Google Drive sharing settings to block external sharing.
  2. Create an organizational unit (OU) for each company and disable file sharing.
  3. Set up data loss prevention (DLP) rules to prevent specific documents from being shared.
  4. Set up Google Drive trust rules to prevent access to documents from individual companies. Correct Answer

Key Takeaways

Tests your ability to isolate data across business units within a single tenant, with the common trap being overly broad sharing blocks that hinder legitimate cross-company operations.

Learn how to enforce strict document isolation between subsidiary companies in a unified Google Workspace deployment. The community strongly endorses using organizational trust rules to maintain secure, compartmentalized data access.

Common mistake: Option A is frequently chosen because blocking external sharing seems logical, but it incorrectly restricts all outside collaboration needed for auditors, partners, or vendors rather than isolating internal company boundaries.

Expert Analysis

Why the Answer Is Correct

Setting up Google Drive trust rules allows administrators to precisely control sharing permissions based on corporate boundaries. This ensures that users within one subsidiary cannot view or share files with another, maintaining strict data segregation without breaking core Workspace functionality. By targeting access at the organizational level, you align security policies with your company’s legal and operational structure.

Why the Other Options Are Wrong

Option A blocks all external sharing globally, which would prevent necessary interactions with external auditors, clients, or third-party services. Option B disables file sharing entirely across the organization, crippling productivity and violating basic collaboration requirements. Option C focuses on DLP, which scans content for sensitive data patterns rather than enforcing structural access controls tied to company entities.

Community Comment Notes

Exam candidates consistently highlight that while terminology may vary slightly across updates, trust rules remain the definitive mechanism for company-level isolation. One contributor notes that DLP is content-specific and not designed for OU-based access management, reinforcing why administrative grouping is superior. Another user confirms that broad sharing blocks create unnecessary compliance roadblocks for routine business functions.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always map administrative controls to organizational boundaries first before applying blanket security policies. When questions mention multi-company structures under a single tenant, prioritize OU-based or trust rule configurations over global sharing restrictions to balance security with operational flexibility.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. apb98 👍 3 Answered D
    Not A because you are blocking all external sharing that you may need with, for example, send files to external auditors. Not B because you wouldn't be able to share neither internally nor externally. Not C because DLP rules are typically content-specific and not designed to manage access control based on organizational units (OUs) or group structures. I choose D, although Google Drive trust rules need OUs or groups to define the scope of access control.
  2. dija123 👍 1 Answered D
    I am ok with D
  3. mostafa97 👍 1
    D is good

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Fix Non-Google File Access Issues in Google Drive?

S-grade

How to First Troubleshoot Google Meet Video Issues?

S-grade

How to Restrict Temporary Employees' Email Domains in Google Workspace?

S-grade

How to Securely Share Files with External Users Without Google Accounts?

S-grade

← Back to PWA Study Guide