Which of the following is a client-side action in the Visual Policy Editor that prevents external access and deletes any files created during a secure access session?

Windows Group Policy is an OS-level policy mechanism unrelated to APM session sandboxing or post-session file cleanup.

Resource Assign is a VPE action that maps resources such as webtops and ACLs to a session - it does not create a sandboxed workspace or delete files.

Protected Workspace is a client-side action in the APM Visual Policy Editor that launches an isolated, encrypted workspace on the endpoint to prevent data leakage to the local OS. It restricts external application access during the session and, upon session termination, automatically deletes any files, cache, and data created within the workspace. This makes it the correct choice because it directly satisfies both requirements: preventing external access during the session and cleaning up artifacts afterward.

Virtual Keyboard is an input security feature that prevents keystroke logging - it does not sandbox the session or manage file lifecycle.

Browser Cache and Session Control clears browser-specific artifacts like cookies and cache after a web session, but it does not create an isolated workspace or delete files created by other applications during the session.