GWS-ADMIN Practice Test 1 — 10 Questions

Question 1

Your organization wants to ensure that all outgoing mail is routed through a third-party email security gateway for scanning. What is the correct configuration?

Accepted Answer

Apps > Google Workspace > Gmail > Routing. Outbound routing is configured in Apps > Google Workspace > Gmail > Routing by setting an outbound gateway.

Answer

Security > Compliance > Gateway

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Network > SMTP relay

Question 2

You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?

Accepted Answer

Security > Access and data control > API controls > Manage domain-wide delegation. For service accounts performing domain-wide delegation, scopes must be defined in the Security > Access and data control > API controls > Manage domain-wide delegation section.

Answer

Account > Security > App access

Answer

Directory > Users > Service Accounts

Answer

Apps > Google Workspace > Gmail > API

Question 3

A Google Workspace administrator notices that a user's account is repeatedly locked out after multiple failed login attempts from different IP addresses. The user insists they are not attempting to sign in. What should the administrator do first to mitigate the issue?

Accepted Answer

Check the user's recent login activity and audit logs for suspicious IPs.. Repeated lockouts from different IPs indicate a potential brute-force or credential-stuffing attack. The administrator should first review login audit logs to identify the attacking IPs and assess the threat. This informs subsequent actions, such as blocking IPs, enforcing two-step verification, or resetting passwords. Suspending the account or resetting the password without investigation may not stop the attack or could disrupt the user unnecessarily.

Answer

Enable two-step verification for the user and require it immediately.

Answer

Temporarily suspend the user's account to stop the lockouts.

Answer

Reset the user's password and enforce a password change at next login.

Question 4

A user reports that their company-owned Windows laptop is not appearing in the list of devices under Endpoint Verification. You have confirmed that the user is signed in to Chrome with their Workspace account. What is the most likely reason for this issue?

Accepted Answer

The Endpoint Verification extension is not installed or is disabled in the user's Chrome browser.. Endpoint Verification relies on the Chrome extension to collect and report device details. If the extension is not installed or is disabled, the device will not appear. Since the user is signed in to Chrome with their managed account, the next step is to verify the extension's presence and status. Other factors like sync or Windows Hello are irrelevant to this functionality.

Answer

The device is not enrolled in Windows Hello for Business.

Answer

The Admin console setting 'Endpoint Verification' is turned off for the organizational unit.

Answer

The user has not enabled Chrome Sync for their Workspace account.

Question 5

A company is preparing for a compliance audit and needs to ensure that all Google Workspace data is retained according to legal requirements. The compliance team asks you to identify which two settings can be configured to prevent users from permanently deleting data. (Choose two.)

Accepted Answer

Configure a Google Drive retention rule in Vault to retain files for a set period.. Google Vault retention rules for Gmail and Drive are the primary mechanisms to prevent permanent data deletion. They retain data according to policy, even if users delete items. Other settings like Data Regions or labels do not prevent deletion, and there is no Admin Console toggle to disable delete buttons.

Answer

Apply a data classification label to all files to prevent deletion.

Answer

Set up a Google Workspace Admin Console setting to disable the 'Delete' button for all users.

Answer

Enable 'Data Regions' for all users to store data in a specific geographic location.

Question 6

Your organization uses Chrome browser on Windows devices. You want to ensure that users cannot disable or remove the Endpoint Verification extension. What should you do?

Accepted Answer

In the Admin console, go to Devices > Chrome > Apps & extensions > Users & browsers, and set the Endpoint Verification extension to 'Force installed'.. To prevent users from disabling or removing the Endpoint Verification extension, you must force-install it via the Chrome Apps & extensions policy. This policy ensures the extension is automatically installed and cannot be removed. It is the standard method for enforcing extensions in managed Chrome browsers.

Answer

In the Admin console, go to Devices > Chrome > Settings > Users & browsers, and enable 'Endpoint Verification' under Security.

Answer

In the Admin console, go to Devices > Chrome > Settings > Device settings, and enable 'Force re-enrollment'.

Answer

In the Admin console, go to Devices > Mobile & endpoints > Settings > Universal settings, and enable 'Force Endpoint Verification'.

Question 7

A healthcare organization uses Google Workspace. A compliance officer asks you to ensure that any Gmail message containing a patient identifier is automatically quarantined for review rather than delivered. Which configuration accomplishes this with the least administrative overhead?

Accepted Answer

Configure a Gmail DLP rule with a custom pattern and set the action to quarantine.. Gmail DLP evaluates message content against detectors and can take actions such as quarantine, which places the message in a review queue. This directly addresses the need to hold messages containing patient identifiers instead of delivering them, and it requires only a single DLP rule rather than custom routing.

Answer

Create a content compliance rule that adds a header to matching messages.

Answer

Add the pattern to the blocked senders list in Gmail settings.

Answer

Use an attachment compliance rule to reject messages with matching attachments.

Question 8

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 9

A user reports that emails sent to a specific external domain are bouncing with a '550 5.7.1' error. What is the likely reason?

Accepted Answer

The domain's email authentication (SPF/DKIM/DMARC) is failing.. 550 5.7.1 errors are typically related to SPF, DKIM, or DMARC failures, indicating the recipient domain is rejecting the mail due to authentication issues.

Answer

The message size exceeds the limit.

Answer

The user's storage quota is exceeded.

Answer

The recipient's mailbox is full.

Question 10

Your organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?

Accepted Answer

Place contractors in a dedicated OU, navigate to Security > Authentication > 2-step verification, and configure the allowed methods to only include security keys.. Security key enforcement can be targeted to specific organizational units or security groups by setting the 2SV policy appropriately.

Answer

Modify the default domain-wide sign-in security policy to require security keys globally and grant exceptions via API.

Answer

Configure Context-Aware Access to block non-security key authentications for the contractors group.

Answer

Create an IAM custom role that revokes prompt-based authentication for external users.