GWS-ADMIN Practice Test 10 — 10 Questions

Question 1

A Google Workspace administrator receives reports that some users are not receiving email notifications from a third-party ticketing system. The ticketing system sends from a domain that has a strict DMARC policy. The notifications are not in spam. What should the administrator check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Email Log Search in the Google Admin console for rejected messages.. When emails are not delivered and not in spam, the issue is likely at the SMTP or policy level. Email Log Search in the Admin console shows whether messages were rejected, deferred, or delivered. It can reveal DMARC failures or other rejection reasons. This is the fastest way to determine the root cause before investigating SPF/DKIM or filters.

Answer

Confirm the users' Gmail filters are not automatically deleting the messages.

Answer

Ensure the ticketing system's sending IP is whitelisted in Google Workspace email settings.

Answer

Verify the ticketing system's SPF and DKIM records are correctly configured.

Question 2

You need to add a custom attribute to user profiles. Where is this configured?

Accepted Answer

Directory > Users > Manage custom attributes. Custom attributes are managed under Directory > Users > More > Manage custom attributes.

Answer

Account > Organization profile

Answer

Security > Profile settings

Answer

Directory > OU management

Question 3

A Google Workspace administrator at a company with a single primary domain wants to make a newly created OU named 'Contractors' immediately available as a target for dynamic group membership rules and shared drive access policies. A colleague suggests that the OU must be populated with at least one user before it can be referenced by policy. Which statement describes what actually happens after the OU is created in the Admin console?

Accepted Answer

The OU is created instantly and can be referenced by policies and dynamic group queries even while it is empty.. Organizational units are persistent directory objects created the moment they are saved. Their path can be targeted by dynamic group membership queries, device policies, and access policies without any member present, and users moved in later inherit those settings automatically. No pending state, sync delay, or matching group is required for the OU to function as a policy target.

Answer

The OU can only be referenced by policies after a group with the same name has been created.

Answer

The OU is created, but it appears only in the Admin console after the next directory synchronization completes.

Answer

The OU remains in a pending state until a user is assigned to it, and policies applied to it do not take effect until then.

Question 4

Which TWO of the following actions can be performed on an Android device from the Admin console?

Accepted Answer

Remote removal of the work profile. Option B is correct because Android Enterprise management through the Admin console allows an administrator to remotely delete/remove a work profile from a managed device, wiping only the corporate data and apps in that profile. Option D is correct because the Admin console supports issuing a remote factory reset (wipe) command that erases the entire device, returning it to its original out-of-box state. Option A is not valid since the Admin console has no capability to control a device's camera shutter remotely. Option C is not valid because OS version installation/updates are handled by the device manufacturer or carrier OTA process, not pushed as a specific Android OS version from the Admin console. Option E is not valid because physically removing a battery is a hardware action that cannot be performed remotely through any management console.

Answer

Remote control of the camera shutter

Answer

Remote installation of a specific version of Android OS

Answer

Remote physical battery removal

Question 5

A multinational company has a primary domain, example.com, and a secondary domain, example.net, in the same Google Workspace account. The administrator wants users signing in with the example.net alias to appear in the Global Directory under example.net rather than under example.com. What must the administrator configure to achieve this?

Accepted Answer

Keep example.net as a secondary domain and set each user's primary email address to the example.net domain.. A user's primary email address determines which domain they are listed under in the Global Directory. With example.net configured as a secondary domain in the same account, assigning that domain as the primary address for selected users produces listings under example.net while example.com remains the account's primary domain.

Answer

Add example.net as an alias domain of example.com and set each user's primary email in the example.net domain.

Answer

Create a separate Google Workspace account for example.net and enable directory sharing between the two accounts.

Answer

Make example.net the primary domain and demote example.com to a secondary domain.

Question 6

Which THREE items can be managed through the 'Directory' section in the Admin Console?

Accepted Answer

User profile editing permissions. In the Google Admin Console, the Directory section is where administrators manage directory-related settings and resources. Option A (User profile editing permissions) is correct because the Directory > Directory settings area lets you control whether users can edit their own profiles and which fields they may change. Option B (Building resources) is correct because Directory > Buildings and Resources is where you create and manage buildings and resource calendars (such as meeting rooms and equipment). Option E (Shared contacts) is correct because Directory > Shared contacts allows you to add external contacts that appear in the directory for your users. Option C (Device management policies) is not in Directory; device policies are configured under Devices (e.g., Mobile & endpoints or Chrome management). Option D (Gmail routing rules) is not in Directory; routing and compliance rules are configured under Apps > Google Workspace > Gmail > Routing, not the Directory section.

Answer

Device management policies

Answer

Gmail routing rules

Question 7

A user in your Google Workspace domain has left the company. You need to immediately suspend their account to prevent access, but you may need to restore it later if they return. What should you do?

Accepted Answer

Suspend the user account.. Suspending the account is the correct immediate action to block access while retaining the ability to restore it later. Suspension preserves all data and can be reversed at any time. Deletion starts a recovery window, but suspension is safer when restoration is likely. Other options do not effectively prevent access or are not designed for offboarding.

Answer

Change the user's password and not share it.

Answer

Delete the user account.

Answer

Move the user to a different Organizational Unit.

Question 8

You need to distribute a specific internal Android app to a subset of users. What is the most efficient way to achieve this using Google Workspace?

Accepted Answer

Add the app to the Managed Google Play store and assign to an OU. Adding the app to the managed Google Play store and assigning it to specific organizational units (OUs) allows for controlled distribution.

Answer

Enable 'Allow all apps' in the mobile device settings

Answer

Manually install the APK on every user's device

Answer

Send the APK via email to all employees

Question 9

A Google Workspace administrator is investigating why a user is not receiving email notifications from an external CRM system. The CRM vendor confirms emails are sent from notifications@crmvendor.com, but the user's inbox shows nothing. The admin runs a message trace in the Google Admin console and sees the messages were delivered to the user's mailbox. What should the admin check next?

Accepted Answer

The user's Gmail filters and blocked senders list.. When a message trace confirms delivery to a user's mailbox but the user cannot see the message, the issue is almost always after delivery. User-created Gmail filters or blocked senders can silently archive, delete, or label messages. The admin should inspect those settings to find the rule diverting the CRM notifications.

Answer

The domain's SPF record for crmvendor.com.

Answer

The user's Gmail IMAP and POP settings.

Answer

The Google Workspace MX records for the domain.

Question 10

A Google Workspace administrator is troubleshooting a user's inability to sign in to their account. The user reports that after entering their password, they see a message saying 'Your account is not allowed to sign in from this device.' The admin checks the user's account status and sees it is active. What should the admin check next?

Accepted Answer

The organizational unit's device policy for sign-in.. The message 'Your account is not allowed to sign in from this device' points to a device-based access restriction. Google Workspace admins can enforce policies that require managed devices or block unmanaged ones. The admin should review device management and context-aware access settings for the user's organizational unit to identify and adjust the blocking policy.

Answer

The domain's MX records.

Answer

The user's 2-Step Verification settings.

Answer

The user's Google Drive storage quota.