GWS-ADMIN Practice Test 12 — 15 Questions

Question 1

Which THREE of the following are aspects of the Directory API 'user' resource?

Accepted Answer

Suspension status. The Directory API 'user' resource includes the 'suspended' field, which indicates whether the account is suspended, so option A (Suspension status) is correct. It also contains the 'name' object with givenName, familyName, and fullName properties, making option B (User's full name) correct. The resource's 'primaryEmail' field holds the user's primary email address, so option C (Primary email address) is correct. Option D (Device serial number) belongs to the Chrome/iOS device resources of the Directory API, not the user resource. Option E (Account creation date) is not a field of the user resource; creation time is exposed via the Admin SDK Reports API or the 'creationTime' field in other contexts, not as a standard user resource attribute.

Answer

Device serial number

Answer

Account creation date

Question 2

You are configuring Endpoint Verification. What is the primary purpose of the Endpoint Verification extension on a user's browser?

Accepted Answer

To collect device information for context-aware access. Endpoint Verification is a Chrome extension (and mobile agent) that collects device attributes such as OS version, screen lock status, disk encryption, and serial number, and reports them to Google. These signals feed into context-aware access policies, allowing admins to grant or deny access to Workspace apps based on device posture. Its primary purpose is to provide device context for access decisions.

Answer

To enable remote wipe capabilities

Answer

To enforce password complexity

Answer

To block all malicious websites

Question 3

A user reports that their mobile device is no longer syncing corporate data. What is the most likely cause?

Accepted Answer

The device no longer meets security compliance requirements.. If a security policy change has occurred or the device has become non-compliant, sync will be automatically blocked by Google Workspace.

Answer

The device battery is low.

Answer

The user is on the wrong Wi-Fi network.

Answer

The mobile carrier has blocked the connection.

Question 4

Your organization uses Google Workspace and has a legal hold on a user's Gmail and Drive data. The user continues to work and creates new files and emails. You need to ensure that any new content created by this user is also preserved under the same legal hold. What should you do?

Accepted Answer

Edit the existing matter and add the user's account to the holds for Gmail and Drive; Vault automatically includes future content.. Google Vault holds are applied to user accounts and cover all data within the specified services, including future data. When you add a user to a hold, any new emails or files they create are automatically preserved until the hold is released. This is the correct and simplest way to ensure ongoing preservation. Other options either do not provide the same legal protection or are unnecessary.

Answer

Create a new matter for the same user and set the same retention rules.

Answer

Set a Vault retention rule for the user's organizational unit to retain data indefinitely.

Answer

Export the user's current data and then set up a script to periodically export new data.

Question 5

Which setting allows you to see what files are being shared externally across your entire domain?

Accepted Answer

Security Investigation Tool. The Security Investigation Tool is the correct setting because it allows admins to search across all Drive files in the domain and filter by sharing visibility, including externally shared files. It provides a domain-wide view of file sharing activity and is the only surface that supports querying external sharing at scale. This is the tool designed for security investigations and reporting on sharing exposure.

Answer

Drive Audit Log

Answer

Apps > Google Workspace > Drive > Sharing audit

Answer

Report > User Reports > Drive

Question 6

You need to ensure that Chrome browsers on unmanaged devices are secure. What is a key step to take?

Accepted Answer

Use Chrome browser cloud management to enforce policies. Using Chrome browser cloud management to enforce policies is a key step to secure Chrome browsers on unmanaged devices. This allows administrators to apply security policies centrally to Chrome browsers regardless of device management status, ensuring consistent protection.

Answer

Force users to use Incognito mode

Answer

Require a VPN for all browser traffic

Answer

Disable all extensions

Question 7

Your company has an external contractor who needs temporary access to Google Workspace. You want to ensure their account automatically deactivates after 30 days without manual administrative intervention. How can you achieve this securely?

Accepted Answer

Use Cloud Identity Premium automated user lifecycle management or the Admin SDK API to schedule account suspension after 30 days.. Cloud Identity Premium provides automated user lifecycle management, allowing you to set policies to suspend accounts after a period of inactivity. Alternatively, you can use the Admin SDK API to programmatically suspend the account after 30 days. This achieves automatic deactivation without manual intervention.

Answer

Enable the Advanced Protection Program, which automatically deletes inactive external accounts after 30 days.

Answer

Set the user password expiration policy specifically for that user's OU to 30 days.

Answer

Configure a Context-Aware Access rule with a time-based expiration condition.

Question 8

Which TWO of the following can be enforced via ChromeOS device settings?

Accepted Answer

Forced re-enrollment after factory reset. Enforcing forced re-enrollment and restricted sign-in are core device security policies.

Answer

Automatic screen cleaning

Answer

Mandatory screen brightness levels

Answer

Automatic battery calibration

Question 9

A user claims they cannot reset their password using the 'Forgot Password' link. What is the most likely cause?

Accepted Answer

The self-service reset feature is disabled in Security settings. If 'Allow users to reset their passwords' is disabled in the Security settings, they cannot use the self-service flow.

Answer

The user is an admin

Answer

The user has 2FA enabled

Answer

The user account is in an OU without a license

Question 10

You need to prevent users from sharing sensitive files outside the organization. Which setting should you modify?

Accepted Answer

Drive sharing options in the Admin Console. Drive sharing options in the Admin Console let you restrict whether users can share files outside the organization, set default sharing visibility, and block external sharing entirely or by OU. This is the direct control for preventing sensitive files from leaving the org via Drive. Other settings address different concerns (endpoint security, retention, app access) and do not govern Drive sharing.

Answer

Endpoint management

Answer

Vault retention settings

Answer

App access control

Question 11

Your legal team requires that all emails from a specific user be preserved for an upcoming audit. Which tool should you use to ensure these messages are not deleted?

Accepted Answer

Google Vault. Google Vault is the eDiscovery and retention tool designed for legal and compliance use cases. It lets admins place holds on specific users' Gmail messages, ensuring they cannot be deleted even by the user, and supports search/export for audits. This directly satisfies the legal team's requirement to preserve a specific user's emails.

Answer

Data Loss Prevention (DLP) rules

Answer

Google Workspace Migration for Microsoft Outlook

Answer

Admin Console Reporting

Question 12

Which feature prevents a user from being deleted during a directory sync?

Accepted Answer

GCDS 'Do not delete' rule. The 'Do not delete' flag in GCDS prevents the sync process from removing accounts that don't match the source directory.

Answer

OU locking

Answer

Account suspension

Answer

Admin role assignment

Question 13

You want to prevent sensitive Drive documents from being printed. Which setting is appropriate?

Accepted Answer

Drive sharing options for viewers/commenters. In Google Drive sharing settings, admins can disable the 'Viewers and commenters can see the option to download, print, and copy' setting, which removes the print/download/copy options for users with view or comment access. This is the appropriate control to prevent printing of sensitive documents shared with those roles.

Answer

Context-aware access

Answer

Endpoint management

Answer

DLP policy

Question 14

You need to investigate a potential data breach where a user downloaded a large number of sensitive files. Which tool provides the most granular audit logs for Drive file downloads?

Accepted Answer

Security center investigation tool. The Security Center (Google Workspace Security Center) investigation tool provides the most granular, event-level audit data for Drive, including who downloaded which file, when, from what IP/device, and allows filtering and pivoting on those events. It is purpose-built for security investigations like mass-download detection.

Answer

DLP policy logs

Answer

Vault eDiscovery search

Answer

Reports dashboard

Question 15

You have configured a new transport rule, but it is not triggering as expected. What is the first troubleshooting step?

Accepted Answer

Check the Gmail Audit logs.. Gmail Audit logs in the Admin Console record every transport rule evaluation and action, so they reveal whether the rule matched, what action was taken, and why it may not have fired. Checking logs first is non-destructive and gives concrete evidence before changing configuration. This is the standard 'observe before you modify' troubleshooting discipline for Workspace rules.

Answer

Delete and recreate the rule.

Answer

Change the priority of the rule.

Answer

Restart the Google Workspace service.