GWS-ADMIN Practice Test 13 — 15 Questions

Question 1

You need to monitor for potentially malicious third-party apps accessing Drive data. Which feature should you use?

Accepted Answer

App access control. App access control (also called app allowlisting/blocklisting) lets admins see which third-party OAuth apps have been granted access to Workspace data, review their scopes, and restrict or block apps that request risky Drive permissions. This is the feature designed to monitor and control third-party app access to Drive data.

Answer

DLP rules

Answer

Context-aware access

Answer

Vault matters

Question 2

A Google Workspace administrator is investigating why a user's Google Calendar events are not syncing to their mobile device. The user has an Android device with the Google Calendar app installed and signed in with their Workspace account. The administrator confirms that the user can access Calendar on the web and that events appear there. Which TWO of the following should the administrator check to resolve the mobile sync issue? (Choose two.)

Accepted Answer

Ensure that the Google Calendar app has permission to access the device's storage and background data.. Mobile sync issues often stem from device-level settings. The administrator should verify that Calendar sync is enabled for the Workspace account in Android account settings and that the Calendar app has necessary permissions, including background data. These two checks address the most common causes of events not appearing on mobile while web access works. Licensing and account suspension are unlikely given web access functions.

Answer

Confirm that the user's device is enrolled in mobile device management (MDM) and that Calendar access is allowed.

Answer

Check if the user's Google Workspace license includes Google Calendar.

Answer

Verify that the user's Google Workspace account is not suspended.

Question 3

An administrator wants to configure security policies to protect corporate data on mobile devices. Which THREE actions can be enforced through Google Workspace Endpoint Management? (Choose three.)

Accepted Answer

Enforce containerization or work profile segregation on Android devices.. Option A is correct because Google Workspace Endpoint Management supports Android work profiles, which containerize corporate apps and data separately from personal apps and data, preventing cross-contamination and enabling IT to manage only the work side. Option B is correct because administrators can enforce device policies such as requiring a screen lock and a strong password/PIN on enrolled mobile devices before granting access to Workspace data. Option C is correct because Endpoint Management allows administrators to remotely wipe corporate data (a selective/account wipe) or perform a full device wipe on lost or stolen devices to protect sensitive information. Option D is not correct because deep packet inspection of all cellular traffic is a network-level capability typically performed by carrier or dedicated security appliances, not a policy enforced by Google Workspace Endpoint Management. Option E is not correct because reading personal text messages on a user's personal phone would violate privacy boundaries and is not a function of Google Workspace Endpoint Management, which manages corporate data and app access rather than personal communications.

Answer

Configure deep packet inspection on all cellular data traffic passing through the device.

Answer

Directly access and read personal text messages stored on the user's personal phone.

Question 4

Which TWO of the following methods can be used to enroll Android devices?

Accepted Answer

QR code scanning. QR code scanning (C) is a valid Android enrollment method in which the device's setup wizard or the Android Device Policy app reads a QR code containing the enrollment token and server details, allowing the device to register with the management service without manual configuration. Zero-touch enrollment (D) is also correct because it lets an organization pre-register devices purchased through authorized resellers so they automatically enroll into the EMM/MDM during initial setup, with no user action required. Manually entering the server IP address (A) is not a standard Android enrollment method, as enrollment relies on tokens, QR codes, or managed Google accounts rather than raw IP entry. A physical USB cable connection to the Admin's PC (B) is not an Android enrollment mechanism; USB is used for ADB debugging or flashing, not for EMM enrollment. Installing a third-party root certificate (E) is unrelated to enrollment and would not register a device with a management service.

Answer

Manually entering the server IP address

Answer

Physical USB cable connection to the Admin's PC

Answer

Installing a third-party root certificate

Question 5

An enterprise organization is planning its 2-Step Verification (2SV) rollout. Which THREE methods or tokens are natively supported by Google Workspace for 2SV authentication? (Choose three.)

Accepted Answer

Time-based One-Time Password (TOTP) authenticator apps (e.g., Google Authenticator). Google Workspace natively supports several 2SV methods, and the three correct options here are A, D, and E. Option A is correct because Time-based One-Time Password (TOTP) authenticator apps such as Google Authenticator generate 6-digit codes from a shared secret and are a standard 2SV method in Google Workspace. Option D is correct because Google Prompts push a sign-in approval notification to a trusted mobile device signed into the same account, allowing the user to tap Yes/No without typing a code. Option E is correct because FIDO2/U2F security keys like Titan keys are supported as phishing-resistant hardware tokens for 2SV. Option B is not correct because Google Workspace 2SV does not rely on local BIOS firmware biometric retina scanning; biometrics may unlock a device but are not a Workspace 2SV token. Option C is not correct because automatic voice call verification via landline pulse dialing tones is not a supported Google Workspace 2SV method.

Answer

Biometric retina scans processed by local BIOS firmware

Answer

Automatic voice call verification through landline pulse dialing tones

Question 6

Which TWO of the following can be restricted in Google Drive sharing settings?

Accepted Answer

Sharing with users who do not have a Google account. Option B is correct because Google Drive's sharing settings include an admin control that limits whether files can be shared with people who don't have a Google account, typically by restricting sharing to only users within the domain or requiring recipients to sign in with a Google account. Option D is correct because Google Workspace admins can configure sharing settings to control whether files can be shared outside the organization, including options like turning off external sharing entirely or limiting it to allowlisted domains. Option A is incorrect because file size limits are governed by storage quotas and upload limits, not by Drive sharing settings. Option C is incorrect because who can use the Drive app is controlled through user licensing and app access settings, not sharing settings. Option E is incorrect because there is no per-day file sharing limit configurable in Drive sharing settings.

Answer

The size of files shared via links

Answer

The specific users who can use the Drive app

Answer

The number of files a user can share per day

Question 7

Your organization uses Google Workspace and you have been asked to ensure that all email sent from your domain passes SPF, DKIM, and DMARC checks. You have already published SPF and DKIM records. Which action should you take to complete the DMARC configuration?

Accepted Answer

Publish a DMARC TXT record at _dmarc.yourdomain.com with a policy of p=quarantine or p=reject.. DMARC is implemented by publishing a TXT record at _dmarc.yourdomain.com with a policy such as quarantine or reject. This tells receiving servers how to treat messages that fail SPF and DKIM alignment. Admin console settings and MX records do not configure DMARC, so the DNS TXT record is the required action.

Answer

Configure a DMARC policy in the Google Workspace Security center under Authentication.

Answer

Enable DMARC in the Google Admin console under Apps > Google Workspace > Gmail > Compliance.

Answer

Add a DMARC record to the Google Workspace MX records list.

Question 8

A user is leaving the company. You need to keep their data for 7 years. What is the best practice?

Accepted Answer

Create a Vault hold for the user's account. A Vault hold preserves all data (Gmail, Drive, Meet, etc.) for a user indefinitely, regardless of retention rules or user actions, making it the best practice for legal/regulatory retention when an employee leaves. Holds are the only mechanism that guarantees data cannot be purged until the hold is removed, which is essential for 7-year retention requirements.

Answer

Export all data to a PST file

Answer

Transfer Drive ownership to another user

Answer

Suspend the user account and keep it

Question 9

An administrator needs to restrict access to Google Workspace apps so that users can only log in from corporate-managed Chromebooks and Windows devices enrolled in Endpoint Management, while blocking all mobile devices entirely. How should this be implemented?

Accepted Answer

Use Context-Aware Access with access levels checking for device policy compliance and specific operating systems (desktop OS only).. Context-Aware Access is the only Google Workspace mechanism that evaluates device posture (managed/enrolled status, OS type, screen lock, encryption) at authentication time via access levels. By creating an access level that requires 'device policy compliance' and restricting the OS to Chrome OS and Windows (excluding iOS/Android), the admin enforces the exact policy described. Access levels are then bound to Workspace apps (Gmail, Drive, etc.) so users on unmanaged or mobile devices are denied.

Answer

Set up IAM conditions in the Google Cloud console for Google Workspace endpoints.

Answer

Apply an Advanced Protection policy for all mobile users.

Answer

Configure mobile device management settings to turn off Google sync for iOS and Android.

Question 10

A user is unable to access a specific mobile app on their managed device. Which tool should you use to check the device policy status?

Accepted Answer

Device Management dashboard. To check the device policy status for a managed device, you should use the Device Management dashboard. This dashboard provides an overview of all managed devices, their compliance status, and applied policies. It allows you to drill down into a specific device to see which policies are applied and if there are any issues.

Answer

Directory settings

Answer

Group settings

Answer

Security Investigation Tool

Question 11

Which report would you use to identify users who haven't logged in for more than 30 days?

Accepted Answer

Reports > User Reports > User accounts. The report to identify users who haven't logged in for more than 30 days is found under Reports > User Reports > User accounts. This report provides a list of user accounts with their last login time, allowing you to filter by inactivity. It is the designated place for user account activity metrics.

Answer

Reports > Security > Login

Answer

Apps > Google Workspace > Reports

Answer

Directory > Users > Account status

Question 12

Where do you go in the Admin Console to view the current data region for your organization?

Accepted Answer

Account > Account settings > Data regions. The 'Account settings' section under 'Account' contains the data regions configuration.

Answer

Vault > Settings

Answer

Apps > Google Workspace

Answer

Security > Data protection

Question 13

Which of the following is true regarding 'Advanced' mobile management for iOS?

Accepted Answer

It allows administrators to manage Wi-Fi profiles and certificates. Advanced management provides more control, such as certificate management and enterprise Wi-Fi configuration, compared to Basic management.

Answer

It replaces the need for an Apple Push Certificate

Answer

It automatically removes the device after 30 days

Answer

It is required for all Android devices

Question 14

Which THREE settings can be configured within the Gmail Compliance section?

Accepted Answer

Content compliance. In the Google Admin console, the Gmail Compliance section (Apps > Google Workspace > Gmail > Compliance) provides rules for inspecting and acting on messages, and it includes Content compliance (A), which lets admins define rules that match message content, headers, or attachments and then route, quarantine, or reject them. It also includes Attachment compliance (D), which applies policies specifically to attachments based on file type, name, or size, such as blocking or quarantining messages with certain files. Profanity check (B) is likewise a configurable compliance rule that scans message content against a predefined or custom word list and can block, quarantine, or route offending messages. SPF record generation (C) is not part of Gmail compliance; SPF is a DNS TXT record configured in domain DNS settings, not in the Gmail Compliance UI. Default signature settings (E) are configured under Gmail > General settings (or per-user signatures), not within the Compliance section.

Answer

SPF record generation

Answer

Default signature settings

Question 15

Which TWO of the following steps are useful when troubleshooting a user's inability to share a file externally?

Accepted Answer

Review Drive sharing policies in the Admin console. Option A is correct because external sharing in Google Workspace is governed by Admin console settings under Apps > Google Workspace > Drive and Docs > Sharing settings, where policies such as "Sharing outside of <domain>" can be set to OFF or restricted to whitelisted domains, directly blocking a user's ability to share a file externally. Option C is correct because files in a shared drive are subject to the shared drive's own membership and access rules, and external sharing may be limited by the shared drive's settings or by the user lacking the required role (e.g., Manager or Content Manager with sharing privileges), so confirming the file's location is essential. Option B is wrong because changing the primary email address does not affect sharing permissions and would only disrupt the user's identity. Option D is wrong because browser version is unrelated to Drive sharing policy enforcement. Option E is wrong because resetting the Google account is a drastic, unrelated action that would not resolve a sharing policy or shared drive permission issue.

Answer

Change the user's primary email address

Answer

Verify the user's browser version

Answer

Reset the user's Google account