GWS-ADMIN Practice Test 14 — 15 Questions

Question 1

When an email is reported as missing, which THREE logs or tools can help you track the issue?

Accepted Answer

Security Investigation Tool. The Security Investigation Tool is correct because it lets admins search Gmail log events (e.g., message ID, sender, recipient, subject, delivery status) and run investigations across the domain to trace what happened to a missing message. Gmail Audit logs are correct because they record Gmail-specific events such as message delivery, content compliance, and admin actions, which help reconstruct a message's lifecycle. Email Log Search is correct because it is the dedicated tool for tracing a specific message's delivery path, showing whether it was delivered, delayed, bounced, or rejected, and where it was routed. Device audit logs are not correct because they cover endpoint/device activity (e.g., mobile device events) rather than Gmail message delivery. Google Calendar logs are not correct because they pertain to calendar events and sharing, not email message tracking.

Answer

Device audit logs

Answer

Google Calendar logs

Question 2

When setting up SAML SSO with a third-party Identity Provider (IdP), which THREE pieces of information must typically be exchanged or configured in the Google Admin console? (Choose three.)

Accepted Answer

Entity ID (Issuer) provided by the IdP. In the Google Admin console's SAML SSO configuration (Security > Authentication > SSO with third-party IdP), you must supply the IdP's Entity ID (Issuer) so Google can validate the SAML assertion's issuer and audience (Option A). You must also enter the IdP's Sign-in URL (SSO endpoint) so Google can redirect unauthenticated users to the correct IdP login page (Option C). Finally, you upload the IdP's X.509 public signing certificate so Google can verify the digital signature on incoming SAML responses/assertions (Option E). Options B and D are incorrect because SAML SSO is an XML-based authentication federation protocol and never requires a SQL database connection string or any Google Workspace master database encryption key; those are unrelated to SAML metadata exchange.

Answer

The third-party IdP database connection string (SQL connection)

Answer

Google Workspace master database encryption key

Question 3

Which TWO reports or logs should an administrator check to verify whether Context-Aware Access rules are successfully blocking unauthorized connection attempts? (Choose two.)

Accepted Answer

Reporting > Audit > Login audit log events. Option E, Reporting > Audit > Context-Aware Access, is correct because this dedicated audit log records every Context-Aware Access evaluation, showing whether an access attempt was granted or denied and the specific access level and device/context attributes that triggered the decision, which is exactly what is needed to verify blocking behavior. Option D, Reporting > Audit > Login audit log events, is correct because Context-Aware Access denials during sign-in are surfaced in the login audit log with event details indicating the access was blocked due to unmet access level requirements, allowing the admin to confirm unauthorized sign-in attempts were rejected. Option A, Apps > Google Workspace > Marketplace apps > Activity, only covers Marketplace app authorization and usage events, not Context-Aware Access enforcement. Option B, Directory > Users > Organizational unit history, merely tracks changes to a user's OU membership over time and contains no access-attempt data. Option C, Security > Security Center > Billing and subscriptions log, is unrelated to access control and only concerns billing/subscription events.

Answer

Apps > Google Workspace > Marketplace apps > Activity

Answer

Directory > Users > Organizational unit history

Answer

Security > Security Center > Billing and subscriptions log

Question 4

Which tool would you use to sync local Active Directory users to Google Workspace?

Accepted Answer

Google Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the standard tool for one-way synchronization from AD to Google.

Answer

Google Workspace Migrate

Answer

Directory API

Answer

Admin SDK

Question 5

You are using the Directory API to update user phone numbers. Which method should you use?

Accepted Answer

PATCH. The 'patch' method allows updating specific fields without needing to send the entire user resource.

Answer

GET

Answer

POST

Answer

DELETE

Question 6

An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?

Accepted Answer

Security > Authentication > 2-step verification. Enforcing 2-Step Verification requires navigating to Security > Authentication > 2-step verification in the Google Admin console.

Answer

Account settings > Security settings > 2SV

Answer

Directory > Users > Security > Access control

Answer

Devices > Mobile & endpoints > Settings > Universal settings

Question 7

Which THREE of the following are settings that can be controlled in the Chrome browser for all users?

Accepted Answer

Force-installing extensions. Extension installation, homepage URL, and bookmark sync are controllable browser policies.

Answer

Forcing a specific font size

Answer

Enforcing a specific desktop wallpaper

Question 8

An organization uses a third-party gateway to route email. Users report that emails are being marked as spam frequently. Which DNS record should you investigate to ensure Google trusts the gateway?

Accepted Answer

SPF record. SPF (Sender Policy Framework) is the DNS TXT record that lists which hosts are authorized to send mail for a domain. When a third-party gateway routes outbound mail, Google's receiving servers check the envelope sender's domain SPF record to verify the gateway's IP is authorized; if the gateway's IP is missing from SPF, messages fail SPF and are more likely to be marked spam. The correct record to investigate is therefore the SPF record.

Answer

DKIM record

Answer

A record

Answer

MX record

Question 9

An organization is failing to receive emails from a specific sender. The logs show the messages were rejected by the 'Spam Filter'. What should you do?

Accepted Answer

Add the sender to the 'Approved senders' list.. Adding the sender's domain or IP to the 'Approved senders' list in the Gmail settings will allow the messages to bypass spam filtering.

Answer

Disable all spam filtering for the domain.

Answer

Delete the sender's email address.

Answer

Increase the domain storage limit.

Question 10

You are a Workspace administrator. A user reports that their company-owned Android device is not receiving work emails in the Gmail app. You check the Admin console and see that the device is listed as 'Pending' in the mobile devices list. What is the most likely reason for this status?

Accepted Answer

The device has not been approved by an administrator and is awaiting approval to access Workspace data.. A 'Pending' status in the mobile devices list means the device has requested access but has not been approved by an administrator. Until approval, work data such as Gmail will not sync. The other options describe issues that would produce different statuses or errors, not a pending approval state.

Answer

The device is running an outdated version of the Gmail app that is not supported by your organization.

Answer

The user has not set a screen lock on the device, so it is blocked from syncing.

Answer

The device is not connected to Wi-Fi, so it cannot complete enrollment.

Question 11

Which Google Workspace service should you use to search and export user data for legal requests?

Accepted Answer

Google Vault. Google Vault is the eDiscovery and information governance service in Google Workspace, purpose-built for searching, holding, and exporting user data (Gmail, Drive, Meet, Chat) in response to legal requests. It provides the search, hold, and export workflows required for litigation and compliance.

Answer

Google Cloud Storage

Answer

Data migrations

Answer

Security center

Question 12

A new employee joins the company, and the administrator wants the user's mailbox to be created in the Sales organizational unit with a Google Workspace license applied automatically. Which action accomplishes this?

Accepted Answer

Create the user account and place it in the Sales organizational unit, then assign a license. The correct workflow is to create the user, set the organizational unit to Sales during creation, and assign a Google Workspace license. The organizational unit determines which policies apply, and the license activates services such as Gmail, which provisions the mailbox. Adding to a group or enabling Gmail globally does not meet either requirement.

Answer

Create the user account and add it to a Google Group named Sales

Answer

Create the user account and assign a Google Workspace license, then move the account later

Answer

Create the user account in the root organizational unit and enable Gmail for everyone

Question 13

As a Google Workspace administrator, you need to ensure that all users in your organization are required to use two-step verification. Which setting in the Admin console controls this enforcement?

Accepted Answer

Security > Authentication > Two-step verification. Two-step verification enforcement is configured under Security > Authentication in the Admin console. Administrators can enforce it for the entire organization or specific organizational units, ensuring users must set up and use 2-Step Verification when signing in.

Answer

Devices > Mobile & endpoints > Settings

Answer

Directory > Users > Security

Answer

Apps > Google Workspace > Security

Question 14

A Google Workspace administrator is preparing to add a new secondary domain and needs to ensure that users in that domain can sign in and receive mail. Which two actions must the administrator perform after adding the domain in the Admin console? (Choose two.)

Accepted Answer

Verify domain ownership by adding a TXT record to the domain's DNS settings. After adding a secondary domain, the administrator must verify ownership via a TXT record and configure MX records so email is routed to Google. Verification proves control of the domain, and MX records enable mail delivery. Changing the primary domain and adding a domain alias are different features, while SPF and DKIM are optional deliverability enhancements.

Answer

Add the domain to the Google Workspace Directory as a domain alias

Answer

Configure SPF and DKIM records for the new domain to improve deliverability

Answer

Set the new domain as the primary domain for the account

Question 15

Your organisation has a primary domain, example.com, and a secondary domain, example.net. The marketing team wants all new hires to receive an address at example.net while existing staff keep their example.com addresses. You have already verified example.net and created the necessary users. What must you do so that mail sent to the new users' example.net addresses is delivered?

Accepted Answer

Add the MX records for example.net in your DNS provider, pointing to Google's mail servers.. Inbound mail routing depends on MX records, not on verification or aliasing. Because example.net is a verified secondary domain, the administrator must publish Google's MX records for that domain in DNS. Verification only establishes ownership, aliasing only adds a receive-only address, and changing the primary domain would rename every existing account.

Answer

Publish a TXT record containing the Google site-verification token for example.net.

Answer

Create an alias domain for example.net and assign it to the marketing organisational unit.

Answer

Set example.net as the primary domain so that new users inherit the correct address.