GWS-ADMIN Practice Test 15 — 15 Questions

Question 1

A security analyst needs to investigate a suspected data exfiltration event involving Google Drive. The analyst has access to the Admin Console and Security Center. Which two actions should the analyst take to gather evidence of external sharing and file downloads? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the Drive audit log in the Admin Console filtered by the user and event type.. Drive audit logs contain the events needed to reconstruct sharing and download activity. The Security Investigation Tool provides a flexible query interface over those same logs and can export results. Together they let the analyst identify external shares and downloads and preserve the evidence.

Answer

Create a Vault matter and export the user's Drive files.

Answer

Change the Gmail log retention setting to capture Drive events.

Answer

Export the Security Center dashboard summary for the user.

Question 2

A Google Workspace administrator needs to enforce a policy that requires all users to have a recovery email address set. The administrator wants to monitor compliance and generate a report of users missing a recovery email. What is the most efficient way to achieve this?

Accepted Answer

Use the Admin SDK Directory API to retrieve all users and filter those without a recovery email.. The Admin SDK Directory API is the appropriate tool to retrieve user data, including recovery email, and can be used to programmatically identify users missing this field. This allows for efficient monitoring and reporting, unlike manual checks or using unrelated APIs. The Reports API does not cover profile fields, and Google Groups alerts are not designed for this purpose.

Answer

Set up a Google Groups email alert to notify when a user without a recovery email logs in.

Answer

Use the Admin console to manually check each user's profile for a recovery email.

Answer

Use the Google Workspace Reports API to generate a report on user recovery email status.

Question 3

Your organisation has multiple departments and you want to delegate password reset duties to a small group of team leads without giving them full administrator privileges. Each team lead should only be able to reset passwords for users in their own department's organizational unit. What is the most appropriate approach?

Accepted Answer

Create a custom role with the Users > Reset password privilege and assign it to each team lead with an organisational unit scope of their department.. Custom roles with a narrowly defined privilege set, assigned at the department organisational unit, deliver exactly the password-reset capability needed without granting unrelated administrative rights. Prebuilt roles like Help Desk Administrator are too broad, super administrator is excessive, and Groups Administrator governs groups rather than user credentials.

Answer

Add each team lead to a Google Group and grant that group the Groups Administrator role.

Answer

Assign the prebuilt Help Desk Administrator role to each team lead.

Answer

Make each team lead a super administrator and instruct them to only reset passwords for their own department.

Question 4

A Google Workspace administrator needs to give a user the ability to reset passwords for other users in the Support organizational unit only, without granting broader privileges. Which role should be assigned?

Accepted Answer

Custom role with the Users > Reset Password privilege scoped to the Support organizational unit. The requirement is least privilege for password resets limited to one organizational unit. A custom role with the Users > Reset Password privilege scoped to the Support organizational unit achieves exactly that. Predefined roles such as Super Admin, User Management Admin, and Help Desk Admin grant broader, account-wide permissions that exceed the stated need.

Answer

User Management Admin

Answer

Help Desk Admin

Answer

Super Admin

Question 5

You are a Workspace administrator for a company that uses ChromeOS devices. You want to ensure that all ChromeOS devices are automatically enrolled in your organization's domain when they are first powered on by an employee. Which setting should you configure?

Accepted Answer

Zero-touch enrollment. Zero-touch enrollment is the correct method to automatically enroll ChromeOS devices upon first power-on. It requires pre-registering device serial numbers with Google, typically through a reseller or the Admin console. Once enrolled, devices are managed by your organization. Other options like forced re-enrollment only apply after a device has been enrolled and then wiped, while enrollment controls and device policies do not provide automatic initial enrollment.

Answer

Device policy for ChromeOS

Answer

Enrollment controls

Answer

Forced re-enrollment

Question 6

What is the maximum number of custom aliases a user can have?

Accepted Answer

30. Google allows up to 30 aliases per user.

Answer

10

Answer

50

Answer

Unlimited

Question 7

A Google Workspace administrator is troubleshooting a Google Meet issue for a user. The user reports that when they try to join a meeting from a Chrome browser, they see a 'You cannot join this call' error, but other participants can join successfully. The user can join the same meeting from the Google Meet mobile app without issues. The administrator checks the user's OU and confirms that Google Meet is enabled and that the user has a valid license. Which is the MOST likely cause of the browser-specific error?

Accepted Answer

The user's Chrome browser is signed in with a different Google Account than the one used for Google Workspace, causing a mismatch in meeting permissions.. The browser-specific error suggests an account mismatch. If Chrome is signed in with a different Google Account than the one used for Google Workspace, Meet may block access because the meeting is restricted to the organization. The mobile app likely has the correct Workspace account signed in, allowing the user to join. The administrator should instruct the user to sign out of Chrome or switch to the correct Workspace account.

Answer

The user's Chrome browser has a policy installed that blocks third-party cookies, which Google Meet requires for authentication.

Answer

The user's Chrome browser has an extension installed that interferes with Google Meet's ability to access the microphone and camera, causing a join failure.

Answer

The user's Chrome browser is outdated and does not support the latest WebRTC standards required by Google Meet.

Question 8

A school district's Workspace administrator needs every staff member's directory listing to display a job title and department that are visible to all users in the domain, including on the Contacts card in Gmail. The data already exists in the district's HR system. Which action accomplishes this with the least manual effort?

Accepted Answer

Populate the built-in Job title and Department fields using bulk upload or the Directory API, since those fields are directory-visible by default.. Job title and Department are built-in directory fields with domain-wide visibility by default, and they render on the Contacts card. Because the data already exists in HR, a bulk CSV upload or Directory API update loads all staff records efficiently. Custom attributes, groups, and OU naming do not populate these standard visible fields.

Answer

Add the values as custom attributes on each user and instruct staff to share them manually.

Answer

Create a Google Group named after each department and add staff as members so the group name appears on their profile.

Answer

Set the organizational unit name to the department and the user's description field to the job title.

Question 9

A user reports that they are unable to access a Google Meet link shared by an external partner. The user can access other Google Meet links from within the organization. Which TWO of the following should the administrator check to resolve this? (Choose two.)

Accepted Answer

Check the Google Meet video settings in the Admin console for external participants.. External Google Meet access can be blocked by Admin console settings that restrict external participants or by the meeting link's own restrictions. Checking the video settings for external participants and verifying the link's validity and authentication requirements are the two most direct steps. Other options like license or device requirements are not relevant because the user can access internal meetings.

Answer

Verify the user's Google Workspace license includes Google Meet.

Answer

Ensure the user's device meets the minimum system requirements for Google Meet.

Answer

Verify the user's Google Calendar is correctly syncing with Google Meet.

Question 10

Your organization is subject to a regulation that requires all Google Workspace data for users in the European Union to be stored within the EU. You have already set up a data region policy for the EU. However, you discover that some user data is still stored in the United States. What is the most likely reason for this?

Accepted Answer

The data region policy only applies to new data created after the policy was set; existing data is not automatically migrated.. Data region policies in Google Workspace control where data at rest is stored for covered services. However, they do not automatically migrate existing data when enabled. Only new data generated after the policy takes effect is stored in the specified region. To move existing data, you must initiate a data migration request through Google Support. Therefore, the presence of US-stored data is expected if the policy was recently applied.

Answer

The user's account was created before the data region policy was enforced, so their data remains in the default region.

Answer

The data region policy was not applied to all organizational units; some users are excluded.

Answer

Data region policies only cover Gmail and Drive, not other services like Calendar or Meet.

Question 11

A user reports that their company-owned Android device is not receiving work emails in the Gmail app. You check the Admin console and see that the device is listed as 'Compromised'. What is the most likely cause?

Accepted Answer

The device has been rooted, which triggers the compromised status.. Google Mobile Management marks a device as compromised when it detects security compromises such as rooting (Android) or jailbreaking (iOS). Rooting gives superuser access, undermining device security. The compromised status typically triggers policy actions, such as blocking access to work data. Thus, rooting is the most likely cause for the user's issue.

Answer

The device is running an outdated version of Android, which automatically flags it as compromised.

Answer

The user has installed a third-party app from outside the Google Play Store, which is always considered compromised.

Answer

The device has not been enrolled in Google Mobile Management, so it is flagged as compromised.

Question 12

You need to prevent users from sharing Google Drive files with people outside the organization. Which setting should you modify?

Accepted Answer

Apps > Google Workspace > Drive and Docs > Sharing settings. In the Google Workspace Admin console, the setting to control external sharing for Google Drive is found under Apps > Google Workspace > Drive and Docs > Sharing settings. This section allows administrators to set policies such as preventing users from sharing files outside the organization. Modifying this setting enforces the restriction at the organizational unit level.

Answer

Directory > Users > Sharing

Answer

Account > Organizational units > Restrictions

Answer

Security > Access and data control > Drive

Question 13

A Workspace administrator is troubleshooting a report that calendar invitations sent by a user are not appearing on recipients' calendars. The recipients are internal users in the same domain. The administrator confirms that the sender can create events and that recipients receive the invitation emails. Which setting should the administrator check to resolve the issue?

Accepted Answer

The recipients' Calendar settings for automatically adding invitations to their calendars.. Google Calendar includes a user-level preference that determines whether invitations are automatically added to the calendar. When recipients receive the invitation email but do not see the event, this setting is a common cause. Verifying it on the affected recipients' Calendar settings explains the behavior and provides a straightforward fix, since enabling automatic addition makes future invitations appear without manual action.

Answer

The sender's Calendar resource booking policy to confirm they have permission to invite other users.

Answer

The sender's Calendar sharing settings for the domain, specifically whether free/busy information is shared.

Answer

The domain's SPF and DKIM records to ensure calendar invitation emails are authenticated and not filtered.

Question 14

A Google Workspace administrator is troubleshooting why a user cannot access a Google Drive file shared by another user in the same domain. The file is owned by a user in the same domain, and the sharing settings are set to 'Anyone in the organization with the link can view'. The user reports seeing a 'You need permission' error. The administrator has verified that the user is signed in with the correct account. Which of the following is the most likely cause?

Accepted Answer

The user's organizational unit has a Drive sharing policy that prevents them from accessing files shared with 'Anyone in the organization'.. Drive sharing policies at the organizational unit level can override file-level sharing settings. If the user's OU has a policy that blocks access to files shared with 'Anyone in the organization', the user will see a permission error even though the file's settings allow it. Administrators should review the OU's sharing settings and adjust if necessary.

Answer

The file owner has not granted the user explicit permission.

Answer

The user's Google Drive is full, preventing them from viewing shared files.

Answer

The file is in a shared drive where the user is not a member.

Question 15

Which THREE security settings are commonly configured using Context-Aware Access?

Accepted Answer

Device security posture (e.g., screen lock). Context-Aware Access in Google Workspace evaluates access requests based on attributes of the user, device, and context, so device security posture such as screen lock status (A) is a valid access level condition that can block or allow apps based on whether the device meets requirements like encryption or screen lock. User IP address (B) is a supported condition, allowing admins to restrict access to specific IP ranges or subnets via access levels. Geographical location (E) is also supported, since Context-Aware Access can evaluate the source country or region of the request to grant or deny access. Email signature format (C) is a Gmail compliance/branding setting unrelated to access decisions, and user password strength (D) is enforced through password policies, not Context-Aware Access conditions.

Answer

Email signature format

Answer

User password strength