GWS-ADMIN Practice Test 16 — 15 Questions

Question 1

An administrator needs to view all changes made to organizational units. Which report should they use?

Accepted Answer

Admin audit log. The Admin Audit log records all configuration changes within the Google Admin console.

Answer

User activity report

Answer

Login audit log

Answer

OAuth token audit

Question 2

An administrator is configuring a Context-Aware Access access level to protect Google Drive for a remote workforce. Which TWO conditions can be used in the access level to evaluate device trust and network origin? (Choose two.)

Accepted Answer

IP subnet: whether the user's source IP falls within a specified CIDR range.. Context-Aware Access access levels support conditions such as device policy, IP subnet, geographic region, and user identity. Device policy evaluates endpoint attributes like encryption and screen lock, while IP subnet evaluates the source network range, making both valid conditions for protecting Drive access.

Answer

Password length: whether the user's password meets a minimum character count.

Answer

App version: whether the Drive app is the latest release available.

Answer

Organizational unit: whether the user belongs to a specific organizational unit.

Question 3

Your organization wants to allow employees to use their personal iOS devices to access Google Workspace, but you need to ensure that corporate data can be wiped if the device is lost. You also want to avoid wiping personal data. Which mobile management setting should you enable?

Accepted Answer

Advanced mobile management. Advanced mobile management for iOS enables the separation of work and personal data. When a device is lost, admins can perform a corporate wipe that removes only managed Google Workspace data and apps, leaving personal data intact. Basic management does not offer this granularity. Context-Aware Access and Endpoint Verification are for access control and posture assessment, not data wiping. Therefore, advanced mobile management is the correct setting to meet both access and security requirements.

Answer

Endpoint Verification

Answer

Context-Aware Access

Answer

Basic mobile management

Question 4

What is the primary function of an alias address?

Accepted Answer

To provide an alternative email address for an existing user. An alias is an additional email address for an existing user that routes mail to the same inbox.

Answer

To act as a mailing list

Answer

To bypass domain verification

Answer

To create a separate inbox

Question 5

A user claims they cannot share a file with an external partner. What is the most likely cause within the Admin console?

Accepted Answer

The Drive sharing settings for the user's OU restrict external sharing.. Sharing settings in Drive and Docs are controlled at the Organizational Unit (OU) level, which can restrict external sharing.

Answer

The user's password has expired.

Answer

The storage quota for the domain is full.

Answer

The partner does not have a Google account.

Question 6

Your company uses Google Cloud Directory Sync to provision users from an on-premises Active Directory. A user who left the company was removed from Active Directory last week, but the account still appears as active in the Google Admin console after multiple sync runs. What is the most likely cause?

Accepted Answer

The GCDS configuration has the option to suspend or delete accounts disabled, so removed users are simply skipped.. GCDS only suspends or deletes Google accounts for users that disappear from the source directory when those actions are explicitly enabled in the configuration. With that option disabled, removed source users are ignored and their Google accounts stay active indefinitely, which is exactly the symptom described.

Answer

The user was moved to a different organisational unit in Active Directory, so GCDS treats the account as newly created rather than deleted.

Answer

The user's account is protected by a Vault retention hold that prevents directory modifications.

Answer

The sync rule excludes the user because their primary email address does not match the domain in the Google Workspace account.

Question 7

Which TWO actions can you take when a user account is under a Vault hold?

Accepted Answer

Prevent data deletion. A Vault hold is a preservation mechanism that overrides retention and deletion policies, so option B (Prevent data deletion) is correct because placing a user account under a hold stops Gmail messages, Drive files, and other covered data from being purged even after the retention period expires. Option D (Ensure data availability for eDiscovery) is also correct because the hold keeps the user's data searchable and exportable in Vault for legal or investigative purposes, which is the core reason holds are applied. The unmarked options do not belong: A (Automatically delete old emails) contradicts the preservation purpose of a hold, C (Enable 2-Step Verification) is an account security setting unrelated to Vault holds, and E (Allow the user to change their password) is a normal account action that a hold neither grants nor blocks.

Answer

Automatically delete old emails

Answer

Enable 2-Step Verification

Answer

Allow the user to change their password

Question 8

Your organization uses Context-Aware Access to restrict access to Google Workspace based on IP address ranges. A remote employee traveling for business is unable to access Gmail from a trusted hotel Wi-Fi. How should the administrator temporarily grant access without compromising long-term security?

Accepted Answer

Temporarily move the user to an organizational unit that does not have the Context-Aware Access rule applied, or assign a temporary exception access level.. Temporarily moving the user to an OU without the Context-Aware Access rule or assigning a temporary exception access level grants access without weakening the overall security posture. This approach is reversible and does not require permanent changes to access levels or disabling security features.

Answer

Permanently add the hotel IP subnet to the global Context-Aware Access access level.

Answer

Disable 2-Step Verification for the user's account.

Answer

Reset the user's OAuth tokens via the Admin SDK.

Question 9

Where do you manage the shared contacts for your organization?

Accepted Answer

Directory > Directory settings > Sharing settings. Shared contacts are managed in the Directory settings of the Admin console.

Answer

Gmail settings

Answer

Security settings

Answer

User profile settings

Question 10

You are a Workspace administrator. Your organization has a policy that all iOS devices accessing Gmail must have a passcode and be encrypted. You have enabled advanced mobile management for iOS. However, some users report that they can still access Gmail on their iOS devices without setting a passcode. What is the most likely reason for this?

Accepted Answer

The users are accessing Gmail through a mobile web browser instead of the Gmail app.. The most likely reason is that users are accessing Gmail through a mobile web browser rather than the Gmail app. Advanced mobile management for iOS enforces device policies only within managed Google apps. Mobile web access bypasses these app-level controls, allowing users to avoid passcode and encryption requirements. To close this gap, administrators should consider disabling mobile web access for Gmail or using Context-Aware Access to block unmanaged browsers.

Answer

The users are using the native iOS Mail app instead of the Gmail app.

Answer

The advanced mobile management setting is not applied to the organizational unit containing these users.

Answer

The iOS devices are not company-owned, so advanced mobile management does not apply.

Question 11

You are a Workspace admin. Your company issues Android devices to field technicians. You need to ensure that if a device is lost or stolen, you can remotely wipe only corporate data (Gmail, Drive, Calendar) without erasing personal photos and apps. The devices are enrolled in advanced mobile management. Which action should you take?

Accepted Answer

Use the 'Wipe corporate data' option for the device.. For Android devices in advanced mobile management, the 'Wipe corporate data' option selectively removes only the managed Google Workspace accounts and data. This secures corporate information while preserving personal apps and files. A full remote wipe would erase everything, which is unnecessary and harmful to the user. Suspending the account or changing the password does not remove data already on the device, so they do not satisfy the requirement.

Answer

Perform a remote wipe of the device from the Admin console.

Answer

Change the user's password.

Answer

Suspend the user account.

Question 12

A financial services company uses Google Workspace. The security team wants to ensure that when an employee's device is compromised, their active Google Workspace sessions are terminated immediately and they are required to re-authenticate with 2-Step Verification. Which action should the administrator take?

Accepted Answer

In the Admin console, navigate to the user's Security settings and click 'Sign out of all sessions'.. The 'Sign out of all sessions' action in the user's Security settings is the correct way to immediately terminate all active sessions for a user. It forces the user to re-authenticate on all devices, and if 2-Step Verification is enforced, they must complete that step again. Resetting the password, suspending the account, or enabling Context-Aware Access do not achieve immediate session termination and re-authentication with 2-Step Verification.

Answer

Suspend the user account, then unsuspend it after the device is secured.

Answer

Reset the user's password and enforce a password change at next login.

Answer

Enable Context-Aware Access with a policy that requires a secure device posture for all users.

Question 13

You need to ensure that all corporate-owned Android devices require a screen lock. Where should you configure this setting?

Accepted Answer

Devices > Mobile & endpoints > Settings > Android > Password settings. Android screen lock enforcement for corporate-owned devices is configured under Devices > Mobile & endpoints > Settings > Android > Password settings, where admins set password strength, length, and lock requirements that apply to managed Android devices. This is the mobile device management (MDM) policy path, distinct from user account password policy.

Answer

Apps > Google Workspace > Android settings

Answer

Security > Authentication > Password policy

Answer

Directory > Users > Security settings

Question 14

Which TWO of the following can be modified in the Admin console's 'Company Profile' section?

Accepted Answer

Support contact phone number. In the Admin console's Company Profile section, administrators can edit the organization's identity and contact details, which includes the Organization name (E) and the Support contact phone number (C). These fields are part of the company profile information used to identify the organization and provide contact details for support. Individual user password requirements (A) are configured under security or password policies, not the Company Profile. Domain verification records (B) are managed in the Domains section, and user licenses (D) are handled in the Billing or Subscriptions area, so neither belongs to the Company Profile.

Answer

Individual user password requirements

Answer

Domain verification records

Answer

User licenses

Question 15

Your organization wants to block access to Google Workspace from all Android devices that are not running the latest security patch. You have configured a Context-Aware Access access level that requires the device to have a security patch level within the last 90 days. However, you notice that some devices with outdated patches are still able to access Gmail. What is the most likely reason?

Accepted Answer

The security patch level attribute is only reported for devices in Advanced mobile management. The security patch level attribute is only collected for Android devices in Advanced mobile management. If some devices are in Basic management, the attribute is missing, and the access level may not block them. Ensuring all Android devices are in Advanced mobile management is necessary for this attribute to be enforced.

Answer

Security patch level is only reported for company-owned devices, not BYOD

Answer

The access level is applied to users, not devices, so it cannot block based on device patch level

Answer

Context-Aware Access does not support Android device attributes