GWS-ADMIN Practice Test 16 — 15 Questions

Question 1

A user needs to see their login history. Where can you find this information?

Accepted Answer

Account Activity report in the Admin Console.. The user's security log in the Admin console shows login attempts and device information.

Answer

Google Analytics.

Answer

The user's Gmail inbox.

Answer

Drive Audit logs.

Question 2

Which dashboard provides a summary of security incidents and potential policy violations?

Accepted Answer

Security center dashboard. The Security Center dashboard provides an overview of security-related events and policy violations across the workspace.

Answer

Vault dashboard

Answer

Compliance reports

Answer

User management dashboard

Question 3

Which Google Workspace service should you use to search and export user data for legal requests?

Accepted Answer

Google Vault. Vault is the primary tool for eDiscovery and legal data requests in Google Workspace.

Answer

Google Cloud Storage

Answer

Data migrations

Answer

Security center

Question 4

Which TWO reports or logs should an administrator check to verify whether Context-Aware Access rules are successfully blocking unauthorized connection attempts? (Choose two.)

Accepted Answer

Reporting > Audit > Login audit log events. Context-Aware Access blocks and evaluations are recorded in the Context-Aware Access log events and Audit log reports.

Answer

Apps > Google Workspace > Marketplace apps > Activity

Answer

Directory > Users > Organizational unit history

Answer

Security > Security Center > Billing and subscriptions log

Question 5

An administrator has configured a new SAML SSO integration with a third-party IdP. Users are complaining that they can log in successfully, but after 30 minutes, they are unexpectedly forced to re-authenticate. Where can the administrator adjust the session duration for SAML apps?

Accepted Answer

Security > Authentication > SSO with third-party IdP > Session length settings. SAML session length settings for third-party applications are configured within the specific SAML app settings in the Google Admin console.

Answer

Security > Access and data control > API controls

Answer

Apps > Web and mobile apps > [SAML App] > Service status

Answer

Account settings > Profile > Session duration

Question 6

When setting up SAML SSO with a third-party Identity Provider (IdP), which THREE pieces of information must typically be exchanged or configured in the Google Admin console? (Choose three.)

Accepted Answer

Entity ID (Issuer) provided by the IdP. SAML setup requires configuring the IdP sign-in URL, entity ID (issuer), and X.509 signing certificate.

Answer

The third-party IdP database connection string (SQL connection)

Answer

Google Workspace master database encryption key

Question 7

You need to ensure that all corporate-owned Android devices require a screen lock. Where should you configure this setting?

Accepted Answer

Devices > Mobile & endpoints > Settings > Android > Password settings. Mobile settings in the Google Admin console are where device security policies like screen lock requirements are defined.

Answer

Apps > Google Workspace > Android settings

Answer

Security > Authentication > Password policy

Answer

Directory > Users > Security settings

Question 8

You need to monitor for potentially malicious third-party apps accessing Drive data. Which feature should you use?

Accepted Answer

App access control. App access control allows admins to review and restrict third-party apps that have OAuth scopes to access Drive files.

Answer

DLP rules

Answer

Context-aware access

Answer

Vault matters

Question 9

You have a Data Region policy configured for the US. A user moves from the US to the EU. How do you trigger the migration of their existing data to the EU?

Accepted Answer

Move the user to an OU configured for the EU data region. Google Workspace automatically migrates data to the new region once the user's organizational unit (OU) is updated to a region mapped to the new location.

Answer

Manually run a data export in Vault

Answer

Re-provision the user account

Answer

Contact Google Support to initiate a manual migration

Question 10

How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?

Accepted Answer

Set a Gmail retention rule in Google Vault. A Vault retention rule for Gmail with a 3-year duration ensures all emails are preserved for that period, overriding user deletion.

Answer

Enable endpoint management

Answer

Use an Admin Console report

Answer

Configure a Gmail filter

Question 11

A user is leaving the company. You need to keep their data for 7 years. What is the best practice?

Accepted Answer

Create a Vault hold for the user's account. Placing a legal hold in Vault ensures all of a user's data is preserved indefinitely or until the hold is removed, which is appropriate for offboarding.

Answer

Export all data to a PST file

Answer

Transfer Drive ownership to another user

Answer

Suspend the user account and keep it

Question 12

You want to prevent sensitive Drive documents from being printed. Which setting is appropriate?

Accepted Answer

Drive sharing options for viewers/commenters. Drive sharing settings include an option to disable downloading, printing, and copying for viewers and commenters.

Answer

Context-aware access

Answer

Endpoint management

Answer

DLP policy

Question 13

You have configured a new transport rule, but it is not triggering as expected. What is the first troubleshooting step?

Accepted Answer

Check the Gmail Audit logs.. Checking the Gmail Audit logs for the specific message can confirm if the rule was applied or why it was skipped.

Answer

Delete and recreate the rule.

Answer

Change the priority of the rule.

Answer

Restart the Google Workspace service.

Question 14

You need to prevent users from sharing sensitive files outside the organization. Which setting should you modify?

Accepted Answer

Drive sharing options in the Admin Console. Drive sharing settings allow administrators to restrict sharing to internal users or specific whitelisted domains.

Answer

Endpoint management

Answer

Vault retention settings

Answer

App access control

Question 15

You need to ensure that credit card numbers are not sent via Gmail by your employees. Which tool should you configure?

Accepted Answer

DLP rules. DLP rules in Google Workspace allow administrators to define content detectors to scan for sensitive information like credit card numbers.

Answer

Context-aware access

Answer

Google Vault retention rules

Answer

Security center investigation tool