GWS-ADMIN Practice Test 17 — 15 Questions

Question 1

Which TWO of the following can be configured in the Google Workspace Admin Console to restrict user access to Google Drive?

Accepted Answer

Restrict sharing settings for external domains. Option A is correct because the Admin console's Drive and Docs sharing settings let you restrict how users can share files outside your domain, such as turning off external sharing or limiting it to whitelisted domains, which directly restricts user access to Drive content. Option E is correct because Drive can be turned ON or OFF per Organizational Unit (or group), so disabling Drive for a specific OU prevents those users from accessing Drive entirely. Option B is not a Drive access control; file creation counts are governed by storage quotas, not a per-user file-count limit in the Admin console. Option C is not configurable as a Drive access restriction; Drive does not offer an Admin console setting to block access by file type. Option D is not a Drive access restriction either; upload size limits are not an Admin console Drive access control (Drive enforces a 5 TB per-file maximum, not a configurable Admin setting).

Answer

Limit the number of files a user can create

Answer

Restrict access to specific file types

Answer

Set a file size limit for all uploads

Question 2

A university uses Google Workspace for Education. The IT team wants to ensure that all new Google Drive files created by students are automatically scanned for sensitive data such as credit card numbers, and that any matches are logged for review. They do not want to block file creation. What should they configure?

Accepted Answer

Drive DLP rule with a condition for credit card numbers, set to 'Alert and log'.. Drive DLP rules are designed to scan Drive content for sensitive information using detectors like credit card numbers. By setting the action to 'Alert and log', the system will record matches without blocking file creation, allowing the IT team to review incidents later. This satisfies both the scanning and non-blocking requirements.

Answer

Drive audit log with a custom alert for credit card numbers.

Answer

Drive DLP rule with a condition for credit card numbers, set to 'Block'.

Answer

Gmail DLP rule with a condition for credit card numbers, set to 'Quarantine'.

Question 3

You need to ensure that credit card numbers are not sent via Gmail by your employees. Which tool should you configure?

Accepted Answer

DLP rules. Data Loss Prevention (DLP) rules in Google Workspace can scan Gmail content for predefined detectors like credit card numbers (using regex and checksum validation) and take actions such as block, quarantine, or warn. This is the purpose-built tool for preventing sensitive data like PANs from being emailed. Other tools handle access, retention, or investigation, not content-based blocking.

Answer

Context-aware access

Answer

Google Vault retention rules

Answer

Security center investigation tool

Question 4

A user is unable to access Google Drive. Which TWO of the following should you check first?

Accepted Answer

User account status (Suspended/Active). Option B (User account status Suspended/Active) is correct because if the user's Google Workspace account has been suspended or disabled by an administrator, the user will be unable to sign in to Google Drive regardless of network or device conditions, making account status a primary troubleshooting check. Option D (Google Workspace Status Dashboard) is correct because it reports current service health and outages for Google Workspace apps including Drive; if Drive is experiencing a widespread outage, the issue is on Google's side and no client-side fix will help. Option A (browser history) is not relevant because cached browsing history does not cause or explain access failures to Drive. Option C (computer model) is irrelevant since Google Drive access depends on the browser and account, not the hardware model. Option E (printer configuration) is unrelated because printing has no bearing on the ability to access Google Drive.

Answer

User's browser history

Answer

The user's computer model

Answer

The user's printer configuration

Question 5

Which TWO practices are recommended when configuring organizational units (OUs) for security policy enforcement in Google Workspace? (Choose two.)

Accepted Answer

Regularly audit OU membership and policy inheritance to ensure users receive appropriate security controls.. Option C is correct because Google Workspace policies are inherited down the OU tree, so regularly auditing OU membership and inheritance ensures users actually receive the intended security controls and that no one is misplaced in an OU with weaker settings. Option E is correct because structuring OUs hierarchically to mirror departments or differing security requirements lets child OUs inherit parent policies while allowing targeted overrides only where needed, which is the recommended design for policy enforcement. Option A is not recommended because Super Administrator privileges should be tightly limited, not granted to each OU head, since that role has broad control over all services and settings. Option B is unnecessary and error-prone because child OUs already inherit parent policies, so overriding identical policies at every level adds administrative overhead and risk of inconsistency. Option D is wrong because placing all users in the root OU prevents granular, differentiated policy application by department or security requirement.

Answer

Assign Super Administrator privileges to the head of each organizational unit.

Answer

Override policies at every child OU level even when parent policies are identical to ensure redundancy.

Answer

Place every single user in the root organizational unit to ensure uniform policy application.

Question 6

How can you prevent users from changing their profile photo?

Accepted Answer

Update Directory profile editing settings. Directory profile settings allow admins to restrict which profile details users can modify.

Answer

Disable the Gmail service

Answer

Create a custom role

Answer

Delete the user's photo

Question 7

You are seeing a 'Domain already in use' error when adding a domain. What is the most likely cause?

Accepted Answer

The domain is already verified in another Google Workspace account. The 'Domain already in use' error in Google Workspace means the domain is already verified and claimed by another Google Workspace account (or a consumer Google account). Google enforces one owner per domain, so you must either remove the domain from the other account or use a different domain. This is a verification/ownership conflict, not a DNS or quota issue.

Answer

The domain is a sub-domain

Answer

DNS is not propagated

Answer

You reached the domain limit

Question 8

Your organization uses Google Workspace and has a fleet of Windows 10 laptops managed by a third-party UEM tool. You need to enforce Context-Aware Access so that users can access Workspace apps only from devices that meet your security policies. What should you deploy on each Windows device to enable device-based access levels?

Accepted Answer

Deploy the Endpoint Verification extension to Google Chrome on each device. Context-Aware Access relies on device attributes to make access decisions. For Windows, macOS, and Linux, the Endpoint Verification extension is required to gather those attributes. It reports on disk encryption, OS version, and other security settings, which are then used in access levels. Without it, device-based access levels cannot be enforced.

Answer

Enroll the devices in Advanced mobile management

Answer

Configure a Chrome user policy to force sign-in and enable sync

Answer

Install the Google Credential Provider for Windows (GCPW)

Question 9

Which TWO of the following are true regarding the Directory API?

Accepted Answer

It requires OAuth 2.0 for authentication. Option A is correct because the Directory API is a Google Workspace (formerly G Suite) Admin SDK API that requires OAuth 2.0 authorization with appropriate scopes (such as https://www.googleapis.com/auth/admin.directory.user or .group) to authenticate and authorize requests. Option D is correct because the Directory API provides resources for managing groups, including creating, updating, deleting, and listing groups and their members via endpoints like /admin/directory/v1/groups and /admin/directory/v1/groups/{groupKey}/members. Option B is incorrect because the Directory API does support bulk operations, such as batch requests and the members.insert/delete endpoints for managing multiple memberships. Option C is incorrect because access to the Directory API depends on the Google Workspace edition and admin privileges, not being universally free with all licenses. Option E is incorrect because access is governed by delegated admin roles and OAuth scopes, not restricted solely to Super Admins.

Answer

It does not support bulk operations

Answer

It is free to use with all licenses

Answer

It is only available to Super Admins

Question 10

Your organization uses Google Workspace and has a fleet of company-owned Windows 10 laptops. You want to ensure that only devices that are company-owned and meet specific security requirements (like disk encryption and screen lock) can access Gmail and Drive. You have already enrolled devices in Windows device management. Which additional step is required to enforce these device-based access policies?

Accepted Answer

Deploy the Endpoint Verification extension to Chrome on each device.. To enforce access based on device security attributes, you must deploy Endpoint Verification. It collects signals such as disk encryption, screen lock, and ownership from Windows, macOS, and Linux devices. These signals are then used by Context-Aware Access to allow or block access to Google Workspace apps. Enabling Context-Aware Access without Endpoint Verification leaves no device data to evaluate, so policies cannot function as intended.

Answer

Configure a device policy in the Admin console under Mobile & endpoints.

Answer

Enable Context-Aware Access for the organizational unit.

Answer

Set up single sign-on (SSO) with a third-party identity provider.

Question 11

You need to enforce 2-Step Verification for a specific department while allowing others to opt-in voluntarily. Which configuration path should you use?

Accepted Answer

Move the department users into a dedicated Organizational Unit and enable 'Enforce' in the 2-Step Verification settings.. To enforce 2SV for specific users, you must use Organizational Units (OUs) or Groups and manage the enforcement settings under Security > Authentication > 2-step verification.

Answer

Apply the enforcement policy at the root Organizational Unit level.

Answer

Use the Google Cloud Identity platform to create a conditional access policy for individual users.

Answer

Set the 'Allowed to opt-in' setting to 'Off' for the entire domain.

Question 12

Your company uses Google Workspace and has a Google Cloud Directory Sync (GCDS) deployment to synchronize users from an on-premises Active Directory. A new HR policy requires that when an employee is terminated, their account must be suspended immediately and not deleted, but their mailbox data must be preserved for eDiscovery. You need to configure GCDS so that terminated employees are suspended rather than deleted. What should you do?

Accepted Answer

In GCDS, under User Accounts, set the 'Suspend' option for users who are no longer in the LDAP search rule, and ensure the 'Delete' option is not selected.. GCDS provides explicit options for handling users removed from the LDAP source: you can choose to suspend or delete them. To meet the policy, configure GCDS to suspend removed users and ensure deletion is not enabled. This preserves mailbox data and allows for eDiscovery while immediately disabling access.

Answer

In the Admin console, set the 'Suspension policy' for the domain to automatically suspend users after 30 days of inactivity, and let GCDS delete them.

Answer

In GCDS, configure the 'User Accounts' rule to move terminated users to a 'Suspended' organizational unit, and then apply a Google Vault retention rule to that OU.

Answer

In GCDS, enable 'Deletion prevention' and set a retention period of 30 days, after which users are automatically suspended.

Question 13

Your organization uses Google Workspace and has a mix of full-time employees and temporary contractors. You need to ensure that contractors cannot access Google Drive from unmanaged mobile devices, while employees can. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Create a separate organizational unit for contractors and apply a device policy that requires mobile devices to be managed.. To prevent contractors from accessing Google Drive on unmanaged mobile devices while allowing employees, you should create a separate organizational unit for contractors and apply a device policy requiring managed devices. Additionally, enabling Context-Aware Access with a policy that requires company-owned or managed devices adds an extra layer of enforcement. Together, these configurations ensure that only compliant devices can access Drive for the contractor OU.

Answer

Set up a Google Group for contractors and restrict Drive sharing to only members of that group.

Answer

Disable Google Drive for the contractors' organizational unit entirely.

Answer

Enforce 2-Step Verification for all contractors and require security keys.

Question 14

A Google Workspace administrator receives reports that users in the sales department cannot access a shared drive named 'Sales Proposals'. The shared drive still appears in their Google Drive interface, but when they try to open it, they get a 'You need permission' error. The admin confirms the shared drive exists and that the sales team is a member of a Google Group that was previously added as a member of the shared drive. What is the most likely cause?

Accepted Answer

The shared drive's membership was changed so that the Google Group no longer has access.. Shared drive access is controlled by membership and access levels. When a Google Group that was a member loses its access or is removed, all group members lose access, producing a permission error. The admin should check the shared drive's membership list and restore the group's access level.

Answer

The sales team's Google Group has a posting restriction that blocks access to shared drives.

Answer

The shared drive is set to 'Restricted' and the sales team is outside the organization.

Answer

The shared drive's content is owned by a user whose account was suspended.

Question 15

Which THREE of the following attributes can be used in Context-Aware Access policies?

Accepted Answer

OS version. Context-Aware Access policies in Google Workspace evaluate device and user context signals, and OS version (A) is a supported attribute used to allow or block access based on the operating system and its version (e.g., requiring a minimum macOS or Windows build). Device encryption status (B) is also a valid attribute, letting admins require that a device's storage be encrypted before granting access to Workspace apps. Device management status (E) is supported as well, distinguishing Basic, Advanced, and Managed device states so policies can restrict access to managed devices only. The user's favorite browser (C) is not a security-relevant context attribute and is not configurable in Context-Aware Access, and the user's physical GPS location (D) is not an available attribute — geographic restrictions rely on IP address ranges rather than GPS coordinates.

Answer

User's favorite browser

Answer

User's physical GPS location