GWS-ADMIN Practice Test 17 — 15 Questions

Question 1

Which TWO actions can you perform in Google Vault?

Accepted Answer

Search and export user data. Vault allows you to place holds on data to prevent deletion and perform searches across user mail and files for eDiscovery.

Answer

Configure DLP policies

Answer

Set up 2-Step Verification

Answer

Manage user passwords

Question 2

An organization uses a third-party gateway to route email. Users report that emails are being marked as spam frequently. Which DNS record should you investigate to ensure Google trusts the gateway?

Accepted Answer

SPF record. The SPF record must include the IP addresses or include mechanism for the third-party gateway to prevent spoofing flags.

Answer

DKIM record

Answer

A record

Answer

MX record

Question 3

When a user leaves the company, which status should you set their account to if you want to keep their data but stop them from logging in?

Accepted Answer

Suspend the account. Suspending a user account prevents access but keeps the account and data intact for admins to access or migrate.

Answer

Reset the 2-Step Verification

Answer

Change the password

Answer

Delete the account

Question 4

An auditor requests that you restrict administrative access to the Google Workspace Admin console to a specific set of IP addresses. What is the most effective way to implement this?

Accepted Answer

Configure 'Admin console sign-in restriction' under Security > Authentication.. The 'Admin console sign-in restriction' setting allows administrators to limit console access to trusted networks.

Answer

Create an 'Access Level' in Context-Aware Access and apply it to the Admin console app.

Answer

Disable 'Advanced Protection Program' for all users.

Answer

Apply a VPC Service Controls perimeter around the organization.

Question 5

An organization wants to integrate Google Workspace with an external SAML IdP. However, some users (such as external contractors) should continue authenticating directly against Google's native login page using their Google password and 2SV. How should the administrator configure SSO to support this mixed environment?

Accepted Answer

Assign the SAML SSO profile selectively to specific organizational units or access groups, leaving the contractor OU on 'Deactivated' SSO settings.. Google Workspace allows you to assign SSO profiles to specific organizational units or groups, allowing some users to use SAML and others to use Google login.

Answer

Use Context-Aware Access to redirect contractor sign-ins to the third-party IdP while routing employees to Google.

Answer

Set up two separate Google Workspace domains, one for contractors and one for employees.

Answer

Configure domain-wide SAML SSO and check the box to allow emergency Google passwords for all users.

Question 6

Which TWO of the following steps are useful when troubleshooting a user's inability to share a file externally?

Accepted Answer

Review Drive sharing policies in the Admin console. Checking both the OU-level sharing policies and the specific file-sharing permissions is necessary.

Answer

Change the user's primary email address

Answer

Verify the user's browser version

Answer

Reset the user's Google account

Question 7

Your organization wants to prevent users from sharing Google Drive files externally, but you need to make an exception for a specific partner domain. Where should you configure this allowed domain list?

Accepted Answer

Apps > Google Workspace > Drive and Docs > Sharing settings > Whitelisted domains. Allowed external domains for sharing are managed under Apps > Google Workspace > Drive and Docs > Sharing settings.

Answer

Security > Authentication > Trusted domains

Answer

Directory > Organizational units > External sharing policy

Answer

Security > Access and data control > Whitelisted domains

Question 8

Which report would you use to identify users who haven't logged in for more than 30 days?

Accepted Answer

Reports > User Reports > User accounts. The 'User accounts' report, found under Reports, provides the last login timestamp for each user.

Answer

Reports > Security > Login

Answer

Apps > Google Workspace > Reports

Answer

Directory > Users > Account status

Question 9

A user is unable to access a specific mobile app on their managed device. Which tool should you use to check the device policy status?

Accepted Answer

Device Management dashboard. The Device Management section within the Admin console allows you to view the compliance status of managed devices.

Answer

Directory settings

Answer

Group settings

Answer

Security Investigation Tool

Question 10

Your company requires that any user attempting to access Google Drive from an unmanaged mobile device must be blocked, while desktop browsers on unmanaged devices are permitted read-only access via Context-Aware Access. How should you structure your Access Levels and assignments?

Accepted Answer

Create two access levels (one for mobile compliant devices, one for desktop OS/browsers) and assign them conditionally using advanced CAA expressions.. Context-Aware Access requires creating separate access levels for device policy compliance and assigning them selectively to apps.

Answer

Set up Alert Center policies to automatically revoke OAuth tokens when an unmanaged mobile device accesses Drive.

Answer

Configure mobile device management (MDM) basic rules to block Drive synchronization on unmanaged iOS/Android.

Answer

Create a single access level checking for device policy compliance and assign it to Google Drive for all devices.

Question 11

Which THREE features or tools in Google Workspace can be used to monitor and investigate suspicious sign-in activity or security anomalies? (Choose three.)

Accepted Answer

Security Center > Investigation Tool. Suspicious activity can be tracked using Audit logs, the Security Center Investigation Tool, and Alert Center.

Answer

Apps > Google Workspace > Drive sharing settings

Answer

Directory > Users > Bulk update via CSV

Question 12

An administrator needs to review recent security alerts and proactive recommendations for improving domain security. Where should they look first in the Google Admin console?

Accepted Answer

Security > Security Center > Dashboard. The Security Center provides a centralized dashboard for security analytics, alerts, and recommendations.

Answer

Directory > Users > Security status

Answer

Reporting > Audit logs > Security overview

Answer

Apps > Google Workspace > Security Center

Question 13

An administrator needs to restrict access to Google Workspace apps so that users can only log in from corporate-managed Chromebooks and Windows devices enrolled in Endpoint Management, while blocking all mobile devices entirely. How should this be implemented?

Accepted Answer

Use Context-Aware Access with access levels checking for device policy compliance and specific operating systems (desktop OS only).. Context-Aware Access rules can evaluate device OS and management state to block mobile devices and permit only managed corporate devices.

Answer

Set up IAM conditions in the Google Cloud console for Google Workspace endpoints.

Answer

Apply an Advanced Protection policy for all mobile users.

Answer

Configure mobile device management settings to turn off Google sync for iOS and Android.

Question 14

Which TWO practices are recommended when configuring organizational units (OUs) for security policy enforcement in Google Workspace? (Choose two.)

Accepted Answer

Regularly audit OU membership and policy inheritance to ensure users receive appropriate security controls.. Best practices for OUs include inheriting policies from parent OUs where possible and structuring OUs logically by department or security requirement.

Answer

Assign Super Administrator privileges to the head of each organizational unit.

Answer

Override policies at every child OU level even when parent policies are identical to ensure redundancy.

Answer

Place every single user in the root organizational unit to ensure uniform policy application.

Question 15

An administrator needs to delegate the role of creating and managing Google Groups across the entire domain without giving full admin rights. Which built-in role should be assigned?

Accepted Answer

Groups Admin. The Groups Admin role specifically grants privileges to manage Google Groups.

Answer

Directory Sync Admin

Answer

Helpdesk Admin

Answer

User Management Admin