GWS-ADMIN Practice Test 18 — 15 Questions

Question 1

Your organization uses Chrome browser policies to manage extensions. You want to allow only a specific set of extensions and block all others for all users. You have created a JSON policy file and applied it to the organizational unit. However, users report that they can still install other extensions from the Chrome Web Store. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy to block all extensions must be set in the 'ExtensionInstallBlocklist' with a wildcard '*' and the allowed extensions in 'ExtensionInstallAllowlist'.. To enforce an allowlist of extensions, you must block all extensions by setting ExtensionInstallBlocklist to '*' and then specify the allowed ones in ExtensionInstallAllowlist. This combination ensures that only listed extensions can be installed. Other policies like ExtensionAllowedTypes or ExtensionInstallForcelist do not provide a comprehensive block on unapproved extensions.

Answer

The 'ExtensionSettings' policy must be used with a wildcard to block all extensions and then override for allowed ones.

Answer

The 'ExtensionInstallForcelist' policy must include all allowed extensions and be set to force-install them, which implicitly blocks others.

Answer

The 'ExtensionAllowedTypes' policy must be configured to restrict extensions to only those from the Chrome Web Store.

Question 2

A financial services company uses Google Workspace. The security team wants to block all access to Gmail from outside the corporate network, but allow access from the office IP range 203.0.113.0/24. They also want to require a managed device for access. Which Google Workspace feature should the administrator configure to enforce these conditions?

Accepted Answer

Context-Aware Access. Context-Aware Access is designed to enforce granular access controls based on attributes like IP address and device management status. By configuring an access level with the corporate IP range and a managed device requirement, and assigning it to Gmail, the administrator ensures that only users on managed devices within the office network can access Gmail. This aligns with zero-trust principles and the specific conditions in the scenario.

Answer

Security keys

Answer

2-Step Verification enforcement

Answer

Password policy

Question 3

You want to require that all corporate-owned iOS devices are encrypted. How is this achieved?

Accepted Answer

Configure a passcode policy in the iOS device management settings. Apple devices (iOS) are encrypted by default when a passcode is set. Therefore, enforcing a passcode policy effectively enforces encryption.

Answer

Enable Advanced Mobile Management for all iOS users

Answer

Use an MDM profile to force file-level encryption

Answer

Enable the 'Require disk encryption' setting in iOS mobile settings

Question 4

A Workspace administrator needs to give the legal department the ability to search across all users' Gmail and Drive data for a specific matter, and to place holds on user accounts to preserve data. The legal team should not have the ability to change any Workspace settings or access user passwords. Which role should you assign to the legal team members?

Accepted Answer

Vault Admin. Vault Admin is the predefined role that provides access to Google Vault for eDiscovery and legal holds without granting broader administrative privileges. It aligns with the principle of least privilege for legal teams who need to search and preserve data but should not modify Workspace settings or access user passwords.

Answer

Groups Admin

Answer

Super Admin

Answer

Services Admin

Question 5

A user has left the company. You need to migrate their data to another user. Which tool should you use?

Accepted Answer

Data Migration Service. The Data Migration Service is specifically designed for moving data from one Google account to another.

Answer

Security Investigation Tool

Answer

Google Takeout

Answer

Google Vault

Question 6

You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?

Accepted Answer

Context-Aware Access access levels referencing IP subnets and device policy compliance, assigned to targeted apps.. Context-Aware Access allows you to combine IP address subnets and device-policy compliance (corporate-owned status via endpoint management) to control access.

Answer

Google Cloud IAM conditions with Context-Aware Access and Security Health Analytics

Answer

Domain-wide SAML SSO with custom attribute mapping for IP addresses

Answer

Advanced Protection Program combined with Context-Aware Access

Question 7

Which TWO of the following are valid methods to audit file access in Google Drive?

Accepted Answer

Use the Security Investigation Tool. Option C is correct because the Security Investigation Tool in the Google Admin console lets admins run targeted searches on Drive log events (e.g., by user, file, or event type such as view, download, or share) to audit file access across the organization. Option D is correct because the Drive Audit log under Reports > Audit in the Admin console records Drive activity events, including who accessed, viewed, downloaded, or shared files, providing the standard audit trail for file access. Option A is not a file-access auditing method; Google Vault is used for retention, legal holds, and eDiscovery exports, not for routine access auditing. Option B is incorrect because alerts for file deletions only notify on deletion events and do not provide a general audit of file access. Option E is incorrect because a user's 'My Drive' settings control personal sharing and storage preferences, not administrative auditing of access.

Answer

Enable Google Vault for Drive exports

Answer

Set up alerts for all file deletions

Answer

Check the user's 'My Drive' settings

Question 8

Which THREE types of data can be managed using Vault retention rules?

Accepted Answer

Gmail messages. Vault retention rules can be applied to Gmail messages (A), Google Drive files (B), and Google Chat messages (D), since these are the core Google Workspace services whose data Vault governs and for which retention policies can be set to retain or expire content. Gmail retention rules control how long messages are preserved or purged, Drive retention rules govern files in My Drive and shared drives, and Chat retention rules manage conversation history and its associated data. User device logs (C) are not a Vault-supported retention data type; device management and endpoint telemetry fall under services like the Admin console or endpoint management, not Vault retention rules. Third-party app tokens (E) are also not a Vault retention category, as Vault does not manage OAuth or access tokens issued to external applications.

Answer

User device logs

Answer

Third-party app tokens

Question 9

You want to prevent users from copying data from managed apps into personal apps on their mobile devices. Which feature should you configure?

Accepted Answer

Mobile management > Work profile data sharing settings. Data protection features within mobile management help restrict data movement between work and personal containers.

Answer

Endpoint verification data settings

Answer

Context-Aware Access policies

Answer

Chrome browser management

Question 10

Your organization is migrating from Microsoft Exchange to Google Workspace. The IT director wants to ensure that all existing calendar events, including recurring meetings and resource bookings, are transferred to Google Calendar with minimal user intervention. Which Google Workspace service should you use to accomplish this?

Accepted Answer

Google Workspace Data Migration Service. The Data Migration Service is the only Google Workspace tool specifically built to migrate calendar data from Exchange, including recurring events and resource bookings. It operates at the domain level and does not require user intervention, making it the correct choice for a bulk migration.

Answer

Google Takeout

Answer

Google Workspace Sync for Microsoft Outlook (GWSMO)

Answer

Google Calendar API

Question 11

A user needs to see their login history. Where can you find this information?

Accepted Answer

Account Activity report in the Admin Console.. The Account Activity report in the Admin Console (Security > Dashboard/Account activity, or the user's Account activity page) shows a user's login history, including successful and failed sign-ins, IP addresses, devices, and timestamps. This is the canonical place for a user or admin to review login history.

Answer

Google Analytics.

Answer

The user's Gmail inbox.

Answer

Drive Audit logs.

Question 12

An administrator needs to delegate the role of creating and managing Google Groups across the entire domain without giving full admin rights. Which built-in role should be assigned?

Accepted Answer

Groups Admin. The Groups Admin built-in role is specifically designed to grant full management of Google Groups across the domain — creating, deleting, and managing groups, memberships, and settings — without granting other admin privileges. It is a delegated admin role scoped to Groups functionality, matching the requirement exactly.

Answer

Directory Sync Admin

Answer

Helpdesk Admin

Answer

User Management Admin

Question 13

Which TWO of the following are types of domains in Google Workspace?

Accepted Answer

Secondary domain. In Google Workspace, the two recognized domain types are the Primary domain (E), which is the main domain used to create user accounts and is set during initial signup, and a Secondary domain (A), which is an additional domain added to the same Workspace account that can host its own users and is treated as a distinct domain rather than an alias. Both are officially supported domain types in the Admin console under Domains. The other options are not valid Workspace domain types: a Root domain (B) is DNS terminology, not a Workspace domain category; an External domain (C) is not a Workspace domain type; and a Verified alias (D) is not a domain type — domain aliases are a separate feature that map alternate domain names to existing users, not a type of domain itself.

Answer

Root domain

Answer

External domain

Answer

Verified alias

Question 14

You are the Workspace administrator for a financial firm. Compliance requires that every external share of a Drive file be logged with the file owner's identity, the recipient, and the timestamp, and that the log be retained for three years. Which action best satisfies this requirement?

Accepted Answer

Configure a Drive log retention rule of three years in the Admin Console so audit events are preserved.. External sharing events are recorded as Drive audit events, which include the actor, the file, the recipient, and the time. To keep them for three years, the administrator sets the Drive log retention period accordingly. DLP and Vault serve different purposes and do not replace the audit log for this retention requirement.

Answer

Create a DLP rule that alerts when files are shared externally.

Answer

Enable Drive audit logging and rely on the default retention period.

Answer

Place a Vault hold on the user's Drive to capture sharing events.

Question 15

You need to verify if an email was sent to an external address. Where can you see this in the Admin Console?

Accepted Answer

Email log search. The Email Log Search tool in the Admin Console allows administrators to trace email delivery and identify recipients.

Answer

Vault search

Answer

Compliance reports

Answer

Security center