GWS-ADMIN Practice Test 19 — 15 Questions

Question 1

You are deploying Endpoint Verification for your organization. You need to ensure that only devices with a valid endpoint verification certificate can access Google Workspace apps. You have already enforced the Endpoint Verification extension. What additional step is required to enforce device trust based on the certificate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Context-Aware Access with an access level that requires the device to be 'verified'.. Endpoint Verification provides device attributes, but enforcement requires Context-Aware Access. By creating an access level that requires the device to be verified and assigning it to apps, you ensure only devices with a valid endpoint verification certificate can access Workspace apps. Other settings do not enforce certificate-based trust for Endpoint Verification.

Answer

Enable 'Device trust' in Admin console > Security > Authentication > SSO.

Answer

Configure a device policy in Admin console > Devices > Mobile & endpoints > Endpoint Verification.

Answer

Set 'Require device approval' in Admin console > Devices > Mobile & endpoints > Devices.

Question 2

You are setting up Context-Aware Access. You want to deny access to Google Workspace if the device is not encrypted. Which tool identifies the 'is_encrypted' attribute?

Accepted Answer

Endpoint Verification extension. Endpoint Verification reports device attributes like encryption status back to Google, which Context-Aware Access then uses to evaluate policies.

Answer

Device policy controller

Answer

Admin console audit logs

Answer

Google Cloud Identity sync

Question 3

You are a Workspace administrator. Your organization provides company-owned Windows 10 laptops to employees. You want to ensure that only these corporate laptops, which are already enrolled in Windows device management, can access Google Workspace services. You also need to block access from personal Windows devices. Which action should you take?

Accepted Answer

Configure a Context-Aware Access access level that requires the device to be company-owned and enrolled in Windows device management, then apply it to the Google Workspace apps.. Context-Aware Access allows administrators to create access levels that evaluate device attributes, such as ownership and management status. By requiring company-owned and enrolled devices, you ensure that only corporate Windows laptops can access Workspace apps. This is the only option that directly enforces device-based access control tailored to the organization's requirement.

Answer

Set up a device policy in the Admin console that requires Windows devices to be encrypted and have a screen lock, which will block personal devices.

Answer

Use Google Endpoint Verification to collect device signals, and then manually approve each device in the Admin console.

Answer

Enforce 2-Step Verification for all users, which will automatically restrict access to company-owned devices.

Question 4

You need to deploy a specific Android application to a subset of users. What is the correct procedure?

Accepted Answer

Use the 'Apps' section in the Admin console to select the app from Managed Google Play and assign it to an OU. The correct procedure is to use the 'Apps' section in the Admin console to select the app from Managed Google Play and assign it to an OU. This allows administrators to deploy specific Android applications to a subset of users by targeting organizational units (OUs), ensuring controlled distribution and policy enforcement.

Answer

Instruct users to download it themselves from the Play Store

Answer

Upload the APK file to the server and email the link to users

Answer

Use a third-party MDM integration

Question 5

Your organization needs to comply with a regulation that requires all Google Drive files to be classified and labeled based on their sensitivity. You want to automate the labeling process for files containing personally identifiable information (PII). Which two Google Workspace features should you use together to achieve this? (Choose two.)

Accepted Answer

Drive labels with a classification field. To automatically classify and label Drive files based on PII content, you need a DLP rule that scans for PII and applies a Drive label. The label provides the classification metadata. Together, these features automate the process. The other options are for retention, investigation, or alerting, which do not fulfill the labeling requirement.

Answer

Security investigation tool for Drive

Answer

Alert center rule for Drive sharing

Answer

Google Vault retention rule for Drive

Question 6

A user reports that they are not receiving emails from an external vendor. As an administrator, where should you first look to verify if the messages reached Google's servers?

Accepted Answer

Email Log Search. Email Log Search is the primary Gmail admin tool for tracing message delivery. It lets an administrator search by sender, recipient, subject, or message ID and see whether the message was accepted by Google's SMTP servers, delivered to the user's mailbox, or rejected/quarantined. This directly answers the question of whether the vendor's mail reached Google at all.

Answer

Security Dashboard

Answer

Reports > User usage

Answer

Gmail > Compliance settings

Question 7

Your organization uses Google Workspace and must comply with a new regulation requiring that all newly created Drive files for the Finance department are stored only in the United States. You have already created a Data Region policy for the US and applied it to the Finance organizational unit. However, you notice that some files created by Finance users are still being stored in the global region. What is the most likely reason for this behavior?

Accepted Answer

The users are creating files in a shared drive that is not covered by the Data Region policy.. Data Region policies apply to user data in My Drive and Gmail, but shared drives require separate configuration. When a policy is applied to an OU, it does not automatically extend to shared drives owned by that OU. Therefore, files created in a shared drive may still be stored in the global region. To ensure compliance, the shared drive must be added to the Data Region policy.

Answer

The Data Region policy must be applied to the user accounts, not the organizational unit.

Answer

The Data Region policy only applies to data created after the policy is applied, but existing files remain in their original region.

Answer

The users have not been assigned a Google Workspace license that supports Data Regions.

Question 8

A Workspace administrator at a financial services firm configures a new SMTP relay service in the Admin console to allow an on-premises application to send notifications through Google Workspace. After configuration, the application's messages are being rejected with an authentication error. The administrator confirms the application is sending to smtp-relay.gmail.com on port 587 and that the sending server's IP address is included in the allowed list. Which additional requirement must be met for the SMTP relay service to accept the messages?

Accepted Answer

The sending server must present valid SMTP credentials for a Workspace user, or the relay must be configured to allow unauthenticated mail from the listed IP addresses.. The SMTP relay service validates senders using the allowed IP list and, depending on configuration, SMTP authentication. If the relay is not set to allow unauthenticated mail from the listed IPs, the sending application must supply valid Workspace credentials. The authentication error indicates one of these conditions is not satisfied, so the administrator must either enable unauthenticated sending for those IPs or configure credentials on the application.

Answer

The sending server must be added to the domain's SPF record as an authorized sender for the domain.

Answer

The sending server must use a TLS certificate issued by a public certificate authority that Google recognizes.

Answer

The sending server must authenticate using OAuth 2.0 with a service account that has domain-wide delegation enabled.

Question 9

A user in your organization reports that they cannot access their Google Drive files from their mobile device. They can access Drive from their laptop without issue. You suspect a device-based access policy is blocking mobile access. Where in the Google Admin console should you check?

Accepted Answer

Security > Access and data control > Context-Aware Access. Context-Aware Access in the Admin console allows administrators to define granular access levels based on device and user context, such as device encryption status, screen lock, or whether the device is managed. If a user can access Drive from a laptop but not a mobile device, it suggests a context-aware access level is applied to Drive that requires certain device conditions not met by the mobile device. Checking this section is the correct troubleshooting step.

Answer

Devices > Mobile & endpoints > Android settings

Answer

Directory > Users > [user] > Security

Answer

Apps > Google Workspace > Drive and Docs > Sharing settings

Question 10

A user reports that their company-owned Android device is not receiving the latest security policies you configured in the Admin console. You have verified that the device is enrolled in Advanced mobile management. What should you check first to ensure policies are applied?

Accepted Answer

Ensure the device has an active internet connection and is syncing with Google's servers. Policy updates are delivered over the internet. If the device is offline or not syncing, it will not receive new policies. This is the most fundamental requirement, so it should be verified before checking licenses, OS versions, or device states.

Answer

Confirm that the device is not in a lost mode or suspended state

Answer

Verify that the user has the correct Google Workspace license assigned

Answer

Check if the device is running the latest version of Android

Question 11

Your organization uses Google Workspace and has a fleet of company-owned ChromeOS devices. You want to ensure that these devices automatically install a set of essential web apps and extensions for all users. You also need to prevent users from uninstalling these apps. Which configuration should you implement?

Accepted Answer

In the Admin console, go to Devices > Chrome > Apps & extensions > Users & browsers, and set the apps and extensions to 'Force-install' for the organizational unit.. Force-installing apps and extensions through the Admin console's Chrome management settings ensures they are automatically installed on enrolled ChromeOS devices and cannot be removed by users. This directly meets the need to deploy essential apps and lock them down. Other options either do not enforce installation or are irrelevant to ChromeOS app management.

Answer

Use Google Play for Education to push the apps to the devices, which will automatically install and lock them.

Answer

Configure a user policy that allows users to install apps from the Chrome Web Store, and then instruct users to install the apps manually.

Answer

Enroll the devices in zero-touch enrollment, which will automatically install the required apps and extensions.

Question 12

A user in your organization reports that when they try to open a Google Docs file shared by a colleague, they see a message stating they need to request access. The colleague confirms the file is shared with the entire organization as Editor. What should you check first to resolve this?

Accepted Answer

Ensure the user is signed in with the correct Google Workspace account.. The error suggests a permission mismatch, often because the user is signed in with a different account than the one the file is shared with. Since the file is shared with the entire organization, the user must be using their Workspace account. Verifying the signed-in account is the first and simplest check. Other options like license or sharing settings are less likely given the specific error.

Answer

Verify the user's Google Workspace license includes Google Drive.

Answer

Check if the user is a member of a group that is excluded from the sharing policy.

Answer

Confirm the file's sharing settings allow viewers and commenters to download, print, and copy.

Question 13

Your organization has a Google Workspace Enterprise Plus subscription and uses Google Vault. An external auditor requests a report of all users who have accessed a specific sensitive document stored in a shared drive over the past 90 days. What should you do to provide this information?

Accepted Answer

Use the security investigation tool to search Drive logs for the document ID and filter by users who viewed it in the last 90 days.. The security investigation tool is designed for deep investigations into user activity and provides granular filtering of Drive audit logs. Searching by document ID and filtering by view events over a 90-day period yields the required access report. Vault, Admin Console reports, and activity dashboards do not provide the same level of detail or are not suited for this purpose.

Answer

Generate a Drive audit log report from the Admin Console and filter by the document name.

Answer

Ask the shared drive manager to review the document's activity dashboard.

Answer

Run a Vault search for the document name in the shared drive and export the results.

Question 14

An administrator at a retail company notices that a user's Google Drive files are suddenly inaccessible to colleagues who previously had access. The administrator checks the file's sharing settings and sees that the sharing permissions still list the colleagues. The administrator also confirms the colleagues can access other files in the same shared drive. Which action should the administrator take first to troubleshoot the issue?

Accepted Answer

Verify whether the affected user's account has been suspended or had its Drive service turned off, which would prevent others from accessing files owned by that user.. Files in Google Drive are governed by the owner's account state as well as by sharing permissions. If the owner's account is suspended or the owner's Drive service is disabled, others may lose access even though permissions remain listed. Because the colleagues can still reach other files in the same shared drive, the issue is isolated to one owner, making the owner's account and service status the most direct thing to verify.

Answer

Check whether the affected user's account has been moved to an organizational unit with a Drive sharing policy that restricts external sharing.

Answer

Confirm that the colleagues have the Drive File Stream client installed and that it is up to date on their computers.

Answer

Review the audit log for external sharing events to see if the files were transferred to another owner outside the organization.

Question 15

A Google Workspace administrator receives a report from a user who cannot access Google Drive. The user sees a 'Service not enabled for this account' error when attempting to open Drive. The administrator confirms that the user is in an organizational unit (OU) where Google Drive is turned ON. What should the administrator check NEXT to resolve this issue?

Accepted Answer

Verify that the user has a Google Workspace license that includes Drive.. The error 'Service not enabled for this account' typically means the user lacks a license that includes Google Drive. Even if Drive is enabled for the OU, the user must have an appropriate license. The administrator should check the user's assigned licenses in the Admin console under Directory > Users. If the user has no license or a license without Drive, assigning a correct license will resolve the issue.

Answer

Check if the user has exceeded their Drive storage quota.

Answer

Confirm that the user is not a member of a group that has Drive disabled.

Answer

Check the user's Chrome browser settings to ensure cookies are enabled.