GWS-ADMIN Practice Test 2 — 10 Questions

Question 1

Which TWO of the following are valid methods to verify domain ownership in Google Workspace? (Choose two)

Accepted Answer

Adding a TXT or CNAME record to your DNS settings.. Google Workspace provides multiple methods for domain verification, including DNS records and file uploads.

Answer

Enabling SSO via a SAML metadata file.

Answer

Sending an email to the registrar's abuse alias.

Answer

Creating a new admin account with the '@gmail.com' suffix.

Question 2

Your company uses Windows 10 laptops. You want to ensure that only devices with a valid and up-to-date Endpoint Verification extension and a recent sync can access Google Drive. You have already deployed the extension. Which additional step must you take to enforce this requirement?

Accepted Answer

Create a Context-Aware Access access level that requires the device to be 'Verified' and apply it to Google Drive.. Context-Aware Access allows you to define access levels based on device attributes, including whether the device is 'Verified' by Endpoint Verification. By applying such an access level to Google Drive, you ensure that only devices with the extension installed and recently synced can access the service. This is the intended mechanism for enforcing endpoint verification on desktop devices.

Answer

Enable 'Advanced' mobile management for Windows devices in the Admin console.

Answer

Configure a device policy that blocks access to Google Drive unless the device is company-owned.

Answer

Set up a SAML SSO profile that requires device certificate authentication for Google Drive.

Question 3

When a user leaves the company, which status should you set their account to if you want to keep their data but stop them from logging in?

Accepted Answer

Suspend the account. Suspending a Google Workspace account immediately blocks sign-in while preserving all data, including Gmail, Drive, and Calendar content. The account remains in the directory and can be restored later. This matches the requirement to keep data but stop logins.

Answer

Reset the 2-Step Verification

Answer

Change the password

Answer

Delete the account

Question 4

When troubleshooting a SAML application error, which THREE of the following should you check?

Accepted Answer

SAML application metadata. Option A (SAML application metadata) is correct because the metadata XML defines the entity ID, ACS URL, and signing certificates that the IdP and SP exchange; a mismatched or stale metadata file is a common cause of SAML assertion failures. Option C (User attribute mapping) is correct because SAML assertions must carry the attributes the SP expects (for example NameID, email, or role claims), and incorrect or missing mappings cause authorization or login errors. Option E (Certificate expiration status) is correct because SAML signing and encryption certificates have validity periods, and an expired IdP or SP certificate will invalidate assertions and break the trust relationship. Option B (the user's computer operating system) is not relevant because SAML is a browser-based federation protocol independent of the client OS, and Option D (the user's physical location) is not relevant because SAML troubleshooting focuses on identity configuration, not geographic location.

Answer

The user's computer operating system

Answer

The user's physical location

Question 5

Which TWO tools in the Admin Console help you identify potentially compromised accounts?

Accepted Answer

Security dashboard. The Security dashboard (C) is correct because it surfaces security-related metrics and alerts in the Admin Console, including suspicious login activity and other indicators that can point to potentially compromised accounts. The Investigation tool (D) is correct because it lets admins run targeted searches across Gmail, Drive, and other Workspace logs (e.g., login and device events) to dig into anomalous user activity and confirm whether an account has been compromised. Vault search (A) is for eDiscovery and content retention/legal holds, not for identifying compromised accounts. Group settings (B) only manage membership and group configuration, and Data regions (E) controls where data is stored, neither of which helps detect account compromise.

Answer

Vault search

Answer

Group settings

Answer

Data regions

Question 6

You are the Workspace administrator for a retail company. The legal department needs to ensure that all email sent to and received from a specific external domain is archived for eDiscovery, even if users delete the messages. Which Google Workspace feature should you configure?

Accepted Answer

Google Vault retention rules and holds for Gmail.. Google Vault is the correct feature for archiving email for eDiscovery. It allows you to create retention rules based on specific conditions, such as messages to or from a particular external domain, and ensures those messages are preserved even if users delete them. Vault also supports holds and searches for legal investigations. Other Gmail settings like retention rules or content compliance do not provide a separate, searchable archive.

Answer

Gmail delegation settings to allow the legal team to access user mailboxes.

Answer

Content compliance rules in Gmail settings to route messages to a third-party archiving system.

Answer

Gmail retention rules in the Admin console under Apps > Google Workspace > Gmail > Compliance.

Question 7

You are migrating users from a secondary domain to the primary domain. What is the impact on their email?

Accepted Answer

The old email address becomes an alias. Changing a primary domain email requires renaming the user, which creates an alias of the old address.

Answer

The user must re-verify their identity

Answer

Data is lost

Answer

The user is automatically suspended

Question 8

Your organization has a mix of Windows, macOS, and Linux devices. You want to use Context-Aware Access to block access to Google Drive from devices that do not have disk encryption enabled. You have deployed Endpoint Verification to all devices. Which access level condition should you use?

Accepted Answer

Device encryption status is 'Encrypted'.. Context-Aware Access access levels can include a condition for disk encryption based on Endpoint Verification data. By requiring the device to be encrypted, you ensure that only devices with encryption enabled can access Drive. Other conditions like management status or screen lock do not verify encryption and would not satisfy the policy.

Answer

Device management status is 'Managed'.

Answer

Device operating system is 'Windows' or 'macOS' or 'Linux'.

Answer

Device screen lock is 'Enabled'.

Question 9

A user claims they cannot see a shared calendar. What should you check to resolve this?

Accepted Answer

Calendar sharing permissions. Calendar sharing permissions determine whether a user can view a shared calendar. If the user cannot see it, the most likely cause is that the calendar owner has not granted the user 'See all event details' or 'See only free/busy' access, or the calendar is not shared with the user's domain. Checking the sharing settings in Google Calendar (or Admin console calendar resource settings) directly addresses the visibility issue.

Answer

User's secondary email

Answer

User's password

Answer

Browser cache

Question 10

A mobile device is not syncing corporate email. Which THREE of the following should you investigate?

Accepted Answer

User account password reset. Option A (User account password reset) is correct because if the user's account password was recently reset, the cached credentials on the mobile device become stale, causing authentication failures against the mail server (e.g., Exchange ActiveSync or IMAP) and halting sync until the password is updated on the device. Option B (Mobile management settings in the Admin console) is correct because MDM/MAM policies such as ActiveSync access rules, device enrollment requirements, or conditional access settings can block or disable email synchronization for that user or device. Option C (Device compliance status) is correct because if the device falls out of compliance (e.g., missing encryption, outdated OS, no passcode, or jailbroken/rooted), conditional access policies will deny it access to corporate email until compliance is restored. Option D (The user's home network speed) is not relevant because slow bandwidth would degrade performance but would not selectively stop corporate email sync while other connectivity works. Option E (The user's browser plugin list) is not relevant because mobile email sync relies on native mail clients and MDM/ActiveSync protocols, not browser plugins.

Answer

The user's home network speed

Answer

The user's browser plugin list