GWS-ADMIN Practice Test 20 — 15 Questions

Question 1

You are configuring Chrome policies for your organization's managed Chrome browser on Windows devices. You want to control which extensions users can install. Which two policies should you configure? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ExtensionInstallAllowlist. The ExtensionInstallAllowlist and ExtensionInstallBlocklist policies are designed to control which extensions users can install. The allowlist restricts installations to only approved extensions, while the blocklist explicitly prevents specific extensions. Used together, they enforce a strict extension policy. Other policies like force list or ExtensionSettings serve different purposes, such as mandatory installations or advanced per-extension configurations, and do not directly fulfill the need for user-installation control.

Answer

ExtensionInstallForcelist

Answer

ChromeWebStoreEnabled

Answer

ExtensionSettings

Question 2

You are the Workspace administrator for a company that has a mix of full-time employees and temporary contractors. Contractors are placed in a 'Contractors' organizational unit and must not have access to Google Chat or Google Meet. You need to configure the 'Contractors' OU to disable these services while keeping all other services enabled. Which TWO of the following steps should you perform? (Choose two.)

Accepted Answer

In the Admin console, go to Apps > Google Workspace > Google Meet and set the service status to 'OFF' for the 'Contractors' organizational unit.. To disable specific services for an organizational unit, you turn off the service in the Apps section for that OU. Setting Google Chat and Google Meet to OFF for the Contractors OU achieves the requirement while preserving all other services for those users and not affecting other OUs. Per-user checkboxes and API controls do not govern core service availability.

Answer

In the Admin console, go to Account > Account settings > Legal and compliance and enable 'Restrict services for contractors'.

Answer

In the Admin console, go to Directory > Users > Contractors OU and uncheck the 'Chat and Meet' checkbox for each user.

Answer

In the Admin console, go to Security > Access and data control > API controls and block the Chat and Meet APIs for the Contractors OU.

Question 3

Your organization has a Data Region policy that restricts data at rest for Google Drive to the European Union. A user based in the EU travels to the United States and accesses Drive from there. The compliance team wants to ensure that the user's existing Drive data remains stored in the EU and that new files created during the trip are also stored in the EU. What should you do?

Accepted Answer

Do nothing; the Data Region policy automatically keeps all data for that user in the EU regardless of the user's physical location.. Data Region policies determine the geographic location where data at rest is stored, based on the user's assigned region, not their physical location. A user assigned to the EU region will have their Drive data stored in the EU even when accessing from the US. No migration or access restriction is required to maintain compliance.

Answer

Create a new Data Region policy for the US and assign the traveling user to it, then trigger a migration of their data back to the EU when they return.

Answer

Enable Context-Aware Access for the user to restrict access to Drive from only EU IP addresses, ensuring data never leaves the region.

Answer

Use the Data Regions migration tool to move the user's data to the EU after they return, and instruct them not to create new files while in the US.

Question 4

You need to grant a user permission to manage only the 'Marketing' OU. Which administrative role do you assign?

Accepted Answer

Custom Admin role with OU scope. Custom Admin roles allow granular control over OU access.

Answer

User Management Admin

Answer

Super Admin

Answer

Group Admin

Question 5

A manager needs to know which users in the sales organizational unit have not signed in to their Google Workspace account in the past 30 days. The manager does not have admin access. What should the administrator do to provide this information?

Accepted Answer

Generate a user accounts report in the Admin console and filter by last login date for the sales organizational unit.. The user accounts report in the Admin console includes last login information and can be filtered by organizational unit. An administrator can use it to identify sales users who have not signed in within the past 30 days and share that information with the manager. Vault and Drive audit logs serve different purposes and do not provide the needed last login overview.

Answer

Ask the manager to review each user's Gmail last login from their profile page.

Answer

Check the Google Drive audit log for file access by sales users.

Answer

Use the Google Vault audit log to search for user sign-in events.

Question 6

A company wants to prevent data exfiltration by ensuring that users can only access Google Drive from managed devices, but must allow contractors using personal devices to access Gmail. Which approach should the administrator take?

Accepted Answer

Apply a Context-Aware Access access level requiring managed devices to Drive for the main organizational unit, and place contractors in an OU without that access level while leaving Gmail enabled.. Context-Aware Access access levels are assigned per app and per organizational unit, allowing a managed-device requirement to be applied to Drive for the main OU while contractors in a separate OU remain unrestricted for Gmail. This layered assignment satisfies the exfiltration prevention and contractor access goals simultaneously.

Answer

Turn off Drive for the entire domain and enable it only for users who request access.

Answer

Create a device policy in the Admin console that blocks personal devices from syncing any Google Workspace data.

Answer

Enforce 2-Step Verification for all users and require security keys for Drive access.

Question 7

A user is receiving 'Account temporarily unavailable' messages. What is the primary thing to check?

Accepted Answer

The user's account status in the Admin console.. This error often occurs when an account has exceeded bandwidth limits or is undergoing a security review.

Answer

The user's browser version.

Answer

The user's internet connection.

Answer

The domain's MX records.

Question 8

An administrator needs to review recent security alerts and proactive recommendations for improving domain security. Where should they look first in the Google Admin console?

Accepted Answer

Security > Security Center > Dashboard. The Security Center Dashboard in the Google Admin console is the single pane of glass that surfaces current security alerts, a security health score, and proactive recommendations (e.g., enabling 2SV, configuring SPF/DKIM/DMARC, restricting external sharing). It is the intended first stop for reviewing both alerts and hardening recommendations.

Answer

Directory > Users > Security status

Answer

Reporting > Audit logs > Security overview

Answer

Apps > Google Workspace > Security Center

Question 9

An administrator must allow a partner organization to access a shared Drive folder, but only when the partner users sign in from their own managed devices. The partner has its own Google Workspace domain. Which configuration should the administrator use to enforce this requirement?

Accepted Answer

Share the folder with the partner domain and require the partner to enforce device-based access in their own Workspace domain.. Context-Aware Access and device policies are enforced by the domain that authenticates the user. Since the partner users sign in through their own Workspace domain, only the partner's administrators can apply a managed-device requirement to their sessions. Your organization can share the folder with the partner domain, but the device enforcement must come from the partner's side.

Answer

Enable Drive trust rules to block downloads for external users accessing the folder.

Answer

Share the folder with the partner domain and enable a Context-Aware Access level requiring managed devices for the partner's org unit.

Answer

Create a Google Group containing partner users and apply a Drive sharing restriction to that group.

Question 10

Which TWO of the following are common reasons for a user sync failure in GCDS?

Accepted Answer

Incorrect LDAP query. Option C (Incorrect LDAP query) is correct because GCDS relies on the LDAP search base, scope, and filter configured in the sync settings to enumerate directory objects; a malformed or overly restrictive query returns no users or the wrong set, causing the sync to fail or produce incomplete results. Option E (Invalid OU mapping) is correct because GCDS maps source directory OUs to target Google Workspace OUs, and if a mapped OU does not exist or the mapping is misconfigured, the sync job errors out when it cannot place users in the specified destination. Option A (Expired Google license) is not a typical GCDS sync failure cause, since licensing affects user service access rather than the directory sync process itself. Option B (Incorrect password for the Google Admin) is not the standard failure mode because GCDS authenticates to Google using an OAuth 2.0 service account and JSON key, not an admin password. Option D (Browser compatibility issues) is irrelevant because GCDS is a standalone Windows application that runs as a service or config tool, not a browser-based interface.

Answer

Expired Google license

Answer

Incorrect password for the Google Admin

Answer

Browser compatibility issues

Question 11

A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?

Accepted Answer

The Admin console audit log for mobile management. The device audit log provides the necessary visibility into whether a command was successfully executed by the server and acknowledged by the device.

Answer

The Google Cloud Platform logs

Answer

The user's account status in the directory

Answer

The user's Gmail sent items

Question 12

When managing ChromeOS devices, which TWO settings can be configured within the 'Device settings' section of the Admin console?

Accepted Answer

Auto-update settings. Option C (Auto-update settings) is correct because the Admin console's Device settings section includes an 'Auto-update settings' area where admins can control the ChromeOS release channel (stable/beta/dev/LTS), pin a specific ChromeOS version, and set auto-update behavior for enrolled devices. Option D (Sign-in restrictions) is correct because Device settings provides sign-in controls such as restricting sign-in to specific domains, allowing or blocking guest mode, and controlling which users can sign in to the device. Option A (User password rotation) is not a ChromeOS Device settings control; password policies are handled through Google Workspace user/security settings, not device-level configuration. Option B (Browser history retention) is not configured in Device settings; history retention is a user-level Chrome/Google Workspace setting rather than a device policy. Option E (Default home page for all users) is not part of Device settings; homepage/startup configuration is applied via user-level Chrome policies or managed browser settings, not the device settings section.

Answer

User password rotation

Answer

Browser history retention

Answer

Default home page for all users

Question 13

A user complains that they cannot access their work email. You see the device is marked as 'Blocked' in the Admin console. What should you do?

Accepted Answer

Approve the device in the mobile management list. If a device is blocked, changing the status to 'Approved' or 'Unblocked' will restore access.

Answer

Send a 'Sync' command

Answer

Factory reset the device

Answer

Delete the device record

Question 14

You notice that a user's account is generating a large amount of spam. What is the immediate action you should take?

Accepted Answer

Reset the user's password and sign out of all sessions.. Resetting the user's password and forcing a logout of all sessions is the fastest way to stop an account that has been compromised.

Answer

Rename the user account.

Answer

Delete the account.

Answer

Send a warning email to the user.

Question 15

A user in your organization reports that they accidentally deleted a Google Calendar event that contained important meeting notes and attachments. The event was deleted from a secondary calendar they own. Where can the user recover the deleted event?

Accepted Answer

From the calendar's trash, accessible via Calendar settings for that specific calendar. Deleted events in Google Calendar are moved to a per-calendar trash, and users can restore them from the settings of the specific calendar where the event lived. Because the event was on a secondary calendar the user owns, the correct action is to open that calendar's settings and use its trash to restore the event. Admin tools and Vault serve different purposes and do not restore events to a user's calendar.

Answer

From the Google Drive trash, because calendar attachments are stored in Drive

Answer

From the Admin console's Calendar recovery tool

Answer

By asking a super administrator to restore the event from Google Vault