GWS-ADMIN Practice Exam 1 — 20 Questions

Question 1

Your organization wants to ensure that all outgoing mail is routed through a third-party email security gateway for scanning. What is the correct configuration?

Accepted Answer

Apps > Google Workspace > Gmail > Routing. Outbound routing is configured in Apps > Google Workspace > Gmail > Routing by setting an outbound gateway.

Answer

Security > Compliance > Gateway

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Network > SMTP relay

Question 2

You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?

Accepted Answer

Security > Access and data control > API controls > Manage domain-wide delegation. For service accounts performing domain-wide delegation, scopes must be defined in the Security > Access and data control > API controls > Manage domain-wide delegation section.

Answer

Account > Security > App access

Answer

Directory > Users > Service Accounts

Answer

Apps > Google Workspace > Gmail > API

Question 3

A Google Workspace administrator notices that a user's account is repeatedly locked out after multiple failed login attempts from different IP addresses. The user insists they are not attempting to sign in. What should the administrator do first to mitigate the issue?

Accepted Answer

Check the user's recent login activity and audit logs for suspicious IPs.. Repeated lockouts from different IPs indicate a potential brute-force or credential-stuffing attack. The administrator should first review login audit logs to identify the attacking IPs and assess the threat. This informs subsequent actions, such as blocking IPs, enforcing two-step verification, or resetting passwords. Suspending the account or resetting the password without investigation may not stop the attack or could disrupt the user unnecessarily.

Answer

Enable two-step verification for the user and require it immediately.

Answer

Temporarily suspend the user's account to stop the lockouts.

Answer

Reset the user's password and enforce a password change at next login.

Question 4

A user reports that their company-owned Windows laptop is not appearing in the list of devices under Endpoint Verification. You have confirmed that the user is signed in to Chrome with their Workspace account. What is the most likely reason for this issue?

Accepted Answer

The Endpoint Verification extension is not installed or is disabled in the user's Chrome browser.. Endpoint Verification relies on the Chrome extension to collect and report device details. If the extension is not installed or is disabled, the device will not appear. Since the user is signed in to Chrome with their managed account, the next step is to verify the extension's presence and status. Other factors like sync or Windows Hello are irrelevant to this functionality.

Answer

The device is not enrolled in Windows Hello for Business.

Answer

The Admin console setting 'Endpoint Verification' is turned off for the organizational unit.

Answer

The user has not enabled Chrome Sync for their Workspace account.

Question 5

A company is preparing for a compliance audit and needs to ensure that all Google Workspace data is retained according to legal requirements. The compliance team asks you to identify which two settings can be configured to prevent users from permanently deleting data. (Choose two.)

Accepted Answer

Configure a Google Drive retention rule in Vault to retain files for a set period.. Google Vault retention rules for Gmail and Drive are the primary mechanisms to prevent permanent data deletion. They retain data according to policy, even if users delete items. Other settings like Data Regions or labels do not prevent deletion, and there is no Admin Console toggle to disable delete buttons.

Answer

Apply a data classification label to all files to prevent deletion.

Answer

Set up a Google Workspace Admin Console setting to disable the 'Delete' button for all users.

Answer

Enable 'Data Regions' for all users to store data in a specific geographic location.

Question 6

Your organization uses Chrome browser on Windows devices. You want to ensure that users cannot disable or remove the Endpoint Verification extension. What should you do?

Accepted Answer

In the Admin console, go to Devices > Chrome > Apps & extensions > Users & browsers, and set the Endpoint Verification extension to 'Force installed'.. To prevent users from disabling or removing the Endpoint Verification extension, you must force-install it via the Chrome Apps & extensions policy. This policy ensures the extension is automatically installed and cannot be removed. It is the standard method for enforcing extensions in managed Chrome browsers.

Answer

In the Admin console, go to Devices > Chrome > Settings > Users & browsers, and enable 'Endpoint Verification' under Security.

Answer

In the Admin console, go to Devices > Chrome > Settings > Device settings, and enable 'Force re-enrollment'.

Answer

In the Admin console, go to Devices > Mobile & endpoints > Settings > Universal settings, and enable 'Force Endpoint Verification'.

Question 7

A healthcare organization uses Google Workspace. A compliance officer asks you to ensure that any Gmail message containing a patient identifier is automatically quarantined for review rather than delivered. Which configuration accomplishes this with the least administrative overhead?

Accepted Answer

Configure a Gmail DLP rule with a custom pattern and set the action to quarantine.. Gmail DLP evaluates message content against detectors and can take actions such as quarantine, which places the message in a review queue. This directly addresses the need to hold messages containing patient identifiers instead of delivering them, and it requires only a single DLP rule rather than custom routing.

Answer

Create a content compliance rule that adds a header to matching messages.

Answer

Add the pattern to the blocked senders list in Gmail settings.

Answer

Use an attachment compliance rule to reject messages with matching attachments.

Question 8

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 9

A user reports that emails sent to a specific external domain are bouncing with a '550 5.7.1' error. What is the likely reason?

Accepted Answer

The domain's email authentication (SPF/DKIM/DMARC) is failing.. 550 5.7.1 errors are typically related to SPF, DKIM, or DMARC failures, indicating the recipient domain is rejecting the mail due to authentication issues.

Answer

The message size exceeds the limit.

Answer

The user's storage quota is exceeded.

Answer

The recipient's mailbox is full.

Question 10

Your organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?

Accepted Answer

Place contractors in a dedicated OU, navigate to Security > Authentication > 2-step verification, and configure the allowed methods to only include security keys.. Security key enforcement can be targeted to specific organizational units or security groups by setting the 2SV policy appropriately.

Answer

Modify the default domain-wide sign-in security policy to require security keys globally and grant exceptions via API.

Answer

Configure Context-Aware Access to block non-security key authentications for the contractors group.

Answer

Create an IAM custom role that revokes prompt-based authentication for external users.

Question 11

Which TWO of the following are valid methods to verify domain ownership in Google Workspace? (Choose two)

Accepted Answer

Adding a TXT or CNAME record to your DNS settings.. Google Workspace provides multiple methods for domain verification, including DNS records and file uploads.

Answer

Enabling SSO via a SAML metadata file.

Answer

Sending an email to the registrar's abuse alias.

Answer

Creating a new admin account with the '@gmail.com' suffix.

Question 12

Your company uses Windows 10 laptops. You want to ensure that only devices with a valid and up-to-date Endpoint Verification extension and a recent sync can access Google Drive. You have already deployed the extension. Which additional step must you take to enforce this requirement?

Accepted Answer

Create a Context-Aware Access access level that requires the device to be 'Verified' and apply it to Google Drive.. Context-Aware Access allows you to define access levels based on device attributes, including whether the device is 'Verified' by Endpoint Verification. By applying such an access level to Google Drive, you ensure that only devices with the extension installed and recently synced can access the service. This is the intended mechanism for enforcing endpoint verification on desktop devices.

Answer

Enable 'Advanced' mobile management for Windows devices in the Admin console.

Answer

Configure a device policy that blocks access to Google Drive unless the device is company-owned.

Answer

Set up a SAML SSO profile that requires device certificate authentication for Google Drive.

Question 13

When a user leaves the company, which status should you set their account to if you want to keep their data but stop them from logging in?

Accepted Answer

Suspend the account. Suspending a Google Workspace account immediately blocks sign-in while preserving all data, including Gmail, Drive, and Calendar content. The account remains in the directory and can be restored later. This matches the requirement to keep data but stop logins.

Answer

Reset the 2-Step Verification

Answer

Change the password

Answer

Delete the account

Question 14

When troubleshooting a SAML application error, which THREE of the following should you check?

Accepted Answer

SAML application metadata. Option A (SAML application metadata) is correct because the metadata XML defines the entity ID, ACS URL, and signing certificates that the IdP and SP exchange; a mismatched or stale metadata file is a common cause of SAML assertion failures. Option C (User attribute mapping) is correct because SAML assertions must carry the attributes the SP expects (for example NameID, email, or role claims), and incorrect or missing mappings cause authorization or login errors. Option E (Certificate expiration status) is correct because SAML signing and encryption certificates have validity periods, and an expired IdP or SP certificate will invalidate assertions and break the trust relationship. Option B (the user's computer operating system) is not relevant because SAML is a browser-based federation protocol independent of the client OS, and Option D (the user's physical location) is not relevant because SAML troubleshooting focuses on identity configuration, not geographic location.

Answer

The user's computer operating system

Answer

The user's physical location

Question 15

Which TWO tools in the Admin Console help you identify potentially compromised accounts?

Accepted Answer

Security dashboard. The Security dashboard (C) is correct because it surfaces security-related metrics and alerts in the Admin Console, including suspicious login activity and other indicators that can point to potentially compromised accounts. The Investigation tool (D) is correct because it lets admins run targeted searches across Gmail, Drive, and other Workspace logs (e.g., login and device events) to dig into anomalous user activity and confirm whether an account has been compromised. Vault search (A) is for eDiscovery and content retention/legal holds, not for identifying compromised accounts. Group settings (B) only manage membership and group configuration, and Data regions (E) controls where data is stored, neither of which helps detect account compromise.

Answer

Vault search

Answer

Group settings

Answer

Data regions

Question 16

You are the Workspace administrator for a retail company. The legal department needs to ensure that all email sent to and received from a specific external domain is archived for eDiscovery, even if users delete the messages. Which Google Workspace feature should you configure?

Accepted Answer

Google Vault retention rules and holds for Gmail.. Google Vault is the correct feature for archiving email for eDiscovery. It allows you to create retention rules based on specific conditions, such as messages to or from a particular external domain, and ensures those messages are preserved even if users delete them. Vault also supports holds and searches for legal investigations. Other Gmail settings like retention rules or content compliance do not provide a separate, searchable archive.

Answer

Gmail delegation settings to allow the legal team to access user mailboxes.

Answer

Content compliance rules in Gmail settings to route messages to a third-party archiving system.

Answer

Gmail retention rules in the Admin console under Apps > Google Workspace > Gmail > Compliance.

Question 17

You are migrating users from a secondary domain to the primary domain. What is the impact on their email?

Accepted Answer

The old email address becomes an alias. Changing a primary domain email requires renaming the user, which creates an alias of the old address.

Answer

The user must re-verify their identity

Answer

Data is lost

Answer

The user is automatically suspended

Question 18

Your organization has a mix of Windows, macOS, and Linux devices. You want to use Context-Aware Access to block access to Google Drive from devices that do not have disk encryption enabled. You have deployed Endpoint Verification to all devices. Which access level condition should you use?

Accepted Answer

Device encryption status is 'Encrypted'.. Context-Aware Access access levels can include a condition for disk encryption based on Endpoint Verification data. By requiring the device to be encrypted, you ensure that only devices with encryption enabled can access Drive. Other conditions like management status or screen lock do not verify encryption and would not satisfy the policy.

Answer

Device management status is 'Managed'.

Answer

Device operating system is 'Windows' or 'macOS' or 'Linux'.

Answer

Device screen lock is 'Enabled'.

Question 19

A user claims they cannot see a shared calendar. What should you check to resolve this?

Accepted Answer

Calendar sharing permissions. Calendar sharing permissions determine whether a user can view a shared calendar. If the user cannot see it, the most likely cause is that the calendar owner has not granted the user 'See all event details' or 'See only free/busy' access, or the calendar is not shared with the user's domain. Checking the sharing settings in Google Calendar (or Admin console calendar resource settings) directly addresses the visibility issue.

Answer

User's secondary email

Answer

User's password

Answer

Browser cache

Question 20

A mobile device is not syncing corporate email. Which THREE of the following should you investigate?

Accepted Answer

User account password reset. Option A (User account password reset) is correct because if the user's account password was recently reset, the cached credentials on the mobile device become stale, causing authentication failures against the mail server (e.g., Exchange ActiveSync or IMAP) and halting sync until the password is updated on the device. Option B (Mobile management settings in the Admin console) is correct because MDM/MAM policies such as ActiveSync access rules, device enrollment requirements, or conditional access settings can block or disable email synchronization for that user or device. Option C (Device compliance status) is correct because if the device falls out of compliance (e.g., missing encryption, outdated OS, no passcode, or jailbroken/rooted), conditional access policies will deny it access to corporate email until compliance is restored. Option D (The user's home network speed) is not relevant because slow bandwidth would degrade performance but would not selectively stop corporate email sync while other connectivity works. Option E (The user's browser plugin list) is not relevant because mobile email sync relies on native mail clients and MDM/ActiveSync protocols, not browser plugins.

Answer

The user's home network speed

Answer

The user's browser plugin list