GWS-ADMIN Practice Exam 2 — 20 Questions

Question 1

A Workspace administrator uses the Email Log Search tool in the Admin console to investigate a message that a user says never arrived. The search returns a single entry with the delivery status 'Rejected' and the SMTP response code '550 5.7.1'. The recipient's mailbox exists and is active. What is the most likely reason the message was rejected?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A content or attachment policy blocked the message because it matched a quarantine or compliance rule.. A 550 5.7.1 response is the SMTP enhanced status for a message rejected by policy, permission, or security filtering rather than by address or storage. Because the mailbox exists and is active, the rejection must originate from a Workspace rule such as a content compliance, attachment compliance, blocked sender, or DLP policy. Email Log Search is the correct tool to confirm this, and the logs point directly at a policy block.

Answer

The recipient address does not exist in the Workspace directory, so the message was refused.

Answer

The recipient's mailbox storage quota was exceeded, so the incoming message was bounced.

Answer

The sending domain failed SPF authentication, so the receiving server rejected the message as spoofed.

Question 2

A user reports that their company-owned Android device has been lost. You need to remotely wipe all data from the device, including personal data. Which action should you take in the Admin console?

Accepted Answer

In the Admin console, go to Devices > Mobile & endpoints > Devices, select the device, and click 'Wipe device'.. For a lost company-owned Android device, a full device wipe is necessary to erase all data. The 'Wipe device' action in the Admin console triggers a factory reset, removing both corporate and personal data. This is the most secure action to prevent unauthorized access to any data on the device.

Answer

In the Admin console, go to Devices > Mobile & endpoints > Devices, select the device, and click 'Wipe corporate data'.

Answer

In the Admin console, go to Devices > Mobile & endpoints > Devices, select the device, and click 'Block device'.

Answer

In the Admin console, go to Devices > Mobile & endpoints > Devices, select the device, and click 'Remove device'.

Question 3

You are the Workspace administrator at a company where every employee's mailbox must be preserved for seven years after they leave. A user in the Sales organizational unit resigns, and you need to immediately block sign-in and stop new mail from being delivered to that mailbox while keeping all existing mail intact. What should you do?

Accepted Answer

Suspend the user account in the Admin console.. Suspending the account is the standard way to cut off access and inbound mail while keeping all data recoverable. Deletion destroys the mailbox, Vault rules only archive data, and password or 2SV changes do not revoke access. Suspension preserves the mailbox for later migration or Vault export while satisfying the immediate security need.

Answer

Delete the user account and then restore it from the Admin console within 20 days.

Answer

Reset the user's password and enable 2-Step Verification enforcement for the Sales OU.

Answer

Move the user into a dedicated organizational unit and apply a Google Vault retention rule to that OU.

Question 4

What happens when you delete an Organizational Unit?

Accepted Answer

The OU cannot be deleted until it is empty. Deleting an OU requires moving all users and sub-OUs out of it first.

Answer

Users inside are suspended

Answer

Users are deleted along with the OU

Answer

Users inside are automatically moved to root

Question 5

You need to ensure that Google Chat messages are retained for 5 years. How do you do this?

Accepted Answer

Create a Chat retention rule in Vault. Google Vault is the eDiscovery and retention tool for Google Workspace, and it supports retention rules for Chat (as well as Gmail, Drive, and Meet). Creating a Chat retention rule in Vault with a 5-year retention period ensures messages are preserved for that duration regardless of user deletion. This is the only mechanism that enforces a defined retention period for Chat messages.

Answer

Enable chat history for all users

Answer

Export Chat logs via the API

Answer

Set a Gmail retention rule

Question 6

You need to create a custom administrator role that allows a security analyst to use the Security Center Investigation Tool, view audit logs, and manage alerts, but prevents them from modifying user passwords or organizational unit structures. Which exact set of privileges should you assign?

Accepted Answer

Select privileges from Security Center (Investigation Tool, Alerts) and Reporting (Audit logs), while leaving User Management and OU privileges unchecked.. The correct approach is to create a custom role by selecting only the necessary privileges: Security Center (Investigation Tool, Alerts) and Reporting (Audit logs), while leaving User Management and OU privileges unchecked. This grants the security analyst the required access without granting unnecessary permissions.

Answer

Grant 'Super Admin' privileges and restrict access using Context-Aware Access.

Answer

Assign the 'Helpdesk Admin' role combined with 'Security Center Reader'.

Answer

Assign the built-in 'Security Admin' role and remove user management privileges via override.

Question 7

Where can an administrator force a password reset for a single user?

Accepted Answer

Directory > Users > [User] > Reset password. You can initiate a password reset directly from the user's profile page in the Admin console.

Answer

Account > User security

Answer

Directory > Security

Answer

Security > Password management

Question 8

You are the Google Workspace administrator for a company that wants to enforce stricter controls on how users share Google Drive files. You need to configure sharing settings at the organizational unit level. Which TWO of the following actions can you perform in the Google Drive sharing settings for an organizational unit? (Choose two.)

Accepted Answer

Prevent users from granting access to files to users outside the organization.. The Drive sharing settings for an organizational unit allow administrators to set the default visibility for new files and to restrict sharing outside the organization. These controls directly shape how users can share files and help enforce stricter governance. The other options describe capabilities that are not part of the native sharing settings, such as forcing files into a shared drive, setting upload size limits, or requiring admin approval for external shares.

Answer

Force all files to be stored in a specific shared drive regardless of where the user creates them.

Answer

Set a maximum file size limit for uploads to Drive for the organizational unit.

Answer

Require that all shared files be reviewed by an administrator before external sharing is allowed.

Question 9

You have a Data Region policy, but a user is still showing data in the global region. What is the most likely cause?

Accepted Answer

The user's OU is not in a region-mapped group. Data Regions in Google Workspace are enforced through organizational units (OUs) and groups mapped to specific regions. If a user is not placed in a region-mapped group or OU, their data is processed and stored in the default global region, even if a Data Region policy exists. The most likely cause is that the user's OU is not included in the region-mapped group, so the policy does not apply to them.

Answer

The account is suspended

Answer

The user hasn't logged in recently

Answer

Vault hold is preventing the move

Question 10

Your organization must ensure that any Google Drive file containing credit card numbers is automatically flagged and the file owner is alerted. You want the least administrative overhead and want the detection to leverage Google's built-in classifiers. Which Google Workspace feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) rule in Drive that uses a predefined detector for credit card numbers and sends an alert to the file owner. DLP in Google Drive is designed to automatically scan file content for sensitive data patterns, including credit card numbers, using predefined detectors. Configuring a DLP rule with the appropriate detector and an action to alert the owner satisfies the need for automatic detection and notification without custom development. Other options either require manual labeling, do not inspect content, or lack automatic alerting.

Answer

Drive labels with a custom classification and a DLP rule that uses the label as a condition

Answer

Alert center rule that monitors Drive audit logs for files shared externally

Answer

Security investigation tool query that searches Drive logs for files with 'credit card' in the name

Question 11

You are a Workspace administrator. Your organization has a fleet of company-owned Windows devices that are already enrolled in Windows device management and synced to Google Workspace. You want to prevent users from signing in to their Google Account on any Windows device that is not company-owned, without affecting Android or iOS users. What should you do?

Accepted Answer

In Admin console > Security > Access and data control > Context-Aware Access, create an access level that requires the device to be company-owned for Windows devices, then assign it to the Google Workspace apps.. Context-Aware Access is the feature that evaluates device attributes such as ownership and OS to grant or deny access to Workspace apps. By creating an access level that requires company-owned Windows devices and assigning it to the relevant apps, you restrict unmanaged Windows sign-ins while leaving Android and iOS users alone. Other settings either do not exist or do not target Windows specifically.

Answer

In Admin console > Directory > Users, disable 'Allow users to sign in from any device'.

Answer

In Admin console > Devices > Mobile & endpoints > Windows, set 'Windows device management' to 'Block unmanaged devices'.

Answer

In Admin console > Security > Authentication > SSO, require device certificates for Windows.

Question 12

What happens to a user's data when you suspend their account?

Accepted Answer

Data remains, but the user cannot log in. Suspension keeps data intact and accessible to the admin, but the user cannot log in.

Answer

License is automatically released

Answer

Data is deleted after 30 days

Answer

User can still access data via API

Question 13

A Google Workspace administrator needs to delegate the ability to manage user accounts and reset passwords to a helpdesk team, but must ensure they cannot access Gmail content or modify security settings. Which role should be assigned to the helpdesk team?

Accepted Answer

User Management Admin. The User Management Admin role is specifically designed to allow managing users and resetting passwords without granting access to Gmail content or security settings. Super Admin is too broad, while Groups Admin and Services Admin lack the necessary user management capabilities.

Answer

Groups Admin

Answer

Services Admin

Answer

Super Admin

Question 14

You have multiple domains in a single Google Workspace account. How can you provision users in a specific sub-domain?

Accepted Answer

Select the domain from the dropdown in the 'Add user' dialog. When adding a user in the Google Workspace Admin console, the 'Add user' dialog includes a dropdown menu that lists all verified domains and sub-domains in the account. Selecting the desired domain from this dropdown ensures the new user's primary email address is created under that specific domain. This is the standard, direct method for provisioning users in any domain or sub-domain without altering the primary domain or using aliases.

Answer

Rename the primary domain

Answer

Use a group alias

Answer

Create an OU for the domain

Question 15

Which THREE actions should you take to secure your Google Workspace environment against unauthorized admin access? (Choose three)

Accepted Answer

Enable 'Admin console sign-in restriction' to trusted IPs.. Option A is correct because enabling 'Admin console sign-in restriction' to trusted IPs in Google Workspace limits where administrators can authenticate to the Admin console, blocking admin sign-ins from untrusted networks and reducing the risk of credential-based unauthorized access. Option C is correct because configuring Audit and Investigation logs (e.g., the Admin audit log and login audit log) with alerts on unusual admin activity provides detection and rapid response to suspicious privileged actions, which is essential for identifying compromised or rogue admin accounts. Option D is correct because requiring Security Keys (FIDO2/WebAuthn phishing-resistant 2-step verification) for all Super Admin accounts protects the highest-privilege accounts against phishing, credential theft, and MFA fatigue attacks. Option B does not belong because forced 30-day password rotation is no longer a recommended security practice and does not specifically address unauthorized admin access. Option E does not belong because disabling non-Google Marketplace apps reduces third-party app risk but does not directly secure admin access to the Google Workspace environment.

Answer

Require a password change every 30 days for all users.

Answer

Disable all non-Google apps in the Marketplace.

Question 16

Which TWO settings in Drive sharing can help prevent data leakage?

Accepted Answer

Prevent viewers from downloading, printing, or copying. Option A is correct because the 'Viewers and commenters can see the option to download, print, and copy' setting in Google Drive sharing can be disabled, which removes the download, print, and copy controls for viewers and commenters, directly reducing the risk of data exfiltration. Option B is correct because limiting sharing to specific domains (via the 'Sharing outside of <domain>' / target audience and allowlist settings) restricts content distribution to trusted organizational domains, preventing leakage to unauthorized external parties. Option C is incorrect because allowing external sharing for all users broadens exposure and increases leakage risk rather than preventing it. Option D is incorrect because letting users set their own sharing permissions removes centralized control and can lead to overly permissive sharing. Option E is incorrect because disabling all Drive sharing is an overly broad, disruptive measure, not a targeted data-leakage prevention setting.

Answer

Allow external sharing for all users

Answer

Enable 'Allow user to set their own sharing'

Answer

Disable all Drive sharing

Question 17

Your company has a Google Workspace domain, example.com. A new subsidiary, subsidiary.com, will use Google Workspace but must remain a separate domain in the Admin console. You have added subsidiary.com as a secondary domain and verified ownership. Users at subsidiary.com need email addresses such as alice@subsidiary.com, but their accounts must be under the same Google Workspace subscription. What should you do next?

Accepted Answer

Create user accounts with a primary email address in the subsidiary.com domain.. A secondary domain lets you create new user accounts with primary addresses in that domain while keeping the existing primary domain. After verifying ownership, you simply specify the secondary domain when creating each user. This satisfies the need for alice@subsidiary.com under the same subscription without altering the primary domain or using aliases.

Answer

Create a new Google Workspace account for subsidiary.com and link it to the existing account.

Answer

Convert subsidiary.com into the account's primary domain.

Answer

Add subsidiary.com as a domain alias to example.com.

Question 18

Your company has a Google Workspace subscription. The IT team wants to ensure that all users' Chrome browsers are configured to block third-party cookies and that this setting cannot be changed by users. Which Google Workspace setting should you configure?

Accepted Answer

Chrome user policies in the Admin console under Devices > Chrome > Settings.. To enforce Chrome browser settings such as blocking third-party cookies and preventing users from changing them, you must configure Chrome user policies in the Admin console. This allows granular control over browser behavior for managed users. Other settings are unrelated to Chrome configuration.

Answer

Security settings under Security > Authentication > Google Session control.

Answer

Google Drive sharing settings under Apps > Google Workspace > Drive and Docs.

Answer

Google Meet safety settings under Apps > Google Workspace > Google Meet.

Question 19

A user reports that their Android work profile is no longer syncing corporate emails. As an administrator, which action should you perform first in the Google Admin console to investigate?

Accepted Answer

View the device details in the Device Management section of the Admin console. Checking the device status in the Admin console provides immediate insight into sync errors or compliance issues.

Answer

Force a factory reset on the user's device

Answer

Remove the user from the mobile management organizational unit

Answer

Disable the user's account in Google Workspace

Question 20

A departing employee's account must be preserved for a legal hold, but the employee should not be able to sign in. The legal team also needs to search the employee's Gmail and Drive content. Which action should the administrator take?

Accepted Answer

Suspend the account and place a Vault hold on the user.. Suspension blocks authentication while retaining the mailbox and Drive data. A Vault hold ensures the data is preserved beyond normal retention and makes it searchable for legal purposes. The combination meets both the access and preservation requirements without deleting data.

Answer

Archive the user and enable Gmail delegation for the legal team.

Answer

Suspend the account and take no further action.

Answer

Delete the account and restore the data from a backup.