GWS-ADMIN Practice Exam 2 — 20 Questions

Question 1

You need to create a report showing which users have been affected by a specific DLP policy violation in the last month. Where can you find this?

Accepted Answer

Security center investigation tool. The Security Center investigation tool allows for queries specifically filtered by DLP rule violations.

Answer

Admin audit logs

Answer

Reports dashboard

Answer

Vault matters

Question 2

Which setting allows you to see what files are being shared externally across your entire domain?

Accepted Answer

Security Investigation Tool. The Security Investigation Tool allows administrators to search and audit Drive file sharing activities across the organization.

Answer

Drive Audit Log

Answer

Apps > Google Workspace > Drive > Sharing audit

Answer

Report > User Reports > Drive

Question 3

You need to ensure that Google Chat messages are retained for 5 years. How do you do this?

Accepted Answer

Create a Chat retention rule in Vault. Vault supports retention rules for Google Chat, which can be configured for a specific time period.

Answer

Enable chat history for all users

Answer

Export Chat logs via the API

Answer

Set a Gmail retention rule

Question 4

You have a Data Region policy, but a user is still showing data in the global region. What is the most likely cause?

Accepted Answer

The user's OU is not in a region-mapped group. Data region policies require the user's OU to be updated to match the intended region. If the OU is not updated, the migration process does not begin.

Answer

The account is suspended

Answer

The user hasn't logged in recently

Answer

Vault hold is preventing the move

Question 5

Which TWO actions can you take when a user account is under a Vault hold?

Accepted Answer

Prevent data deletion. A hold ensures the data is not deleted, even if the user attempts to delete it or if the account is suspended/deleted.

Answer

Automatically delete old emails

Answer

Enable 2-Step Verification

Answer

Allow the user to change their password

Question 6

You need to deploy a specific Android application to a subset of users. What is the correct procedure?

Accepted Answer

Use the 'Apps' section in the Admin console to select the app from Managed Google Play and assign it to an OU. You must add the app via the Managed Google Play store and then assign it to the specific Organizational Unit (OU) or group.

Answer

Instruct users to download it themselves from the Play Store

Answer

Upload the APK file to the server and email the link to users

Answer

Use a third-party MDM integration

Question 7

An employee has left the company. You need to migrate their email and calendar data to their manager's account. Which tool should you use?

Accepted Answer

Data Migration Service. The Data Migration Service is the primary tool for migrating user data between Google Workspace accounts.

Answer

Google Cloud Storage Transfer Service

Answer

GAM (Google Apps Manager)

Answer

Vault

Question 8

You need to ensure that Chrome browsers on unmanaged devices are secure. What is a key step to take?

Accepted Answer

Use Chrome browser cloud management to enforce policies. Enforcing Chrome browser management allows you to apply policies to the browser regardless of the OS of the underlying device.

Answer

Force users to use Incognito mode

Answer

Require a VPN for all browser traffic

Answer

Disable all extensions

Question 9

Which THREE items can be managed through the 'Directory' section in the Admin Console?

Accepted Answer

User profile editing permissions. Directory manages buildings, resources, and user profiles.

Answer

Device management policies

Answer

Gmail routing rules

Question 10

An employee is suspected of leaking data. You need to search their past Gmail and Drive files for specific terms. Which tool do you use?

Accepted Answer

Vault matter search. Vault allows for full-text search across Gmail, Drive, and other services to support eDiscovery investigations.

Answer

DLP incident report

Answer

Security investigation tool

Answer

Admin audit logs

Question 11

Which TWO of the following can be restricted in Google Drive sharing settings?

Accepted Answer

Sharing with users who do not have a Google account. You can restrict sharing to external domains and prevent sharing with non-Google accounts.

Answer

The size of files shared via links

Answer

The specific users who can use the Drive app

Answer

The number of files a user can share per day

Question 12

An organization wants to configure SSO with a third-party SAML IdP. Which THREE advanced settings can be configured within the Google Workspace SAML application settings? (Choose three.)

Accepted Answer

Name ID format selection (e.g., EMAIL, PERSISTENT). Advanced SAML settings include configuring Start URL, Name ID format, and Signed requests/responses.

Answer

Direct database connection pool size for real-time user lookup

Answer

Custom SSL cipher suites for the Google Workspace login button rendering

Question 13

You have multiple domains in a single Google Workspace account. How can you provision users in a specific sub-domain?

Accepted Answer

Select the domain from the dropdown in the 'Add user' dialog. During user creation, you can select the domain from the dropdown menu of verified domains.

Answer

Rename the primary domain

Answer

Use a group alias

Answer

Create an OU for the domain

Question 14

You have enabled 'Google+ ' for your organization, but some users cannot see it. What is the most likely cause?

Accepted Answer

They are in the wrong OU. Service visibility is controlled at the OU level; ensure the service is 'ON' for that specific OU.

Answer

They need a higher license

Answer

The API is disabled

Answer

Their browser cache is full

Question 15

Which THREE of the following are aspects of the Directory API 'user' resource?

Accepted Answer

Suspension status. The user resource includes primary email, name, and suspension status as standard fields.

Answer

Device serial number

Answer

Account creation date

Question 16

Which TWO tools in the Admin Console help you identify potentially compromised accounts?

Accepted Answer

Security dashboard. The Security dashboard and the Investigation tool are the primary means of identifying suspicious activity in user accounts.

Answer

Vault search

Answer

Group settings

Answer

Data regions

Question 17

Your organization requires that all Google Meet recordings be saved to a specific shared folder. How can you automate this?

Accepted Answer

It is not possible to change the default location via Admin Console settings. Google Meet recordings are saved to the meeting organizer's 'Meet Recordings' folder in My Drive by default. You cannot redirect this to a shared folder via admin settings.

Answer

Set the 'Default storage' path in Apps > Google Workspace > Meet

Answer

Configure the 'Recording location' in Meet settings

Answer

Create a Drive retention policy for Meet

Question 18

You are configuring Endpoint Verification. What is the primary purpose of the Endpoint Verification extension on a user's browser?

Accepted Answer

To collect device information for context-aware access. Endpoint Verification collects device metadata (serial number, encryption, OS) and reports it to the Admin console for access context.

Answer

To enable remote wipe capabilities

Answer

To enforce password complexity

Answer

To block all malicious websites

Question 19

A department requires a custom building resource to be added to Google Calendar. Where do you add this?

Accepted Answer

Directory > Buildings and resources. Building resources are managed under Directory > Buildings and resources.

Answer

Apps > Google Workspace > Directory > Calendar

Answer

Apps > Google Workspace > Calendar > Resources

Answer

Organization > Settings > Resources

Question 20

Which TWO of the following are valid methods to audit file access in Google Drive?

Accepted Answer

Use the Security Investigation Tool. Audit logs and the Investigation tool are the standard ways to monitor file activity.

Answer

Enable Google Vault for Drive exports

Answer

Set up alerts for all file deletions

Answer

Check the user's 'My Drive' settings