GWS-ADMIN Practice Exam 3 — 20 Questions

Question 1

You are the Workspace administrator for a healthcare company. A compliance officer asks you to prove that Drive files containing patient data cannot be accessed by users outside your organization, even if a user accidentally shares a link publicly. You need to configure a Drive sharing setting that blocks external sharing for files matching a specific label. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a data classification label with a 'Confidential' sensitivity level and apply it to patient files, then configure the label's sharing restriction to 'No external sharing'.. Data classification labels provide a scalable way to enforce sharing restrictions based on sensitivity. By applying a 'Confidential' label to patient files and setting the label's sharing restriction to 'No external sharing', you ensure that even if a user attempts to share a link publicly, the system blocks it. This approach is granular, auditable, and aligns with compliance requirements for protecting sensitive data.

Answer

Enable Drive DLP rules to block external sharing for files containing patient data, and set the action to 'Warn' when external sharing is attempted.

Answer

Create a data classification label with a 'Public' sensitivity level and apply it to all patient files, then set the label's sharing restriction to 'No external sharing'.

Answer

In the Admin Console, go to Apps > Drive and Docs > Sharing settings, and set 'Sharing outside of your organization' to 'Off' for all users.

Question 2

A user is unable to sync their Google Drive files to their local machine using Drive for Desktop. What is the first step you should recommend?

Accepted Answer

Check the Drive for Desktop application status and error logs.. Checking the Drive for Desktop application status and logs is the standard initial troubleshooting step for local client issues.

Answer

Reset the user's password.

Answer

Reinstall the entire Google Workspace account.

Answer

Disable multi-factor authentication.

Question 3

A Google Workspace administrator wants to ensure that all users in the organization are required to use 2-Step Verification (2SV) when signing in. Where should the administrator enforce this requirement?

Accepted Answer

In the Admin console, under Security > Authentication > 2-Step Verification, set enforcement to 'On' for the entire organizational unit.. The correct location to enforce 2-Step Verification for all users is the Admin console under Security > Authentication > 2-Step Verification. Administrators can set enforcement to 'On' for organizational units, which requires users to enroll and use 2SV. This centralized approach ensures consistent application of the security policy across the domain. Other options either do not exist or are unrelated to Workspace authentication settings.

Answer

In the Google Cloud Console, under IAM, create an organization policy that enforces 2-Step Verification for all users.

Answer

In the Google Workspace Directory, edit each user's profile and enable the 'Require 2-Step Verification' checkbox.

Answer

In the Admin console, under Apps > Google Workspace > Security, set the 'Enforce 2-Step Verification' slider to 'On'.

Question 4

Your organization requires that all Google Meet recordings be saved to a specific shared folder. How can you automate this?

Accepted Answer

It is not possible to change the default location via Admin Console settings. Google Meet recordings are saved to the meeting organizer's Drive by default, and the Admin Console does not provide a setting to redirect recordings to a specific shared folder. Admins can control whether recordings are allowed and who can record, but the storage location is determined by the organizer's Drive. To centralize recordings, organizations must use Drive sharing or a third-party tool, not an Admin Console path setting.

Answer

Set the 'Default storage' path in Apps > Google Workspace > Meet

Answer

Configure the 'Recording location' in Meet settings

Answer

Create a Drive retention policy for Meet

Question 5

A Google Workspace administrator needs to allow a third-party application to access specific Google Drive files on behalf of users. The administrator wants to restrict the application so it can only access files that users explicitly share with it, and cannot access all files in the domain. Which OAuth scopes configuration should be used?

Accepted Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive.file' scope, which allows access only to files that the app creates or that the user shares with it.. The 'https://www.googleapis.com/auth/drive.file' scope is the correct choice because it limits access to files that the app creates or that the user explicitly shares with it. This matches the requirement to restrict the third-party app to only explicitly shared files. Other scopes provide broader access, either to all files or all file metadata, which would exceed the necessary permissions and violate least privilege.

Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive.readonly' scope, which allows read-only access to all files.

Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive' scope, which provides full access to all files.

Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive.metadata.readonly' scope, which allows reading metadata of all files.

Question 6

Which dashboard provides a summary of security incidents and potential policy violations?

Accepted Answer

Security center dashboard. The Security center dashboard in the Google Admin console aggregates security-related signals, including potential policy violations, suspicious login activity, and other incident summaries, giving admins a consolidated view of security posture. It is the designated place for security incident overview.

Answer

Vault dashboard

Answer

Compliance reports

Answer

User management dashboard

Question 7

Your company is subject to a regulation that requires all Google Workspace data for EU employees to remain within the European Union. You have already set a Data Region policy for the EU. A new employee in Germany reports that their Drive files show a US data region. What is the most likely explanation?

Accepted Answer

The files were created before the Data Region policy was applied or the policy does not cover the employee's organizational unit.. Data Region policies are forward-looking and scoped to organizational units. Data created before the policy, or by users outside the covered organizational unit, remains in its original region. The administrator must verify the policy scope and, if needed, migrate existing data using the supported migration process.

Answer

The employee is connecting from a non-EU IP address, which forces data to the US region.

Answer

The employee's Drive for desktop client is caching files locally in the US.

Answer

The employee's personal Drive settings override the organizational Data Region policy.

Question 8

An administrator is configuring Context-Aware Access to secure corporate data. Which TWO criteria can be evaluated within a Context-Aware Access access level expression? (Choose two.)

Accepted Answer

User's current geographic location (country/region).. Context-Aware Access access levels in Google Workspace/Cloud Identity are built from attributes about the user's identity, the request context, and the device, evaluated by Access Context Manager. Option D is correct because access levels can include geographic location conditions, such as the source IP's country/region, to allow or block access based on where the request originates. Option E is correct because device-based conditions are a core part of Context-Aware Access: access levels can require device policy compliance attributes like disk encryption, screen lock, and OS version via endpoint verification/device management. Option A is not a supported access level attribute, as Gmail inbox metrics are not part of Access Context Manager expressions. Option B is not evaluated by Context-Aware Access, since local OS password complexity and history are not exposed as access level criteria. Option C is not a supported criterion, as directory schema fields such as a manager name are not used in access level expressions.

Answer

The number of unread emails in the user's Gmail inbox.

Answer

The user's local operating system password complexity and history length.

Answer

The user's direct manager name listed in the directory schema.

Question 9

Which TWO actions should be taken when offboarding a user to protect organizational data?

Accepted Answer

Suspend the user account. Option B is correct because suspending the user account immediately blocks the offboarded user from signing in and accessing organizational resources such as email, Drive, and other Workspace services, while preserving the account's data for later transfer or audit. Option C is correct because applying a Vault hold preserves the user's data (mail, Drive files, chat, etc.) beyond the normal retention period and prevents it from being purged, which is essential when legal, compliance, or investigation requirements exist. Option A is wrong because billing settings are unrelated to protecting organizational data during offboarding. Option D is wrong because granting full email access would expand the departing user's access rather than restrict it. Option E is wrong because deleting the account immediately can destroy data and remove the ability to transfer ownership or place holds, so suspension is preferred over deletion.

Answer

Reset the user's billing settings

Answer

Grant user full email access

Answer

Delete the user account immediately

Question 10

A user is unable to send email to a group. What is the most common cause?

Accepted Answer

The group's 'Who can post' settings.. Google Groups have specific 'Who can post' settings that often restrict who can send messages to the group.

Answer

The group name is invalid.

Answer

The group's storage is full.

Answer

The user is not a member of the group.

Question 11

You want to ensure that users cannot change their profile photo. Where is this setting located?

Accepted Answer

Account > Account settings > Profile editing. The setting to prevent users from changing their profile photo is located under Account > Account settings > Profile editing. In the Google Admin console, this section contains controls for what users can edit in their directory profile, including photo, name, and other fields. Disabling photo editing here enforces the restriction.

Answer

Security > Account settings

Answer

Directory > Users > Permissions

Answer

Apps > Google Workspace > Directory

Question 12

Where do you go to view a list of all devices currently accessing your organization's data?

Accepted Answer

Devices > Mobile & endpoints > Devices. The 'Devices' section in the Admin console provides a centralized view of all mobile and desktop devices.

Answer

Reports > Audit > Mobile

Answer

Directory > Users > Device list

Answer

Security > Devices

Question 13

Where can an administrator view the status of a user's 2-Step Verification enrollment?

Accepted Answer

Directory > Users > [User] > Security. User security information, including 2SV status, is found in the individual user's profile within the Directory.

Answer

Security > Authentication > 2SV

Answer

Reports > Audit > Security

Answer

Account > Security Dashboard

Question 14

An administrator mistakenly deleted a user account 10 days ago. How can you restore this account?

Accepted Answer

Use the Restore User tool in the Admin console. Deleted users can be restored within 20 days via the Admin console.

Answer

Contact Google Support for data recovery

Answer

Restore from a Vault export

Answer

Create a new user with the same email

Question 15

Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?

Accepted Answer

SAML Single Logout (SLO) URL configuration in the SSO profile.. Single Logout (SLO) allows users to terminate their session across both Google Workspace and the configured SAML IdP.

Answer

Context-Aware Access session termination

Answer

OAuth token revocation API

Answer

Automated user provisioning via SCIM

Question 16

Which THREE settings can be enforced on Android devices using Advanced mobile management?

Accepted Answer

Managed application deployment. Advanced management allows for mandatory passcodes, managed applications, and remote wipe capabilities.

Answer

Enable the device's GPS tracking

Answer

Force an OS update

Question 17

You need to add a secondary domain to your Google Workspace account. What must you perform after adding the domain in the Admin console?

Accepted Answer

Verify domain ownership. Verification is mandatory to prove domain ownership via DNS records.

Answer

Create a new OU

Answer

Set up SPF records

Answer

Provision user accounts

Question 18

You are automating user creation via the Directory API. Which scope is required to create users?

Accepted Answer

https://www.googleapis.com/auth/admin.directory.user. The admin.directory.user scope is required for CRUD operations on user objects.

Answer

https://www.googleapis.com/auth/admin.reports.audit.readonly

Answer

https://www.googleapis.com/auth/admin.directory.group

Answer

https://www.googleapis.com/auth/admin.directory.domain.readonly

Question 19

Your organization uses a third-party Identity Provider (IdP) for SSO. Users are reporting that they cannot sign in. Where do you verify the SAML configuration?

Accepted Answer

Security > Authentication > SSO with third-party IdP. SAML configuration for third-party providers is managed in Security > Authentication > SSO with third-party IdP.

Answer

Apps > Web and mobile apps

Answer

Directory > Users

Answer

Account > Domain settings

Question 20

Your company has a mix of ChromeOS devices and Windows laptops. You want to ensure that only devices that are company-owned and enrolled in your domain can access Google Workspace. You have already set up Context-Aware Access with an access level that requires the device to be company-owned. However, users on Windows laptops are still able to access Workspace from personal devices. What is the most likely cause?

Accepted Answer

Windows devices are not reporting the company-owned attribute because Endpoint Verification does not collect that attribute. The company-owned attribute is not natively collected by Endpoint Verification on unmanaged Windows devices. To have this attribute, the device must be enrolled in a management system that reports ownership, such as GCPW with device management or a third-party UEM integrated with Google. Without that, the attribute is missing, and the access level may not enforce as expected.

Answer

The access level is not applied to the correct organizational units

Answer

The access level requires the device to be encrypted, which is not supported on Windows

Answer

ChromeOS devices are inherently trusted, so the access level only applies to them