GWS-ADMIN Practice Exam 3 — 20 Questions

Question 1

You need to prevent users from installing third-party Marketplace apps that request Drive read/write access. How do you configure this?

Accepted Answer

Security > Access and data control > API controls > Manage Google Services. This is managed in Security > Access and data control > API controls > Manage Google Services.

Answer

Apps > Google Workspace > Marketplace > Settings

Answer

Security > App access control

Answer

Apps > Google Workspace > Drive > API settings

Question 2

Which TWO of the following can be configured in the Google Workspace Admin Console to restrict user access to Google Drive?

Accepted Answer

Restrict sharing settings for external domains. Access to Drive is controlled by Sharing settings and Drive API controls.

Answer

Limit the number of files a user can create

Answer

Restrict access to specific file types

Answer

Set a file size limit for all uploads

Question 3

Where do you go to view a list of all devices currently accessing your organization's data?

Accepted Answer

Devices > Mobile & endpoints > Devices. The 'Devices' section in the Admin console provides a centralized view of all mobile and desktop devices.

Answer

Reports > Audit > Mobile

Answer

Directory > Users > Device list

Answer

Security > Devices

Question 4

You need to limit the number of participants in a Google Meet session to 10 for a specific organizational unit. How do you achieve this?

Accepted Answer

It is not possible to limit participant counts via Admin Console. Google Meet does not support limiting the number of participants via the Admin Console.

Answer

Modify the OU policy in Apps > Google Workspace > Meet

Answer

Use a group policy for Meet access

Answer

Set 'Participant limit' in the Meet settings

Question 5

Where can an administrator view the status of a user's 2-Step Verification enrollment?

Accepted Answer

Directory > Users > [User] > Security. User security information, including 2SV status, is found in the individual user's profile within the Directory.

Answer

Security > Authentication > 2SV

Answer

Reports > Audit > Security

Answer

Account > Security Dashboard

Question 6

You are setting up Context-Aware Access. You want to deny access to Google Workspace if the device is not encrypted. Which tool identifies the 'is_encrypted' attribute?

Accepted Answer

Endpoint Verification extension. Endpoint Verification reports device attributes like encryption status back to Google, which Context-Aware Access then uses to evaluate policies.

Answer

Device policy controller

Answer

Admin console audit logs

Answer

Google Cloud Identity sync

Question 7

An employee lost their company-issued Android device. What is the most effective way to secure the data?

Accepted Answer

Use the 'Wipe device' command in the Admin console. Performing a 'Wipe account' or 'Wipe device' command removes corporate data or everything from the device remotely.

Answer

Disable the user's account in Active Directory

Answer

Change the user's password

Answer

Send an email to the employee to delete the data

Question 8

You want to ensure that all internal Google Calendar invites include a link to a Google Meet session. Where do you configure this?

Accepted Answer

Apps > Google Workspace > Google Meet > Meet video settings. This is configured in the Google Meet settings, which automatically adds video conferencing to new calendar events.

Answer

Apps > Google Workspace > Calendar > Settings

Answer

Security > Calendar > Video call settings

Answer

Apps > Google Workspace > Calendar > Sharing options

Question 9

You need to ensure that Google Meet sessions created by your users always require a password/PIN for external participants. How do you enforce this?

Accepted Answer

This feature is not available in Google Workspace. Google Meet does not use PINs for external participants; it uses host management and entry controls.

Answer

Configure 'External participation' in Meet settings

Answer

Require 'Admin approval' for all meetings

Answer

Enable 'Meet Entry PIN' in Meet settings

Question 10

Where do you go in the Admin Console to view the current data region for your organization?

Accepted Answer

Account > Account settings > Data regions. The 'Account settings' section under 'Account' contains the data regions configuration.

Answer

Vault > Settings

Answer

Apps > Google Workspace

Answer

Security > Data protection

Question 11

Which THREE security settings are commonly configured using Context-Aware Access?

Accepted Answer

Device security posture (e.g., screen lock). Context-aware access allows restricting access to apps based on device security posture, IP, and location.

Answer

Email signature format

Answer

User password strength

Question 12

You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?

Accepted Answer

Security > Access and data control > API controls > Manage domain-wide delegation. For service accounts performing domain-wide delegation, scopes must be defined in the Security > Access and data control > API controls > Manage domain-wide delegation section.

Answer

Account > Security > App access

Answer

Directory > Users > Service Accounts

Answer

Apps > Google Workspace > Gmail > API

Question 13

Which TWO of the following are prerequisites for setting up iOS device management?

Accepted Answer

Apple Push Certificate. An Apple Push Certificate and Advanced Mobile Management are required to manage iOS devices effectively.

Answer

Physical access to each device

Answer

A custom domain name

Answer

Android Enterprise registration

Question 14

Your organization requires that all iOS devices accessing corporate data be encrypted and have a passcode. You have enabled Google Mobile Management. Which configuration setting should you verify in the Google Admin console to ensure all devices enforce these policies?

Accepted Answer

Configure iOS password requirements in Mobile & endpoints > Settings > iOS. The 'Password requirements' setting under Device > Mobile & endpoints > Settings > iOS ensures that MDM-enforced policies apply to the device.

Answer

Use the Google Cloud Directory Sync tool

Answer

Set up Basic mobile management

Answer

Enable Chrome browser management for iOS

Question 15

You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?

Accepted Answer

Account > Account settings. Account settings, including time zone and language, are configured per OU under Account > Account settings.

Answer

Security > General > Account

Answer

Directory > Users > Account settings

Answer

Apps > Google Workspace > Profile

Question 16

Your organization wants to ensure that all outgoing mail is routed through a third-party email security gateway for scanning. What is the correct configuration?

Accepted Answer

Apps > Google Workspace > Gmail > Routing. Outbound routing is configured in Apps > Google Workspace > Gmail > Routing by setting an outbound gateway.

Answer

Security > Compliance > Gateway

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Network > SMTP relay

Question 17

A user is seeing an 'Unable to verify account' error when signing in. What is the first thing to check?

Accepted Answer

Account suspension status. Checking if the account is suspended in the Admin console is the most common reason for this error.

Answer

User's password

Answer

Domain's DNS records

Answer

User's mobile phone number

Question 18

Your security team requires that all administrators must use a hardware security key (FIDO2) for 2-Step Verification and are prohibited from using SMS or phone prompts. Where can you enforce this requirement specifically for admin accounts?

Accepted Answer

Security > Admin security > Enforce 2-Step Verification and specify security keys.. Admin security policies, including strict 2SV methods for administrators, are configured under Security > Admin security.

Answer

Directory > Admin roles > Security policies

Answer

Security > Authentication > 2-step verification > Allow only security keys for administrators

Answer

Account settings > Administrator privileges > Authentication

Question 19

A new employee needs access to Google Workspace. What is the minimum action required in the Google Admin console to create the account?

Accepted Answer

Add a user and assign a Google Workspace license. Creating a user in the Admin console requires defining a primary email address and assigning a license for access.

Answer

Assign a Google Groups membership

Answer

Configure an alias

Answer

Create an organizational unit

Question 20

What is the difference between a primary domain and a secondary domain?

Accepted Answer

Primary is the identity foundation for the account. The primary domain is the identity foundation of the Workspace account, used for initial setup and service naming.

Answer

Secondary domains cost more

Answer

Secondary domains do not support OUs

Answer

Primary is for email; secondary is for Drive