GWS-ADMIN Practice Exam 4 — 20 Questions

Question 1

What is the difference between a primary domain and a secondary domain?

Accepted Answer

Primary is the identity foundation for the account. The primary domain is the identity foundation of the Workspace account, used for initial setup and service naming.

Answer

Secondary domains cost more

Answer

Secondary domains do not support OUs

Answer

Primary is for email; secondary is for Drive

Question 2

You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?

Accepted Answer

Account > Account settings. Account settings, including time zone and language, are configured per OU under Account > Account settings.

Answer

Security > General > Account

Answer

Directory > Users > Account settings

Answer

Apps > Google Workspace > Profile

Question 3

Which TWO of the following tasks can be performed in the Users section of the Admin console?

Accepted Answer

Assigning a user to a group. Option A is correct because the Users section of the Admin console allows administrators to assign users to groups, controlling group membership and the permissions that come with it. Option E is correct because resetting a user's password is a core user-management task performed from the Users section, where an admin can set a new password for the account. Options B, C, and D do not belong: domain verification is handled in the Domains section (via a TXT or CNAME record), SMTP relay configuration is done in the Apps/Gmail settings (SMTP relay service), and creating a new domain is also a Domains-section task, not a Users-section task.

Answer

Verifying the domain

Answer

Configuring SMTP relays

Answer

Creating a new domain

Question 4

A company has a Google Workspace account with multiple domains. The administrator needs to ensure that when users sign in with their email address, they are redirected to the correct domain's login page. The company uses SAML SSO with a third-party IdP. Which setting should the administrator configure?

Accepted Answer

Configure the third-party IdP to use the 'domain_hint' parameter or implement a discovery service.. When using SAML SSO with multiple domains, the IdP must be configured to route users to the correct login page based on their email domain. This is typically done using the 'domain_hint' parameter or a discovery service. Google Workspace's SSO settings are account-level and do not provide per-domain redirection; the IdP is responsible for this behavior.

Answer

In the Google Admin console, set the primary domain for SSO and add secondary domains as aliases.

Answer

Enable the 'Domain Discovery' feature in the Admin console under Security > SSO.

Answer

Set up a secondary domain and configure SSO for each domain separately.

Question 5

You want to ensure that only managed Chrome devices can access your organization's Google Workspace data. Which tool should you configure to verify the security posture of the device before allowing access?

Accepted Answer

Chrome Endpoint Verification. Endpoint Verification is the tool used to verify device security posture and report it to the Admin console.

Answer

Google Workspace Migrate

Answer

Google Cloud Identity

Answer

Chrome Remote Desktop

Question 6

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

Accepted Answer

Enforce hardware security keys as the only allowed 2-Step Verification method for administrator accounts.. Securing admin accounts involves mandating strict 2SV methods and restricting admin access to known IPs or devices.

Answer

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Answer

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Answer

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Question 7

A security team wants to enforce a policy that only company-managed devices can access Gmail and Drive, while personal devices are denied. Which TWO configurations are required in Google Workspace to implement this using Context-Aware Access? (Choose two.)

Accepted Answer

Assign the access level to the Gmail and Drive applications for the target organizational unit.. Context-Aware Access enforces device-based restrictions through access levels that evaluate device attributes. The two required steps are creating an access level that requires company-owned and approved devices, and then assigning that access level to Gmail and Drive for the target organizational unit. Without both steps, the policy either does not exist or does not apply to the apps, so the restriction would not take effect.

Answer

Configure a sign-in challenge that requires a security key for all users in the organizational unit.

Answer

Deploy a Chrome policy to force users to sign in with their managed Google Account on personal devices.

Answer

Enable 2-Step Verification enforcement for all users in the organizational unit.

Question 8

A user reports that emails are not being sent to an external mailing list. The logs show '550 5.1.1'. What does this code indicate?

Accepted Answer

The recipient address is invalid.. A 550 5.1.1 error code indicates that the recipient address does not exist or is invalid.

Answer

The sender is blocked.

Answer

The message was marked as spam.

Answer

The server is temporarily down.

Question 9

An administrator needs to view a report showing which users in the organization have not enabled 2-Step Verification. Where should the administrator look in the Google Admin console?

Accepted Answer

Reporting > Reports > Security > 2-Step Verification adoption. The correct location is Reporting > Reports > Security > 2-Step Verification adoption. This built-in report provides a list of users who have not enrolled in 2-Step Verification, along with their enrollment status. It is specifically designed to monitor 2SV adoption across the organization.

Answer

Account settings > Security metrics > Export

Answer

Security > Authentication > Dashboard > User status

Answer

Directory > Users > Filter > 2SV Status

Question 10

A school district wants to prevent students from installing any third-party apps that request access to Gmail data. Administrators need to ensure that only pre-approved apps can access Gmail. Which Google Workspace setting should they configure?

Accepted Answer

API controls in Admin console under Security > API Controls > App Access Control.. App Access Control in Admin console allows administrators to restrict which third-party apps can access Google Workspace services like Gmail. By setting Gmail to 'Restricted' and listing trusted apps, administrators can block unapproved apps. This is the correct location for managing OAuth-based access to Workspace data. The other options refer to unrelated security settings.

Answer

Gmail security settings under Apps > Google Workspace > Gmail > Safety.

Answer

OAuth consent screen configuration in Google Cloud Console.

Answer

User security settings under Security > Settings > User Security.

Question 11

A Workspace administrator wants to ensure that users in the Sales org unit can only sign in from corporate-managed Chromebooks and Windows devices, and block personal devices from accessing Gmail and Drive. Which enforcement mechanism should the administrator configure?

Accepted Answer

Set up a Context-Aware Access access level based on device policy, then assign it to the Sales org unit in the Gmail and Drive apps.. Context-Aware Access is the Workspace feature that evaluates device posture and other signals before granting access to apps. By defining an access level that requires a company-owned, managed device and assigning it to the Sales org unit for Gmail and Drive, the administrator ensures that only corporate Chromebooks and Windows machines can reach those services, while personal devices are denied.

Answer

Enable 2-Step Verification enforcement for the Sales org unit so only users who completed the second factor can sign in.

Answer

Create a Google Group for Sales and apply a Drive sharing restriction to prevent external sharing of files.

Answer

Configure a password policy with a minimum length of 14 characters for the Sales org unit to restrict access from insecure devices.

Question 12

Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?

Accepted Answer

The SAML app service status is set to OFF for the user's organizational unit or access group.. This error occurs when the SAML app is configured in the Google Admin console, but access is turned OFF for the user or their organizational unit.

Answer

The IdP signing certificate has expired.

Answer

The user's password has expired and needs to be reset.

Answer

The user does not have a Google Cloud Platform billing account attached.

Question 13

How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?

Accepted Answer

Set a Gmail retention rule in Google Vault. Google Vault retention rules override user actions — even if a user empties Trash or permanently deletes a message, Vault retains a copy for the configured period. Setting a 3-year retention rule on Gmail messages ensures deleted emails remain discoverable and recoverable for exactly that duration, satisfying legal/regulatory requirements.

Answer

Enable endpoint management

Answer

Use an Admin Console report

Answer

Configure a Gmail filter

Question 14

You are the Workspace administrator for a healthcare company. A new compliance policy requires that all external email sent from your domain be digitally signed so that recipients can verify the messages are genuinely from your organization. You need to configure this in the Google Workspace Admin console. What should you do?

Accepted Answer

Configure DKIM (DomainKeys Identified Mail) in the Admin console under Apps > Google Workspace > Gmail > Authenticate email, and publish the public key in DNS.. DKIM is the email authentication method that adds a digital signature to outgoing messages, allowing recipients to verify the message was sent by your domain and was not altered. Enabling DKIM in the Admin console and publishing the public key in DNS is the standard way to meet a requirement for digitally signed external email. SPF and DMARC are policy and validation mechanisms but do not sign messages, and S/MIME requires per-user certificates and does not automatically sign all outbound mail.

Answer

Enable DMARC (Domain-based Message Authentication, Reporting & Conformance) by adding a TXT record to your DNS with a policy of p=reject.

Answer

Enable S/MIME for Gmail in the Admin console under Apps > Google Workspace > Gmail > User settings, and upload a root certificate.

Answer

Set up SPF (Sender Policy Framework) by adding a TXT record to your domain's DNS that lists authorized sending IP addresses.

Question 15

Your organization has a policy that all Google Drive files must be owned by the organization, not by individual users. A user creates a new Google Doc and shares it with an external collaborator. You need to ensure that the file remains owned by the organization even if the user leaves. What should you do?

Accepted Answer

Set up a shared drive and enforce that all new files are created in it.. Shared drives are owned by the organization, not by individual users. By enforcing that files are created in shared drives, you ensure that ownership remains with the organization even if the user leaves. This is the most effective way to meet the policy requirement.

Answer

Enable Google Drive ownership transfer for all users.

Answer

Configure Google Vault to retain all files indefinitely.

Answer

Enable Drive File Stream for all users.

Question 16

Your company has a regulatory requirement to retain all Gmail messages sent by employees for exactly seven years, after which they must be permanently deleted. You need to enforce this automatically without user intervention. What should you configure?

Accepted Answer

A Google Vault retention rule for Gmail with a custom retention period of 7 years and an action to permanently delete messages after the period.. Google Vault retention rules are the correct tool for enforcing data retention policies across Google Workspace. You can create a custom rule for Gmail that retains messages for seven years and then permanently deletes them. This ensures compliance without relying on user actions. Other options either do not enforce deletion, lack central control, or are not designed for retention lifecycle management.

Answer

A Gmail content compliance rule that routes messages to a third-party archive and deletes them from Gmail after 7 years.

Answer

A Gmail user setting that automatically deletes messages older than 7 years from the inbox.

Answer

A Google Workspace default retention policy in Vault that retains all Gmail data indefinitely.

Question 17

Your company's security team wants to ensure that all outgoing email from your Google Workspace domain is authenticated so that external recipients can verify it. They ask you to check the current email authentication configuration for the domain. Where should you look in the Google Workspace Admin console to review and manage these settings?

Accepted Answer

Apps > Google Workspace > Gmail > Authenticate email (DKIM). Email authentication for a Google Workspace domain centers on SPF, DKIM, and DMARC. The Admin console provides DKIM management under Apps > Google Workspace > Gmail > Authenticate email, where you can generate and rotate the DKIM key. SPF and DMARC are configured in DNS. The other listed locations deal with compliance rules, account security, or user access, none of which contain the authentication settings the security team needs.

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Account settings > Security

Answer

Apps > Google Workspace > Gmail > End User Access

Question 18

A healthcare organization must comply with HIPAA and wants to ensure that Google Workspace data is protected against insider threats. The security team needs to monitor and alert on suspicious user behavior, such as mass downloads of Drive files and unusual login locations. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable and configure Security Center's investigation tool to create activity rules that trigger alerts on mass download events.. To monitor and alert on suspicious user behavior, the administrator should use Security Center's investigation tool to create activity rules for mass downloads and configure Admin console alerts for unusual login locations. These two actions provide the necessary detection and alerting capabilities. Other options, while important for security, do not directly address the monitoring and alerting requirements for insider threats.

Answer

Use Google Vault to set retention policies that prevent data deletion.

Answer

Configure Data Loss Prevention (DLP) rules to block sharing of sensitive files externally.

Answer

Enforce 2-Step Verification for all users to prevent unauthorized access.

Question 19

An employee lost their company-issued Android device. What is the most effective way to secure the data?

Accepted Answer

Use the 'Wipe device' command in the Admin console. Performing a 'Wipe account' or 'Wipe device' command removes corporate data or everything from the device remotely.

Answer

Disable the user's account in Active Directory

Answer

Change the user's password

Answer

Send an email to the employee to delete the data

Question 20

Your organization has a policy that employees must not be able to download Google Drive files on unmanaged devices. You have already set up Context-Aware Access with an access level that requires managed devices. However, users report they can still download files from Drive on personal devices. What is the most likely reason?

Accepted Answer

The access level only blocks access to Drive, but does not prevent downloading files once access is granted.. Context-Aware Access controls whether a user can access a service like Google Drive based on device context, but it does not manage what actions a user can perform once access is granted. To prevent downloads on unmanaged devices, administrators must also configure Drive sharing settings to disable download, print, and copy for users accessing from unmanaged devices. The most likely reason users can still download is that the access level permits access, and download restrictions are not separately enforced.

Answer

Users are bypassing Context-Aware Access by using the Google Drive mobile app, which is exempt from these policies.

Answer

Context-Aware Access does not apply to Google Drive; it only applies to Gmail and Google Meet.

Answer

The access level is not assigned to the correct organizational unit; it must be assigned to the root OU to take effect.