GWS-ADMIN Practice Test 4 — 25 Questions

Question 1

A user has left the company. You need to migrate their data to another user. Which tool should you use?

Accepted Answer

Data Migration Service. The Data Migration Service is specifically designed for moving data from one Google account to another.

Answer

Security Investigation Tool

Answer

Google Takeout

Answer

Google Vault

Question 2

A user reports that emails are not being sent to an external mailing list. The logs show '550 5.1.1'. What does this code indicate?

Accepted Answer

The recipient address is invalid.. A 550 5.1.1 error code indicates that the recipient address does not exist or is invalid.

Answer

The sender is blocked.

Answer

The message was marked as spam.

Answer

The server is temporarily down.

Question 3

You want to ensure that all users have a strong password policy. Where can you enforce password length and complexity requirements?

Accepted Answer

Security > Authentication > Password management. Password policies are managed in the Security section under Password management.

Answer

Directory > User settings

Answer

Security > Context-Aware Access

Answer

Account > Account settings

Question 4

An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?

Accepted Answer

Security > Authentication > 2-step verification. Enforcing 2-Step Verification requires navigating to Security > Authentication > 2-step verification in the Google Admin console.

Answer

Account settings > Security settings > 2SV

Answer

Directory > Users > Security > Access control

Answer

Devices > Mobile & endpoints > Settings > Universal settings

Question 5

Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?

Accepted Answer

The SAML app service status is set to OFF for the user's organizational unit or access group.. This error occurs when the SAML app is configured in the Google Admin console, but access is turned OFF for the user or their organizational unit.

Answer

The IdP signing certificate has expired.

Answer

The user's password has expired and needs to be reset.

Answer

The user does not have a Google Cloud Platform billing account attached.

Question 6

You want to ensure that only company-managed ChromeOS devices can access your Google Workspace environment. Which setting should you modify?

Accepted Answer

Context-Aware Access levels. Context-Aware Access allows you to restrict access based on whether the device is managed by the organization.

Answer

Device enrollment settings

Answer

Security center dashboard

Answer

Chrome browser cloud management settings

Question 7

Which of the following is true regarding 'Advanced' mobile management for iOS?

Accepted Answer

It allows administrators to manage Wi-Fi profiles and certificates. Advanced management provides more control, such as certificate management and enterprise Wi-Fi configuration, compared to Basic management.

Answer

It replaces the need for an Apple Push Certificate

Answer

It automatically removes the device after 30 days

Answer

It is required for all Android devices

Question 8

An employee is reporting that they cannot access corporate Gmail on their personal Android device. You have set up 'Advanced mobile management'. What is the most likely cause if the device is showing as 'Blocked' in the Admin console?

Accepted Answer

The device is pending admin approval in the mobile devices list. Under Advanced mobile management, devices must be approved by an administrator or meet specific compliance rules before they can sync corporate data.

Answer

The device has not been enrolled in the corporate Wi-Fi network

Answer

The user's account is locked in the Admin console

Answer

The user has not installed the Google Device Policy app

Question 9

When managing ChromeOS devices, which TWO settings can be configured within the 'Device settings' section of the Admin console?

Accepted Answer

Auto-update settings. Device settings allow for controlling device-level behaviors like Auto-update and sign-in restrictions.

Answer

User password rotation

Answer

Browser history retention

Answer

Default home page for all users

Question 10

You need to verify if an email was sent to an external address. Where can you see this in the Admin Console?

Accepted Answer

Email log search. The Email Log Search tool in the Admin Console allows administrators to trace email delivery and identify recipients.

Answer

Vault search

Answer

Compliance reports

Answer

Security center

Question 11

Your company wants to prevent employees from using personal Google accounts on company-owned ChromeOS devices. Which setting should you enable?

Accepted Answer

Device settings > Sign-in settings > Sign-in restriction. Blocking accounts on managed ChromeOS devices is a standard device policy to prevent data exfiltration.

Answer

User settings > Accounts > Prevent adding accounts

Answer

Security > Chrome > Account management

Answer

App management > Block personal accounts

Question 12

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

Accepted Answer

Enforce hardware security keys as the only allowed 2-Step Verification method for administrator accounts.. Securing admin accounts involves mandating strict 2SV methods and restricting admin access to known IPs or devices.

Answer

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Answer

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Answer

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Question 13

An administrator mistakenly deleted a user account 10 days ago. How can you restore this account?

Accepted Answer

Use the Restore User tool in the Admin console. Deleted users can be restored within 20 days via the Admin console.

Answer

Contact Google Support for data recovery

Answer

Restore from a Vault export

Answer

Create a new user with the same email

Question 14

An administrator needs to view all changes made to organizational units. Which report should they use?

Accepted Answer

Admin audit log. The Admin Audit log records all configuration changes within the Google Admin console.

Answer

User activity report

Answer

Login audit log

Answer

OAuth token audit

Question 15

Which THREE of the following are settings that can be controlled in the Chrome browser for all users?

Accepted Answer

Force-installing extensions. Extension installation, homepage URL, and bookmark sync are controllable browser policies.

Answer

Forcing a specific font size

Answer

Enforcing a specific desktop wallpaper

Question 16

Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?

Accepted Answer

SAML Single Logout (SLO) URL configuration in the SSO profile.. Single Logout (SLO) allows users to terminate their session across both Google Workspace and the configured SAML IdP.

Answer

Context-Aware Access session termination

Answer

OAuth token revocation API

Answer

Automated user provisioning via SCIM

Question 17

You want to require that all corporate-owned iOS devices are encrypted. How is this achieved?

Accepted Answer

Configure a passcode policy in the iOS device management settings. Apple devices (iOS) are encrypted by default when a passcode is set. Therefore, enforcing a passcode policy effectively enforces encryption.

Answer

Enable Advanced Mobile Management for all iOS users

Answer

Use an MDM profile to force file-level encryption

Answer

Enable the 'Require disk encryption' setting in iOS mobile settings

Question 18

You want to prevent users from copying data from managed apps into personal apps on their mobile devices. Which feature should you configure?

Accepted Answer

Mobile management > Work profile data sharing settings. Data protection features within mobile management help restrict data movement between work and personal containers.

Answer

Endpoint verification data settings

Answer

Context-Aware Access policies

Answer

Chrome browser management

Question 19

You notice that a user's account is generating a large amount of spam. What is the immediate action you should take?

Accepted Answer

Reset the user's password and sign out of all sessions.. Resetting the user's password and forcing a logout of all sessions is the fastest way to stop an account that has been compromised.

Answer

Rename the user account.

Answer

Delete the account.

Answer

Send a warning email to the user.

Question 20

A user claims they cannot reset their password using the 'Forgot Password' link. What is the most likely cause?

Accepted Answer

The self-service reset feature is disabled in Security settings. If 'Allow users to reset their passwords' is disabled in the Security settings, they cannot use the self-service flow.

Answer

The user is an admin

Answer

The user has 2FA enabled

Answer

The user account is in an OU without a license