GWS-ADMIN Practice Test 4 — 25 Questions

Question 1

Your company has a regulatory requirement to retain all Gmail messages sent by employees for exactly seven years, after which they must be permanently deleted. You need to enforce this automatically without user intervention. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Google Vault retention rule for Gmail with a custom retention period of 7 years and an action to permanently delete messages after the period.. Google Vault retention rules are the correct tool for enforcing data retention policies across Google Workspace. You can create a custom rule for Gmail that retains messages for seven years and then permanently deletes them. This ensures compliance without relying on user actions. Other options either do not enforce deletion, lack central control, or are not designed for retention lifecycle management.

Answer

A Gmail content compliance rule that routes messages to a third-party archive and deletes them from Gmail after 7 years.

Answer

A Gmail user setting that automatically deletes messages older than 7 years from the inbox.

Answer

A Google Workspace default retention policy in Vault that retains all Gmail data indefinitely.

Question 2

Your company's security team wants to ensure that all outgoing email from your Google Workspace domain is authenticated so that external recipients can verify it. They ask you to check the current email authentication configuration for the domain. Where should you look in the Google Workspace Admin console to review and manage these settings?

Accepted Answer

Apps > Google Workspace > Gmail > Authenticate email (DKIM). Email authentication for a Google Workspace domain centers on SPF, DKIM, and DMARC. The Admin console provides DKIM management under Apps > Google Workspace > Gmail > Authenticate email, where you can generate and rotate the DKIM key. SPF and DMARC are configured in DNS. The other listed locations deal with compliance rules, account security, or user access, none of which contain the authentication settings the security team needs.

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Account settings > Security

Answer

Apps > Google Workspace > Gmail > End User Access

Question 3

A healthcare organization must comply with HIPAA and wants to ensure that Google Workspace data is protected against insider threats. The security team needs to monitor and alert on suspicious user behavior, such as mass downloads of Drive files and unusual login locations. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable and configure Security Center's investigation tool to create activity rules that trigger alerts on mass download events.. To monitor and alert on suspicious user behavior, the administrator should use Security Center's investigation tool to create activity rules for mass downloads and configure Admin console alerts for unusual login locations. These two actions provide the necessary detection and alerting capabilities. Other options, while important for security, do not directly address the monitoring and alerting requirements for insider threats.

Answer

Use Google Vault to set retention policies that prevent data deletion.

Answer

Configure Data Loss Prevention (DLP) rules to block sharing of sensitive files externally.

Answer

Enforce 2-Step Verification for all users to prevent unauthorized access.

Question 4

An employee lost their company-issued Android device. What is the most effective way to secure the data?

Accepted Answer

Use the 'Wipe device' command in the Admin console. Performing a 'Wipe account' or 'Wipe device' command removes corporate data or everything from the device remotely.

Answer

Disable the user's account in Active Directory

Answer

Change the user's password

Answer

Send an email to the employee to delete the data

Question 5

Your organization has a policy that employees must not be able to download Google Drive files on unmanaged devices. You have already set up Context-Aware Access with an access level that requires managed devices. However, users report they can still download files from Drive on personal devices. What is the most likely reason?

Accepted Answer

The access level only blocks access to Drive, but does not prevent downloading files once access is granted.. Context-Aware Access controls whether a user can access a service like Google Drive based on device context, but it does not manage what actions a user can perform once access is granted. To prevent downloads on unmanaged devices, administrators must also configure Drive sharing settings to disable download, print, and copy for users accessing from unmanaged devices. The most likely reason users can still download is that the access level permits access, and download restrictions are not separately enforced.

Answer

Users are bypassing Context-Aware Access by using the Google Drive mobile app, which is exempt from these policies.

Answer

Context-Aware Access does not apply to Google Drive; it only applies to Gmail and Google Meet.

Answer

The access level is not assigned to the correct organizational unit; it must be assigned to the root OU to take effect.

Question 6

Your organization uses Google Workspace and wants to enforce context-aware access for users accessing Gmail from desktop browsers. You need to ensure that only company-owned Windows devices with up-to-date OS patches and encrypted drives are allowed. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Configure a Context-Aware Access access level with conditions for device ownership and encryption.. To enforce Context-Aware Access based on device attributes like ownership, encryption, and OS version, you need the Endpoint Verification extension to gather those attributes and an access level that specifies the conditions. These two components work together to allow or deny access to Gmail from desktop browsers.

Answer

Install the Google Credential Provider for Windows on all company-owned devices.

Answer

Set up a Windows device policy in the Admin console to enforce OS updates and encryption.

Answer

Enable advanced mobile management for Windows devices.

Question 7

Your organization allows employees to use personal iOS devices for work. You need to ensure that when a user adds their corporate Google Workspace account to the native iOS Mail app, the device is automatically enrolled in advanced mobile management and a passcode is enforced. What should you do?

Accepted Answer

Enable 'Advanced' mobile management for iOS in the Admin console under Devices > Mobile & endpoints > Settings > Universal settings.. Advanced mobile management for iOS, when enabled for an organizational unit, automatically enrolls personal iOS devices when the user adds a managed Google Workspace account to the native iOS Mail app. This enrollment enforces passcode and encryption policies without requiring the user to install a separate app. It is the designated method for securing BYOD iOS devices in Google Workspace.

Answer

Deploy the Google Device Policy app to all iOS devices via a third-party EMM provider.

Answer

Create a device policy in the Admin console under Devices > Mobile & endpoints > Devices and manually add each iOS device.

Answer

Configure a Context-Aware Access access level that requires a passcode and apply it to the Gmail service.

Question 8

A user reports that their company-owned Android device is not receiving work emails. You check the Admin console and see that the device is listed but the status is 'Pending'. What should you do first?

Accepted Answer

Ask the user to open the Google Device Policy app and complete enrollment.. A 'Pending' device status means the enrollment process was initiated but not completed. The user must open the Google Device Policy app and finish the steps to enroll the device. This app is essential for advanced mobile management and applies the necessary policies. Once enrollment is complete, the device status changes to 'Approved' or similar, and work email will begin syncing. Other actions like re-enrolling or checking licenses are not appropriate first steps.

Answer

Check if the user has exceeded their license limit.

Answer

Verify that the device has an active internet connection.

Answer

Remove the device from the Admin console and re-enroll it.

Question 9

You are the Google Workspace administrator for a company with 5,000 users. The HR department needs to update the 'Department' and 'Manager' fields for all users. They will provide a CSV file. You want to minimize manual effort and ensure the updates are applied correctly. Which method should you use?

Accepted Answer

Use the Google Workspace Admin console's bulk upload feature with a CSV file.. The Admin console provides a bulk upload feature that accepts CSV files to update user profiles in bulk. This is the most efficient method for applying a large set of updates from HR. It directly targets standard fields like Department and Manager, avoiding the need for scripting or manual edits. Other methods either do not scale or target the wrong data fields.

Answer

Use Google Cloud Directory Sync (GCDS) to synchronize the HR database with Google Workspace.

Answer

Use the Directory API to update each user's custom attributes via a script.

Answer

Use the Google Admin console to edit each user's profile individually.

Question 10

A Workspace administrator receives reports that several users in the sales organizational unit cannot sign in to their accounts from newly issued corporate Android devices. The users can sign in successfully from their laptops. The administrator has already confirmed the users' passwords are correct and that no account suspensions are in place. Which TWO of the following should the administrator check to resolve the mobile sign-in failures? (Choose two.)

Accepted Answer

Whether a Google Context-Aware Access access level assigned to the sales OU blocks devices that do not meet device trust requirements.. Sign-in failures that affect only mobile devices while laptops work often point to conditional access or network restrictions. Context-Aware Access access levels can deny devices that lack required security attributes, and IP allowlists can block devices outside approved networks. Both settings can be scoped to an organizational unit and produce exactly the pattern described. Reviewing these two configurations for the sales OU is the most efficient path to resolution.

Answer

Whether the users' Gmail IMAP access is disabled for the sales OU, preventing mobile mail clients from authenticating.

Answer

Whether the sales OU has a password policy that forces a password change on next sign-in for mobile clients only.

Answer

Whether the sales OU has a session length policy that signs users out of mobile apps every hour.

Question 11

A helpdesk administrator needs to reset passwords for users in the Sales organizational unit but must not be able to reset passwords for users in the Finance organizational unit. The helpdesk admin already has a custom role with the 'Users: Reset password' privilege. What should you do to restrict the role's scope to only the Sales organizational unit?

Accepted Answer

Assign the custom role to the helpdesk admin at the Sales organizational unit level in the Admin console.. Administrative privileges in Google Workspace are scoped by organizational unit. When a custom role is assigned at the Sales organizational unit, the admin can perform the included actions only on users within that OU. This allows granular delegation, such as letting helpdesk reset passwords for Sales but not Finance. Assigning the role at the root would grant domain-wide access, so the OU-level assignment is essential.

Answer

Create an access group containing only Sales users and assign the custom role to that group, then remove the helpdesk admin from all other groups.

Answer

Use the 'Delegated admin' setting to specify that the helpdesk admin can only manage users whose last name starts with a letter in the range A-M.

Answer

Create a new organizational unit named 'Sales-Helpdesk' and move the helpdesk admin into it, then assign the role at the root level.

Question 12

You are the Workspace administrator for a company that has just acquired a smaller business. The acquired business currently uses its own Google Workspace account with the domain 'acme-parts.com'. Your leadership team wants users from 'acme-parts.com' to appear in the same Global Directory as your primary domain 'yourcompany.com' and to share Google Workspace services, but they must keep sending and receiving email using '@acme-parts.com' addresses. You have already added and verified 'acme-parts.com' as a secondary domain in your Admin console. What should you do next to meet these requirements?

Accepted Answer

Create user accounts with @acme-parts.com addresses in the yourcompany.com account, and stop paying for the acquired business's old Workspace subscription.. Once a secondary domain is verified, users can be created directly on that domain inside the same Workspace account, giving them distinct @acme-parts.com identities that share the directory and services. A domain alias cannot provide separate mailboxes or sign-in identities, and keeping a separate tenant or swapping the primary domain fails the goal of a unified directory with preserved email addresses.

Answer

Leave the acquired business on its own separate Google Workspace account and configure mail routing between the two tenants.

Answer

Convert 'acme-parts.com' into the primary domain of your account and move 'yourcompany.com' to a secondary domain.

Answer

Configure 'acme-parts.com' as a domain alias of 'yourcompany.com' so that every existing user can receive mail sent to the alias and send as the alias address.

Question 13

A Google Workspace administrator is troubleshooting an issue with Google Groups. A user reports that they are not receiving email sent to a group they are a member of. The administrator checks the group's settings and confirms that the user is a direct member with 'Email' subscription. The group's access settings allow external senders. The administrator also verifies that the group's email address is correct and that messages are not being caught by spam filters. Which is the MOST likely cause of the user not receiving group emails?

Accepted Answer

The user has a filter in Gmail that archives or deletes messages from the group's email address.. When group settings and spam filters are ruled out, the next likely cause is a Gmail filter in the user's mailbox that archives or deletes messages from the group. The administrator should check the user's Gmail settings under Filters and Blocked Addresses. If a filter exists, it should be modified or removed. This is a common oversight because filters operate silently and can affect specific senders.

Answer

The user's Google Workspace account is not authorized to receive email from external senders due to a compliance rule.

Answer

The group's email address is configured to forward to a different address, and the user is not included in the forwarding list.

Answer

The group's membership is set to 'Direct members' only, and the user is actually a member via a nested group.

Question 14

An organization uses Google Cloud Directory Sync (GCDS) to keep its Workspace directory aligned with an on-premises LDAP directory. The administrator must ensure that local directory attributes map correctly and that deletes in the source system do not accidentally wipe out Workspace accounts and their data, while still allowing legitimate departures to be processed. Which two configuration practices should the administrator apply? (Choose two.)

Accepted Answer

Enable the option to suspend rather than delete users removed from the source directory.. Exclusion rules keep designated accounts out of the sync scope so they are never modified or deleted, and the suspend-instead-of-delete option preserves data when a source account disappears. Together these practices prevent accidental data loss while still allowing legitimate departures to be reflected as suspended accounts.

Answer

Map every LDAP attribute to a corresponding Workspace field to avoid missing data.

Answer

Grant the sync service account the Super Admin role to avoid permission errors during synchronization.

Answer

Configure the sync to run continuously in real time so attribute changes propagate instantly.

Question 15

An organization wants to prevent users from signing in to their Google Workspace accounts from outside their home country. Which feature should the administrator configure?

Accepted Answer

Context-Aware Access. Context-Aware Access allows administrators to define access levels based on attributes such as IP address, device type, and user identity, and apply them to Google Workspace apps. By configuring an access level that restricts access to the organization's home country IP ranges, the admin can block sign-ins from outside that country.

Answer

Data Region Policy

Answer

Advanced Protection Program

Answer

Password Monitoring

Question 16

A Google Workspace administrator receives reports that some users are not receiving email notifications from a third-party ticketing system. The ticketing system sends from a domain that has a strict DMARC policy. The notifications are not in spam. What should the administrator check first?

Accepted Answer

Check the Email Log Search in the Google Admin console for rejected messages.. When emails are not delivered and not in spam, the issue is likely at the SMTP or policy level. Email Log Search in the Admin console shows whether messages were rejected, deferred, or delivered. It can reveal DMARC failures or other rejection reasons. This is the fastest way to determine the root cause before investigating SPF/DKIM or filters.

Answer

Confirm the users' Gmail filters are not automatically deleting the messages.

Answer

Ensure the ticketing system's sending IP is whitelisted in Google Workspace email settings.

Answer

Verify the ticketing system's SPF and DKIM records are correctly configured.

Question 17

You need to add a custom attribute to user profiles. Where is this configured?

Accepted Answer

Directory > Users > Manage custom attributes. Custom attributes are managed under Directory > Users > More > Manage custom attributes.

Answer

Account > Organization profile

Answer

Security > Profile settings

Answer

Directory > OU management

Question 18

A Google Workspace administrator at a company with a single primary domain wants to make a newly created OU named 'Contractors' immediately available as a target for dynamic group membership rules and shared drive access policies. A colleague suggests that the OU must be populated with at least one user before it can be referenced by policy. Which statement describes what actually happens after the OU is created in the Admin console?

Accepted Answer

The OU is created instantly and can be referenced by policies and dynamic group queries even while it is empty.. Organizational units are persistent directory objects created the moment they are saved. Their path can be targeted by dynamic group membership queries, device policies, and access policies without any member present, and users moved in later inherit those settings automatically. No pending state, sync delay, or matching group is required for the OU to function as a policy target.

Answer

The OU can only be referenced by policies after a group with the same name has been created.

Answer

The OU is created, but it appears only in the Admin console after the next directory synchronization completes.

Answer

The OU remains in a pending state until a user is assigned to it, and policies applied to it do not take effect until then.

Question 19

Which TWO of the following actions can be performed on an Android device from the Admin console?

Accepted Answer

Remote removal of the work profile. Option B is correct because Android Enterprise management through the Admin console allows an administrator to remotely delete/remove a work profile from a managed device, wiping only the corporate data and apps in that profile. Option D is correct because the Admin console supports issuing a remote factory reset (wipe) command that erases the entire device, returning it to its original out-of-box state. Option A is not valid since the Admin console has no capability to control a device's camera shutter remotely. Option C is not valid because OS version installation/updates are handled by the device manufacturer or carrier OTA process, not pushed as a specific Android OS version from the Admin console. Option E is not valid because physically removing a battery is a hardware action that cannot be performed remotely through any management console.

Answer

Remote control of the camera shutter

Answer

Remote installation of a specific version of Android OS

Answer

Remote physical battery removal

Question 20

A multinational company has a primary domain, example.com, and a secondary domain, example.net, in the same Google Workspace account. The administrator wants users signing in with the example.net alias to appear in the Global Directory under example.net rather than under example.com. What must the administrator configure to achieve this?

Accepted Answer

Keep example.net as a secondary domain and set each user's primary email address to the example.net domain.. A user's primary email address determines which domain they are listed under in the Global Directory. With example.net configured as a secondary domain in the same account, assigning that domain as the primary address for selected users produces listings under example.net while example.com remains the account's primary domain.

Answer

Add example.net as an alias domain of example.com and set each user's primary email in the example.net domain.

Answer

Create a separate Google Workspace account for example.net and enable directory sharing between the two accounts.

Answer

Make example.net the primary domain and demote example.com to a secondary domain.