GWS-ADMIN Practice Test 5 — 25 Questions

Question 1

An administrator notices unusual login activity from a specific geographic location. What is the first step to prevent further unauthorized access?

Accepted Answer

Suspend the user account.. Suspending the user account is the immediate action to stop ongoing unauthorized access while investigating.

Answer

Reset the user's password.

Answer

Delete the user account.

Answer

Clear the user's browser cookies.

Question 2

Which THREE features or tools in Google Workspace can be used to monitor and investigate suspicious sign-in activity or security anomalies? (Choose three.)

Accepted Answer

Security Center > Investigation Tool. Option B (Security Center > Investigation Tool) is correct because it lets admins run targeted queries across Workspace logs (e.g., login, Drive, Gmail) to investigate suspicious sign-in activity and security anomalies, and take remediation actions like deleting emails or suspending users. Option C (Alert Center) is correct because it surfaces security alerts such as suspicious login attempts, leaked passwords, and government-backed attacks, giving admins a centralized place to triage and respond to anomalies. Option E (Reporting > Audit > Log events, e.g., Login, Admin, SAML) is correct because the audit log lets admins review detailed authentication and admin events, including SAML and login activity, to trace suspicious sign-in behavior. Option A (Drive sharing settings) is incorrect because it only controls external sharing and link visibility, not sign-in monitoring. Option D (Directory > Users > Bulk update via CSV) is incorrect because it is a user-provisioning/management feature, not a security monitoring or investigation tool.

Answer

Apps > Google Workspace > Drive sharing settings

Answer

Directory > Users > Bulk update via CSV

Question 3

You want to automate user account creation based on a specific event. What is the recommended approach?

Accepted Answer

Use the Directory API with a service account. Google Apps Script or the Directory API via a webhook/event-driven architecture is the standard method.

Answer

Use GCDS

Answer

Export/Import CSV daily

Answer

Use Google Forms

Answer

Manual input

Question 4

Which THREE of the following are components of the Directory API 'group' resource?

Accepted Answer

Group name. In the Google Workspace Admin SDK Directory API, the group resource is defined by core attributes such as B. Group name (the group's display name), C. Group email address (the unique group email used to address the group), and E. Group description (an optional text field describing the group's purpose). These three fields are standard writable properties of the group resource returned by groups.get and set via groups.insert/groups.update. By contrast, A. Group members list is not part of the group resource itself; membership is managed through the separate Members resource (members.list/insert/delete). D. Group creator ID is also not a field of the group resource; the Directory API group schema does not expose a creator identifier as a group property.

Answer

Group members list

Answer

Group creator ID

Question 5

You need to create a custom administrator role that allows specific users to manage Google Meet hardware devices and review their health status, but nothing else. Which privilege category should you select when building this custom role?

Accepted Answer

Services > Google Meet hardware. To manage Google Meet hardware devices and review their health, the custom role must include privileges from the 'Services > Google Meet hardware' category. This category contains the specific privileges for viewing and managing Meet hardware devices, such as 'View Devices' and 'Manage Devices', which are exactly what the role requires.

Answer

Organizational Units and Admin Roles

Answer

Mobile and Endpoints > Device Management

Answer

Security Center > Investigation Tool

Question 6

Which TWO mechanisms can an administrator use to recover access if a Super Administrator loses their 2-Step Verification device and is locked out? (Choose two.)

Accepted Answer

Have another Super Administrator reset the locked admin's 2-Step Verification status in the Google Admin console.. Option A is correct because a peer Super Administrator can open the Google Admin console, go to the user's Security settings, and reset the locked admin's 2-Step Verification enrollment, forcing re-enrollment at next sign-in. Option E is correct because Google generates one-time backup verification codes (10 codes) that can be used in place of a 2SV prompt when the primary device is unavailable, provided they were saved in advance. Option B is wrong because Google Workspace support cannot instantly disable 2SV without proper verification and typically requires the customer to have another Super Admin perform the reset. Option C is wrong because an external SAML IdP handles federated authentication, not Google's native 2SV, and cannot bypass it for a non-federated account. Option D is wrong because 'root domain controller administrative credentials' is an on-premises Active Directory concept and has no bearing on Google Workspace Super Admin authentication.

Answer

Call Google Workspace technical support to instantly disable 2SV without verification.

Answer

Send a password reset request to the external SAML IdP to bypass Google 2SV.

Answer

Log in using the root domain controller administrative credentials.

Question 7

Which THREE actions can be performed using the Google Admin console's bulk user management tool?

Accepted Answer

Suspending users. The bulk user management tool in the Google Admin console supports creating multiple users at once by uploading a CSV file with the required fields, so option E is correct. It also supports updating user information in bulk, such as names, organizational units, and other attributes, making option D correct. Suspending users in bulk is another supported action, allowing admins to suspend many accounts simultaneously, so option B is correct. Deleting user data is not a bulk operation available through this tool, and assigning custom admin roles is not supported in bulk here, so options A and C do not belong.

Answer

Deleting user data

Answer

Assigning custom admin roles

Question 8

Which TWO actions can you perform in Google Vault?

Accepted Answer

Search and export user data. Option C (Search and export user data) is correct because Google Vault is specifically designed for eDiscovery and compliance, allowing administrators to search across Gmail, Drive, and other Google Workspace services and export the results for legal or investigative purposes. Option E (Place a hold on user data) is also correct because Vault lets you create holds on specific users or organizational units to preserve data indefinitely, even if users delete it, which is essential for litigation and compliance. Option A (Configure DLP policies) is incorrect because data loss prevention is configured in the Google Admin console (Security > Data Loss Prevention), not in Vault. Option B (Set up 2-Step Verification) is incorrect because two-step verification is an authentication setting managed in the Admin console under Security > Authentication. Option D (Manage user passwords) is incorrect because password management is performed in the Admin console under Directory > Users, not in Vault.

Answer

Configure DLP policies

Answer

Set up 2-Step Verification

Answer

Manage user passwords

Question 9

You are implementing context-aware access and need to ensure that only devices with a disk-encrypted state are allowed to access Google Drive. Which feature enables this check?

Accepted Answer

Access Levels in Context-Aware Access. Access Levels in Context-Aware Access allow admins to define conditions like 'disk encryption enabled' for device access to Google Workspace apps. This is configured in Admin console > Security > Context-Aware Access, where you create access levels based on device state, IP, user identity, etc.

Answer

Google Workspace Alert Center

Answer

Device policy profiles

Answer

Chrome Enterprise Upgrade

Question 10

A new employee needs access to Google Workspace. What is the minimum action required in the Google Admin console to create the account?

Accepted Answer

Add a user and assign a Google Workspace license. Creating a user in the Admin console requires defining a primary email address and assigning a license for access.

Answer

Assign a Google Groups membership

Answer

Configure an alias

Answer

Create an organizational unit

Question 11

Which THREE of the following are valid ways to manage Google Calendar resource availability?

Accepted Answer

Auto-accept invitations. Resources are managed via building assignment, auto-accept rules, and visibility settings.

Answer

Enable recurring meeting limits

Answer

Restrict resource access by device type

Question 12

An employee is suspected of leaking data. You need to search their past Gmail and Drive files for specific terms. Which tool do you use?

Accepted Answer

Vault matter search. Vault matter search is the correct tool to search an employee's past Gmail and Drive files for specific terms. It allows administrators to create matters, define search queries, and examine data across Google Workspace services for eDiscovery and investigation purposes.

Answer

DLP incident report

Answer

Security investigation tool

Answer

Admin audit logs

Question 13

A user is unable to install a managed app on their iOS device. What is the first thing you should verify?

Accepted Answer

If the user's device is correctly enrolled in device management. If the device is not enrolled or is in an 'Unmanaged' state, managed apps cannot be pushed to it.

Answer

If the user has updated their iOS version

Answer

If the App Store is restricted on the device

Answer

If the user has an iPhone 14 or later

Question 14

You are configuring a 'Work profile' for Android. What is the primary benefit of this setup?

Accepted Answer

It separates work data and apps from personal data on the same device. Work profiles isolate work data from personal data, ensuring privacy for the user and security for the company.

Answer

It allows the company to see all personal messages

Answer

It prevents the user from taking photos

Answer

It forces the user to use a specific launcher

Question 15

A user reports their Gmail is not receiving external mail. Which TWO of the following could be the cause?

Accepted Answer

Incorrect MX records. Option D is correct because MX records tell the internet where to deliver mail for a domain; if they are incorrect or missing, external senders cannot route messages to Gmail's mail servers, so inbound mail fails. Option E is correct because aggressive spam filtering rules can quarantine, label, or delete legitimate external messages before they reach the inbox, making it appear that external mail is not being received. Option A is not correct because password length affects account security and authentication, not the delivery path for inbound external mail. Option B is not correct because a 30-day inactivity period may affect account state or access, but it does not by itself explain why external mail is not being delivered. Option C is not correct because display language settings only affect the user interface and do not influence SMTP routing or spam filtering.

Answer

The user's password is too short

Answer

The user has not logged in for 30 days

Answer

The user's display language settings

Question 16

Which THREE of the following are aspects of the Directory API 'user' resource?

Accepted Answer

Suspension status. The Directory API 'user' resource includes the 'suspended' field, which indicates whether the account is suspended, so option A (Suspension status) is correct. It also contains the 'name' object with givenName, familyName, and fullName properties, making option B (User's full name) correct. The resource's 'primaryEmail' field holds the user's primary email address, so option C (Primary email address) is correct. Option D (Device serial number) belongs to the Chrome/iOS device resources of the Directory API, not the user resource. Option E (Account creation date) is not a field of the user resource; creation time is exposed via the Admin SDK Reports API or the 'creationTime' field in other contexts, not as a standard user resource attribute.

Answer

Device serial number

Answer

Account creation date

Question 17

You are configuring Endpoint Verification. What is the primary purpose of the Endpoint Verification extension on a user's browser?

Accepted Answer

To collect device information for context-aware access. Endpoint Verification is a Chrome extension (and mobile agent) that collects device attributes such as OS version, screen lock status, disk encryption, and serial number, and reports them to Google. These signals feed into context-aware access policies, allowing admins to grant or deny access to Workspace apps based on device posture. Its primary purpose is to provide device context for access decisions.

Answer

To enable remote wipe capabilities

Answer

To enforce password complexity

Answer

To block all malicious websites

Question 18

A user reports that their mobile device is no longer syncing corporate data. What is the most likely cause?

Accepted Answer

The device no longer meets security compliance requirements.. If a security policy change has occurred or the device has become non-compliant, sync will be automatically blocked by Google Workspace.

Answer

The device battery is low.

Answer

The user is on the wrong Wi-Fi network.

Answer

The mobile carrier has blocked the connection.

Question 19

Your organization uses Google Workspace and has a legal hold on a user's Gmail and Drive data. The user continues to work and creates new files and emails. You need to ensure that any new content created by this user is also preserved under the same legal hold. What should you do?

Accepted Answer

Edit the existing matter and add the user's account to the holds for Gmail and Drive; Vault automatically includes future content.. Google Vault holds are applied to user accounts and cover all data within the specified services, including future data. When you add a user to a hold, any new emails or files they create are automatically preserved until the hold is released. This is the correct and simplest way to ensure ongoing preservation. Other options either do not provide the same legal protection or are unnecessary.

Answer

Create a new matter for the same user and set the same retention rules.

Answer

Set a Vault retention rule for the user's organizational unit to retain data indefinitely.

Answer

Export the user's current data and then set up a script to periodically export new data.

Question 20

Which setting allows you to see what files are being shared externally across your entire domain?

Accepted Answer

Security Investigation Tool. The Security Investigation Tool is the correct setting because it allows admins to search across all Drive files in the domain and filter by sharing visibility, including externally shared files. It provides a domain-wide view of file sharing activity and is the only surface that supports querying external sharing at scale. This is the tool designed for security investigations and reporting on sharing exposure.

Answer

Drive Audit Log

Answer

Apps > Google Workspace > Drive > Sharing audit

Answer

Report > User Reports > Drive