GWS-ADMIN Practice Test 2 — 30 Questions

Question 1

You are a Workspace administrator. Your organization has a fleet of company-owned Windows devices that are already enrolled in Windows device management and synced to Google Workspace. You want to prevent users from signing in to their Google Account on any Windows device that is not company-owned, without affecting Android or iOS users. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In Admin console > Security > Access and data control > Context-Aware Access, create an access level that requires the device to be company-owned for Windows devices, then assign it to the Google Workspace apps.. Context-Aware Access is the feature that evaluates device attributes such as ownership and OS to grant or deny access to Workspace apps. By creating an access level that requires company-owned Windows devices and assigning it to the relevant apps, you restrict unmanaged Windows sign-ins while leaving Android and iOS users alone. Other settings either do not exist or do not target Windows specifically.

Answer

In Admin console > Directory > Users, disable 'Allow users to sign in from any device'.

Answer

In Admin console > Devices > Mobile & endpoints > Windows, set 'Windows device management' to 'Block unmanaged devices'.

Answer

In Admin console > Security > Authentication > SSO, require device certificates for Windows.

Question 2

What happens to a user's data when you suspend their account?

Accepted Answer

Data remains, but the user cannot log in. Suspension keeps data intact and accessible to the admin, but the user cannot log in.

Answer

License is automatically released

Answer

Data is deleted after 30 days

Answer

User can still access data via API

Question 3

A Google Workspace administrator needs to delegate the ability to manage user accounts and reset passwords to a helpdesk team, but must ensure they cannot access Gmail content or modify security settings. Which role should be assigned to the helpdesk team?

Accepted Answer

User Management Admin. The User Management Admin role is specifically designed to allow managing users and resetting passwords without granting access to Gmail content or security settings. Super Admin is too broad, while Groups Admin and Services Admin lack the necessary user management capabilities.

Answer

Groups Admin

Answer

Services Admin

Answer

Super Admin

Question 4

You have multiple domains in a single Google Workspace account. How can you provision users in a specific sub-domain?

Accepted Answer

Select the domain from the dropdown in the 'Add user' dialog. When adding a user in the Google Workspace Admin console, the 'Add user' dialog includes a dropdown menu that lists all verified domains and sub-domains in the account. Selecting the desired domain from this dropdown ensures the new user's primary email address is created under that specific domain. This is the standard, direct method for provisioning users in any domain or sub-domain without altering the primary domain or using aliases.

Answer

Rename the primary domain

Answer

Use a group alias

Answer

Create an OU for the domain

Question 5

Which THREE actions should you take to secure your Google Workspace environment against unauthorized admin access? (Choose three)

Accepted Answer

Enable 'Admin console sign-in restriction' to trusted IPs.. Option A is correct because enabling 'Admin console sign-in restriction' to trusted IPs in Google Workspace limits where administrators can authenticate to the Admin console, blocking admin sign-ins from untrusted networks and reducing the risk of credential-based unauthorized access. Option C is correct because configuring Audit and Investigation logs (e.g., the Admin audit log and login audit log) with alerts on unusual admin activity provides detection and rapid response to suspicious privileged actions, which is essential for identifying compromised or rogue admin accounts. Option D is correct because requiring Security Keys (FIDO2/WebAuthn phishing-resistant 2-step verification) for all Super Admin accounts protects the highest-privilege accounts against phishing, credential theft, and MFA fatigue attacks. Option B does not belong because forced 30-day password rotation is no longer a recommended security practice and does not specifically address unauthorized admin access. Option E does not belong because disabling non-Google Marketplace apps reduces third-party app risk but does not directly secure admin access to the Google Workspace environment.

Answer

Require a password change every 30 days for all users.

Answer

Disable all non-Google apps in the Marketplace.

Question 6

Which TWO settings in Drive sharing can help prevent data leakage?

Accepted Answer

Prevent viewers from downloading, printing, or copying. Option A is correct because the 'Viewers and commenters can see the option to download, print, and copy' setting in Google Drive sharing can be disabled, which removes the download, print, and copy controls for viewers and commenters, directly reducing the risk of data exfiltration. Option B is correct because limiting sharing to specific domains (via the 'Sharing outside of <domain>' / target audience and allowlist settings) restricts content distribution to trusted organizational domains, preventing leakage to unauthorized external parties. Option C is incorrect because allowing external sharing for all users broadens exposure and increases leakage risk rather than preventing it. Option D is incorrect because letting users set their own sharing permissions removes centralized control and can lead to overly permissive sharing. Option E is incorrect because disabling all Drive sharing is an overly broad, disruptive measure, not a targeted data-leakage prevention setting.

Answer

Allow external sharing for all users

Answer

Enable 'Allow user to set their own sharing'

Answer

Disable all Drive sharing

Question 7

Your company has a Google Workspace domain, example.com. A new subsidiary, subsidiary.com, will use Google Workspace but must remain a separate domain in the Admin console. You have added subsidiary.com as a secondary domain and verified ownership. Users at subsidiary.com need email addresses such as alice@subsidiary.com, but their accounts must be under the same Google Workspace subscription. What should you do next?

Accepted Answer

Create user accounts with a primary email address in the subsidiary.com domain.. A secondary domain lets you create new user accounts with primary addresses in that domain while keeping the existing primary domain. After verifying ownership, you simply specify the secondary domain when creating each user. This satisfies the need for alice@subsidiary.com under the same subscription without altering the primary domain or using aliases.

Answer

Create a new Google Workspace account for subsidiary.com and link it to the existing account.

Answer

Convert subsidiary.com into the account's primary domain.

Answer

Add subsidiary.com as a domain alias to example.com.

Question 8

Your company has a Google Workspace subscription. The IT team wants to ensure that all users' Chrome browsers are configured to block third-party cookies and that this setting cannot be changed by users. Which Google Workspace setting should you configure?

Accepted Answer

Chrome user policies in the Admin console under Devices > Chrome > Settings.. To enforce Chrome browser settings such as blocking third-party cookies and preventing users from changing them, you must configure Chrome user policies in the Admin console. This allows granular control over browser behavior for managed users. Other settings are unrelated to Chrome configuration.

Answer

Security settings under Security > Authentication > Google Session control.

Answer

Google Drive sharing settings under Apps > Google Workspace > Drive and Docs.

Answer

Google Meet safety settings under Apps > Google Workspace > Google Meet.

Question 9

A user reports that their Android work profile is no longer syncing corporate emails. As an administrator, which action should you perform first in the Google Admin console to investigate?

Accepted Answer

View the device details in the Device Management section of the Admin console. Checking the device status in the Admin console provides immediate insight into sync errors or compliance issues.

Answer

Force a factory reset on the user's device

Answer

Remove the user from the mobile management organizational unit

Answer

Disable the user's account in Google Workspace

Question 10

A departing employee's account must be preserved for a legal hold, but the employee should not be able to sign in. The legal team also needs to search the employee's Gmail and Drive content. Which action should the administrator take?

Accepted Answer

Suspend the account and place a Vault hold on the user.. Suspension blocks authentication while retaining the mailbox and Drive data. A Vault hold ensures the data is preserved beyond normal retention and makes it searchable for legal purposes. The combination meets both the access and preservation requirements without deleting data.

Answer

Archive the user and enable Gmail delegation for the legal team.

Answer

Suspend the account and take no further action.

Answer

Delete the account and restore the data from a backup.

Question 11

You are the Workspace administrator for a healthcare company. A compliance officer asks you to prove that Drive files containing patient data cannot be accessed by users outside your organization, even if a user accidentally shares a link publicly. You need to configure a Drive sharing setting that blocks external sharing for files matching a specific label. What should you do?

Accepted Answer

Create a data classification label with a 'Confidential' sensitivity level and apply it to patient files, then configure the label's sharing restriction to 'No external sharing'.. Data classification labels provide a scalable way to enforce sharing restrictions based on sensitivity. By applying a 'Confidential' label to patient files and setting the label's sharing restriction to 'No external sharing', you ensure that even if a user attempts to share a link publicly, the system blocks it. This approach is granular, auditable, and aligns with compliance requirements for protecting sensitive data.

Answer

Enable Drive DLP rules to block external sharing for files containing patient data, and set the action to 'Warn' when external sharing is attempted.

Answer

Create a data classification label with a 'Public' sensitivity level and apply it to all patient files, then set the label's sharing restriction to 'No external sharing'.

Answer

In the Admin Console, go to Apps > Drive and Docs > Sharing settings, and set 'Sharing outside of your organization' to 'Off' for all users.

Question 12

A user is unable to sync their Google Drive files to their local machine using Drive for Desktop. What is the first step you should recommend?

Accepted Answer

Check the Drive for Desktop application status and error logs.. Checking the Drive for Desktop application status and logs is the standard initial troubleshooting step for local client issues.

Answer

Reset the user's password.

Answer

Reinstall the entire Google Workspace account.

Answer

Disable multi-factor authentication.

Question 13

A Google Workspace administrator wants to ensure that all users in the organization are required to use 2-Step Verification (2SV) when signing in. Where should the administrator enforce this requirement?

Accepted Answer

In the Admin console, under Security > Authentication > 2-Step Verification, set enforcement to 'On' for the entire organizational unit.. The correct location to enforce 2-Step Verification for all users is the Admin console under Security > Authentication > 2-Step Verification. Administrators can set enforcement to 'On' for organizational units, which requires users to enroll and use 2SV. This centralized approach ensures consistent application of the security policy across the domain. Other options either do not exist or are unrelated to Workspace authentication settings.

Answer

In the Google Cloud Console, under IAM, create an organization policy that enforces 2-Step Verification for all users.

Answer

In the Google Workspace Directory, edit each user's profile and enable the 'Require 2-Step Verification' checkbox.

Answer

In the Admin console, under Apps > Google Workspace > Security, set the 'Enforce 2-Step Verification' slider to 'On'.

Question 14

Your organization requires that all Google Meet recordings be saved to a specific shared folder. How can you automate this?

Accepted Answer

It is not possible to change the default location via Admin Console settings. Google Meet recordings are saved to the meeting organizer's Drive by default, and the Admin Console does not provide a setting to redirect recordings to a specific shared folder. Admins can control whether recordings are allowed and who can record, but the storage location is determined by the organizer's Drive. To centralize recordings, organizations must use Drive sharing or a third-party tool, not an Admin Console path setting.

Answer

Set the 'Default storage' path in Apps > Google Workspace > Meet

Answer

Configure the 'Recording location' in Meet settings

Answer

Create a Drive retention policy for Meet

Question 15

A Google Workspace administrator needs to allow a third-party application to access specific Google Drive files on behalf of users. The administrator wants to restrict the application so it can only access files that users explicitly share with it, and cannot access all files in the domain. Which OAuth scopes configuration should be used?

Accepted Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive.file' scope, which allows access only to files that the app creates or that the user shares with it.. The 'https://www.googleapis.com/auth/drive.file' scope is the correct choice because it limits access to files that the app creates or that the user explicitly shares with it. This matches the requirement to restrict the third-party app to only explicitly shared files. Other scopes provide broader access, either to all files or all file metadata, which would exceed the necessary permissions and violate least privilege.

Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive.readonly' scope, which allows read-only access to all files.

Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive' scope, which provides full access to all files.

Answer

Configure the app to use the 'https://www.googleapis.com/auth/drive.metadata.readonly' scope, which allows reading metadata of all files.

Question 16

Which dashboard provides a summary of security incidents and potential policy violations?

Accepted Answer

Security center dashboard. The Security center dashboard in the Google Admin console aggregates security-related signals, including potential policy violations, suspicious login activity, and other incident summaries, giving admins a consolidated view of security posture. It is the designated place for security incident overview.

Answer

Vault dashboard

Answer

Compliance reports

Answer

User management dashboard

Question 17

Your company is subject to a regulation that requires all Google Workspace data for EU employees to remain within the European Union. You have already set a Data Region policy for the EU. A new employee in Germany reports that their Drive files show a US data region. What is the most likely explanation?

Accepted Answer

The files were created before the Data Region policy was applied or the policy does not cover the employee's organizational unit.. Data Region policies are forward-looking and scoped to organizational units. Data created before the policy, or by users outside the covered organizational unit, remains in its original region. The administrator must verify the policy scope and, if needed, migrate existing data using the supported migration process.

Answer

The employee is connecting from a non-EU IP address, which forces data to the US region.

Answer

The employee's Drive for desktop client is caching files locally in the US.

Answer

The employee's personal Drive settings override the organizational Data Region policy.

Question 18

An administrator is configuring Context-Aware Access to secure corporate data. Which TWO criteria can be evaluated within a Context-Aware Access access level expression? (Choose two.)

Accepted Answer

User's current geographic location (country/region).. Context-Aware Access access levels in Google Workspace/Cloud Identity are built from attributes about the user's identity, the request context, and the device, evaluated by Access Context Manager. Option D is correct because access levels can include geographic location conditions, such as the source IP's country/region, to allow or block access based on where the request originates. Option E is correct because device-based conditions are a core part of Context-Aware Access: access levels can require device policy compliance attributes like disk encryption, screen lock, and OS version via endpoint verification/device management. Option A is not a supported access level attribute, as Gmail inbox metrics are not part of Access Context Manager expressions. Option B is not evaluated by Context-Aware Access, since local OS password complexity and history are not exposed as access level criteria. Option C is not a supported criterion, as directory schema fields such as a manager name are not used in access level expressions.

Answer

The number of unread emails in the user's Gmail inbox.

Answer

The user's local operating system password complexity and history length.

Answer

The user's direct manager name listed in the directory schema.

Question 19

Which TWO actions should be taken when offboarding a user to protect organizational data?

Accepted Answer

Suspend the user account. Option B is correct because suspending the user account immediately blocks the offboarded user from signing in and accessing organizational resources such as email, Drive, and other Workspace services, while preserving the account's data for later transfer or audit. Option C is correct because applying a Vault hold preserves the user's data (mail, Drive files, chat, etc.) beyond the normal retention period and prevents it from being purged, which is essential when legal, compliance, or investigation requirements exist. Option A is wrong because billing settings are unrelated to protecting organizational data during offboarding. Option D is wrong because granting full email access would expand the departing user's access rather than restrict it. Option E is wrong because deleting the account immediately can destroy data and remove the ability to transfer ownership or place holds, so suspension is preferred over deletion.

Answer

Reset the user's billing settings

Answer

Grant user full email access

Answer

Delete the user account immediately

Question 20

A user is unable to send email to a group. What is the most common cause?

Accepted Answer

The group's 'Who can post' settings.. Google Groups have specific 'Who can post' settings that often restrict who can send messages to the group.

Answer

The group name is invalid.

Answer

The group's storage is full.

Answer

The user is not a member of the group.