GWS-ADMIN Practice Test 3 — 30 Questions

Question 1

You have a mix of company-owned and BYOD mobile devices. You want to apply different policies to each. What is the recommended strategy?

Accepted Answer

Create two separate OUs and apply different mobile settings to each. Using different Organizational Units (OUs) allows you to apply different MDM policies to different groups of devices or users.

Answer

Create a Google Group and apply policies to the group

Answer

Use a third-party MDM for the BYOD devices only

Answer

Create a single OU and use groups for individual device settings

Question 2

You are configuring a 'Work profile' for Android. What is the primary benefit of this setup?

Accepted Answer

It separates work data and apps from personal data on the same device. Work profiles isolate work data from personal data, ensuring privacy for the user and security for the company.

Answer

It allows the company to see all personal messages

Answer

It prevents the user from taking photos

Answer

It forces the user to use a specific launcher

Question 3

You want to ensure that only managed Chrome devices can access your organization's Google Workspace data. Which tool should you configure to verify the security posture of the device before allowing access?

Accepted Answer

Chrome Endpoint Verification. Endpoint Verification is the tool used to verify device security posture and report it to the Admin console.

Answer

Google Workspace Migrate

Answer

Google Cloud Identity

Answer

Chrome Remote Desktop

Question 4

Which THREE of the following are valid ways to manage Google Calendar resource availability?

Accepted Answer

Auto-accept invitations. Resources are managed via building assignment, auto-accept rules, and visibility settings.

Answer

Enable recurring meeting limits

Answer

Restrict resource access by device type

Question 5

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 6

You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?

Accepted Answer

Context-Aware Access access levels referencing IP subnets and device policy compliance, assigned to targeted apps.. Context-Aware Access allows you to combine IP address subnets and device-policy compliance (corporate-owned status via endpoint management) to control access.

Answer

Google Cloud IAM conditions with Context-Aware Access and Security Health Analytics

Answer

Domain-wide SAML SSO with custom attribute mapping for IP addresses

Answer

Advanced Protection Program combined with Context-Aware Access

Question 7

A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?

Accepted Answer

The Admin console audit log for mobile management. The device audit log provides the necessary visibility into whether a command was successfully executed by the server and acknowledged by the device.

Answer

The Google Cloud Platform logs

Answer

The user's account status in the directory

Answer

The user's Gmail sent items

Question 8

Which THREE of the following attributes can be used in Context-Aware Access policies?

Accepted Answer

OS version. Device management status, encryption, and OS version are commonly used in access policies.

Answer

User's favorite browser

Answer

User's physical GPS location

Question 9

A user has left the company. You need to ensure all corporate data is removed from their Android device, but you want to keep their personal data intact. Which action should you take?

Accepted Answer

Select 'Wipe account' from the device details page. A 'Work wipe' removes only the work profile and corporate data from the device, leaving personal data untouched.

Answer

Disable the user's account in the Admin console

Answer

Remove the device from the domain

Answer

Perform a Factory reset

Question 10

Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?

Accepted Answer

Configure SSO profile assignment to exclude Super Administrators or use the 'Allow users to sign in with Google password' option on the SSO profile page.. Google Workspace allows you to configure a secondary SSO profile or enable network/admin bypass settings to allow admin sign-in via Google credentials.

Answer

Disable SAML SSO entirely and rely exclusively on Google's built-in OAuth service.

Answer

Enable the 'Turn on SSO for administrative accounts' option and assign a backup password.

Answer

Create a Context-Aware Access rule that triggers emergency recovery mode when the IdP IP is unreachable.

Question 11

An administrator wants to ensure that users cannot use weak or commonly breached passwords. Where can password monitoring be enabled in the Google Admin console?

Accepted Answer

Security > Password management > Monitor password reuse and strength. Password monitoring for breached credentials is enabled under Security > Password management.

Answer

Security Center > Security health page > Password strength

Answer

Account settings > Legal and compliance > Password audit

Answer

Directory > Users > Security alerts

Question 12

A user reports that their Android work profile is no longer syncing corporate emails. As an administrator, which action should you perform first in the Google Admin console to investigate?

Accepted Answer

View the device details in the Device Management section of the Admin console. Checking the device status in the Admin console provides immediate insight into sync errors or compliance issues.

Answer

Force a factory reset on the user's device

Answer

Remove the user from the mobile management organizational unit

Answer

Disable the user's account in Google Workspace

Question 13

Your company uses a third-party Identity Provider (IdP) for Single Sign-On (SSO) via SAML. A newly hired employee is unable to sign in, and you suspect their account is not properly mapped or provisioned. Where can you check SAML sign-in activity and error logs in the Google Admin console?

Accepted Answer

Reporting > Audit > SAML. Log events related to SAML and SSO authentication failures are recorded in the SAML log events section of the Google Admin console.

Answer

Directory > Users > [User] > Activity > Sign-in activity

Answer

Reporting > Audit > Admin log events

Answer

Security > Authentication > SAML log events

Question 14

Your organization uses ChromeOS devices. You want to enforce a policy that prevents users from using guest mode on these devices. Where do you configure this?

Accepted Answer

Device settings. ChromeOS device settings are managed under Devices > Chrome > Settings > Device settings.

Answer

Network settings

Answer

Users & browsers settings

Answer

Apps & extensions settings

Question 15

Which TWO of the following methods can be used to enroll Android devices?

Accepted Answer

QR code scanning. QR code and Zero-touch enrollment are the standard methods for provisioning corporate devices.

Answer

Manually entering the server IP address

Answer

Physical USB cable connection to the Admin's PC

Answer

Installing a third-party root certificate

Question 16

A user has left the company. You need to migrate their data to another user. Which tool should you use?

Accepted Answer

Data Migration Service. The Data Migration Service is specifically designed for moving data from one Google account to another.

Answer

Security Investigation Tool

Answer

Google Takeout

Answer

Google Vault

Question 17

A user reports that emails are not being sent to an external mailing list. The logs show '550 5.1.1'. What does this code indicate?

Accepted Answer

The recipient address is invalid.. A 550 5.1.1 error code indicates that the recipient address does not exist or is invalid.

Answer

The sender is blocked.

Answer

The message was marked as spam.

Answer

The server is temporarily down.

Question 18

You want to ensure that all users have a strong password policy. Where can you enforce password length and complexity requirements?

Accepted Answer

Security > Authentication > Password management. Password policies are managed in the Security section under Password management.

Answer

Directory > User settings

Answer

Security > Context-Aware Access

Answer

Account > Account settings

Question 19

An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?

Accepted Answer

Security > Authentication > 2-step verification. Enforcing 2-Step Verification requires navigating to Security > Authentication > 2-step verification in the Google Admin console.

Answer

Account settings > Security settings > 2SV

Answer

Directory > Users > Security > Access control

Answer

Devices > Mobile & endpoints > Settings > Universal settings

Question 20

Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?

Accepted Answer

The SAML app service status is set to OFF for the user's organizational unit or access group.. This error occurs when the SAML app is configured in the Google Admin console, but access is turned OFF for the user or their organizational unit.

Answer

The IdP signing certificate has expired.

Answer

The user's password has expired and needs to be reset.

Answer

The user does not have a Google Cloud Platform billing account attached.