GWS-ADMIN Practice Questions 2 — 50 Questions

Question 1

You want to ensure that users cannot change their profile photo. Where is this setting located?

Accepted Answer

Account > Account settings > Profile editing. The setting to prevent users from changing their profile photo is located under Account > Account settings > Profile editing. In the Google Admin console, this section contains controls for what users can edit in their directory profile, including photo, name, and other fields. Disabling photo editing here enforces the restriction.

Answer

Security > Account settings

Answer

Directory > Users > Permissions

Answer

Apps > Google Workspace > Directory

Question 2

Where do you go to view a list of all devices currently accessing your organization's data?

Accepted Answer

Devices > Mobile & endpoints > Devices. The 'Devices' section in the Admin console provides a centralized view of all mobile and desktop devices.

Answer

Reports > Audit > Mobile

Answer

Directory > Users > Device list

Answer

Security > Devices

Question 3

Where can an administrator view the status of a user's 2-Step Verification enrollment?

Accepted Answer

Directory > Users > [User] > Security. User security information, including 2SV status, is found in the individual user's profile within the Directory.

Answer

Security > Authentication > 2SV

Answer

Reports > Audit > Security

Answer

Account > Security Dashboard

Question 4

An administrator mistakenly deleted a user account 10 days ago. How can you restore this account?

Accepted Answer

Use the Restore User tool in the Admin console. Deleted users can be restored within 20 days via the Admin console.

Answer

Contact Google Support for data recovery

Answer

Restore from a Vault export

Answer

Create a new user with the same email

Question 5

Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?

Accepted Answer

SAML Single Logout (SLO) URL configuration in the SSO profile.. Single Logout (SLO) allows users to terminate their session across both Google Workspace and the configured SAML IdP.

Answer

Context-Aware Access session termination

Answer

OAuth token revocation API

Answer

Automated user provisioning via SCIM

Question 6

Which THREE settings can be enforced on Android devices using Advanced mobile management?

Accepted Answer

Managed application deployment. Advanced management allows for mandatory passcodes, managed applications, and remote wipe capabilities.

Answer

Enable the device's GPS tracking

Answer

Force an OS update

Question 7

You need to add a secondary domain to your Google Workspace account. What must you perform after adding the domain in the Admin console?

Accepted Answer

Verify domain ownership. Verification is mandatory to prove domain ownership via DNS records.

Answer

Create a new OU

Answer

Set up SPF records

Answer

Provision user accounts

Question 8

You are automating user creation via the Directory API. Which scope is required to create users?

Accepted Answer

https://www.googleapis.com/auth/admin.directory.user. The admin.directory.user scope is required for CRUD operations on user objects.

Answer

https://www.googleapis.com/auth/admin.reports.audit.readonly

Answer

https://www.googleapis.com/auth/admin.directory.group

Answer

https://www.googleapis.com/auth/admin.directory.domain.readonly

Question 9

Your organization uses a third-party Identity Provider (IdP) for SSO. Users are reporting that they cannot sign in. Where do you verify the SAML configuration?

Accepted Answer

Security > Authentication > SSO with third-party IdP. SAML configuration for third-party providers is managed in Security > Authentication > SSO with third-party IdP.

Answer

Apps > Web and mobile apps

Answer

Directory > Users

Answer

Account > Domain settings

Question 10

Your company has a mix of ChromeOS devices and Windows laptops. You want to ensure that only devices that are company-owned and enrolled in your domain can access Google Workspace. You have already set up Context-Aware Access with an access level that requires the device to be company-owned. However, users on Windows laptops are still able to access Workspace from personal devices. What is the most likely cause?

Accepted Answer

Windows devices are not reporting the company-owned attribute because Endpoint Verification does not collect that attribute. The company-owned attribute is not natively collected by Endpoint Verification on unmanaged Windows devices. To have this attribute, the device must be enrolled in a management system that reports ownership, such as GCPW with device management or a third-party UEM integrated with Google. Without that, the attribute is missing, and the access level may not enforce as expected.

Answer

The access level is not applied to the correct organizational units

Answer

The access level requires the device to be encrypted, which is not supported on Windows

Answer

ChromeOS devices are inherently trusted, so the access level only applies to them

Question 11

What is the difference between a primary domain and a secondary domain?

Accepted Answer

Primary is the identity foundation for the account. The primary domain is the identity foundation of the Workspace account, used for initial setup and service naming.

Answer

Secondary domains cost more

Answer

Secondary domains do not support OUs

Answer

Primary is for email; secondary is for Drive

Question 12

You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?

Accepted Answer

Account > Account settings. Account settings, including time zone and language, are configured per OU under Account > Account settings.

Answer

Security > General > Account

Answer

Directory > Users > Account settings

Answer

Apps > Google Workspace > Profile

Question 13

Which TWO of the following tasks can be performed in the Users section of the Admin console?

Accepted Answer

Assigning a user to a group. Option A is correct because the Users section of the Admin console allows administrators to assign users to groups, controlling group membership and the permissions that come with it. Option E is correct because resetting a user's password is a core user-management task performed from the Users section, where an admin can set a new password for the account. Options B, C, and D do not belong: domain verification is handled in the Domains section (via a TXT or CNAME record), SMTP relay configuration is done in the Apps/Gmail settings (SMTP relay service), and creating a new domain is also a Domains-section task, not a Users-section task.

Answer

Verifying the domain

Answer

Configuring SMTP relays

Answer

Creating a new domain

Question 14

A company has a Google Workspace account with multiple domains. The administrator needs to ensure that when users sign in with their email address, they are redirected to the correct domain's login page. The company uses SAML SSO with a third-party IdP. Which setting should the administrator configure?

Accepted Answer

Configure the third-party IdP to use the 'domain_hint' parameter or implement a discovery service.. When using SAML SSO with multiple domains, the IdP must be configured to route users to the correct login page based on their email domain. This is typically done using the 'domain_hint' parameter or a discovery service. Google Workspace's SSO settings are account-level and do not provide per-domain redirection; the IdP is responsible for this behavior.

Answer

In the Google Admin console, set the primary domain for SSO and add secondary domains as aliases.

Answer

Enable the 'Domain Discovery' feature in the Admin console under Security > SSO.

Answer

Set up a secondary domain and configure SSO for each domain separately.

Question 15

You want to ensure that only managed Chrome devices can access your organization's Google Workspace data. Which tool should you configure to verify the security posture of the device before allowing access?

Accepted Answer

Chrome Endpoint Verification. Endpoint Verification is the tool used to verify device security posture and report it to the Admin console.

Answer

Google Workspace Migrate

Answer

Google Cloud Identity

Answer

Chrome Remote Desktop

Question 16

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

Accepted Answer

Enforce hardware security keys as the only allowed 2-Step Verification method for administrator accounts.. Securing admin accounts involves mandating strict 2SV methods and restricting admin access to known IPs or devices.

Answer

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Answer

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Answer

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Question 17

A security team wants to enforce a policy that only company-managed devices can access Gmail and Drive, while personal devices are denied. Which TWO configurations are required in Google Workspace to implement this using Context-Aware Access? (Choose two.)

Accepted Answer

Assign the access level to the Gmail and Drive applications for the target organizational unit.. Context-Aware Access enforces device-based restrictions through access levels that evaluate device attributes. The two required steps are creating an access level that requires company-owned and approved devices, and then assigning that access level to Gmail and Drive for the target organizational unit. Without both steps, the policy either does not exist or does not apply to the apps, so the restriction would not take effect.

Answer

Configure a sign-in challenge that requires a security key for all users in the organizational unit.

Answer

Deploy a Chrome policy to force users to sign in with their managed Google Account on personal devices.

Answer

Enable 2-Step Verification enforcement for all users in the organizational unit.

Question 18

A user reports that emails are not being sent to an external mailing list. The logs show '550 5.1.1'. What does this code indicate?

Accepted Answer

The recipient address is invalid.. A 550 5.1.1 error code indicates that the recipient address does not exist or is invalid.

Answer

The sender is blocked.

Answer

The message was marked as spam.

Answer

The server is temporarily down.

Question 19

An administrator needs to view a report showing which users in the organization have not enabled 2-Step Verification. Where should the administrator look in the Google Admin console?

Accepted Answer

Reporting > Reports > Security > 2-Step Verification adoption. The correct location is Reporting > Reports > Security > 2-Step Verification adoption. This built-in report provides a list of users who have not enrolled in 2-Step Verification, along with their enrollment status. It is specifically designed to monitor 2SV adoption across the organization.

Answer

Account settings > Security metrics > Export

Answer

Security > Authentication > Dashboard > User status

Answer

Directory > Users > Filter > 2SV Status

Question 20

A school district wants to prevent students from installing any third-party apps that request access to Gmail data. Administrators need to ensure that only pre-approved apps can access Gmail. Which Google Workspace setting should they configure?

Accepted Answer

API controls in Admin console under Security > API Controls > App Access Control.. App Access Control in Admin console allows administrators to restrict which third-party apps can access Google Workspace services like Gmail. By setting Gmail to 'Restricted' and listing trusted apps, administrators can block unapproved apps. This is the correct location for managing OAuth-based access to Workspace data. The other options refer to unrelated security settings.

Answer

Gmail security settings under Apps > Google Workspace > Gmail > Safety.

Answer

OAuth consent screen configuration in Google Cloud Console.

Answer

User security settings under Security > Settings > User Security.