GWS-ADMIN Practice Questions 2 — 50 Questions

Question 1

Which THREE security settings are commonly configured using Context-Aware Access?

Accepted Answer

Device security posture (e.g., screen lock). Context-aware access allows restricting access to apps based on device security posture, IP, and location.

Answer

Email signature format

Answer

User password strength

Question 2

You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?

Accepted Answer

Security > Access and data control > API controls > Manage domain-wide delegation. For service accounts performing domain-wide delegation, scopes must be defined in the Security > Access and data control > API controls > Manage domain-wide delegation section.

Answer

Account > Security > App access

Answer

Directory > Users > Service Accounts

Answer

Apps > Google Workspace > Gmail > API

Question 3

Which TWO of the following are prerequisites for setting up iOS device management?

Accepted Answer

Apple Push Certificate. An Apple Push Certificate and Advanced Mobile Management are required to manage iOS devices effectively.

Answer

Physical access to each device

Answer

A custom domain name

Answer

Android Enterprise registration

Question 4

Your organization requires that all iOS devices accessing corporate data be encrypted and have a passcode. You have enabled Google Mobile Management. Which configuration setting should you verify in the Google Admin console to ensure all devices enforce these policies?

Accepted Answer

Configure iOS password requirements in Mobile & endpoints > Settings > iOS. The 'Password requirements' setting under Device > Mobile & endpoints > Settings > iOS ensures that MDM-enforced policies apply to the device.

Answer

Use the Google Cloud Directory Sync tool

Answer

Set up Basic mobile management

Answer

Enable Chrome browser management for iOS

Question 5

You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?

Accepted Answer

Account > Account settings. Account settings, including time zone and language, are configured per OU under Account > Account settings.

Answer

Security > General > Account

Answer

Directory > Users > Account settings

Answer

Apps > Google Workspace > Profile

Question 6

Your organization wants to ensure that all outgoing mail is routed through a third-party email security gateway for scanning. What is the correct configuration?

Accepted Answer

Apps > Google Workspace > Gmail > Routing. Outbound routing is configured in Apps > Google Workspace > Gmail > Routing by setting an outbound gateway.

Answer

Security > Compliance > Gateway

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Network > SMTP relay

Question 7

A user is seeing an 'Unable to verify account' error when signing in. What is the first thing to check?

Accepted Answer

Account suspension status. Checking if the account is suspended in the Admin console is the most common reason for this error.

Answer

User's password

Answer

Domain's DNS records

Answer

User's mobile phone number

Question 8

Your security team requires that all administrators must use a hardware security key (FIDO2) for 2-Step Verification and are prohibited from using SMS or phone prompts. Where can you enforce this requirement specifically for admin accounts?

Accepted Answer

Security > Admin security > Enforce 2-Step Verification and specify security keys.. Admin security policies, including strict 2SV methods for administrators, are configured under Security > Admin security.

Answer

Directory > Admin roles > Security policies

Answer

Security > Authentication > 2-step verification > Allow only security keys for administrators

Answer

Account settings > Administrator privileges > Authentication

Question 9

A new employee needs access to Google Workspace. What is the minimum action required in the Google Admin console to create the account?

Accepted Answer

Add a user and assign a Google Workspace license. Creating a user in the Admin console requires defining a primary email address and assigning a license for access.

Answer

Assign a Google Groups membership

Answer

Configure an alias

Answer

Create an organizational unit

Question 10

What is the difference between a primary domain and a secondary domain?

Accepted Answer

Primary is the identity foundation for the account. The primary domain is the identity foundation of the Workspace account, used for initial setup and service naming.

Answer

Secondary domains cost more

Answer

Secondary domains do not support OUs

Answer

Primary is for email; secondary is for Drive

Question 11

You have a mix of company-owned and BYOD mobile devices. You want to apply different policies to each. What is the recommended strategy?

Accepted Answer

Create two separate OUs and apply different mobile settings to each. Using different Organizational Units (OUs) allows you to apply different MDM policies to different groups of devices or users.

Answer

Create a Google Group and apply policies to the group

Answer

Use a third-party MDM for the BYOD devices only

Answer

Create a single OU and use groups for individual device settings

Question 12

You are configuring a 'Work profile' for Android. What is the primary benefit of this setup?

Accepted Answer

It separates work data and apps from personal data on the same device. Work profiles isolate work data from personal data, ensuring privacy for the user and security for the company.

Answer

It allows the company to see all personal messages

Answer

It prevents the user from taking photos

Answer

It forces the user to use a specific launcher

Question 13

You want to ensure that only managed Chrome devices can access your organization's Google Workspace data. Which tool should you configure to verify the security posture of the device before allowing access?

Accepted Answer

Chrome Endpoint Verification. Endpoint Verification is the tool used to verify device security posture and report it to the Admin console.

Answer

Google Workspace Migrate

Answer

Google Cloud Identity

Answer

Chrome Remote Desktop

Question 14

Which THREE of the following are valid ways to manage Google Calendar resource availability?

Accepted Answer

Auto-accept invitations. Resources are managed via building assignment, auto-accept rules, and visibility settings.

Answer

Enable recurring meeting limits

Answer

Restrict resource access by device type

Question 15

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 16

You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?

Accepted Answer

Context-Aware Access access levels referencing IP subnets and device policy compliance, assigned to targeted apps.. Context-Aware Access allows you to combine IP address subnets and device-policy compliance (corporate-owned status via endpoint management) to control access.

Answer

Google Cloud IAM conditions with Context-Aware Access and Security Health Analytics

Answer

Domain-wide SAML SSO with custom attribute mapping for IP addresses

Answer

Advanced Protection Program combined with Context-Aware Access

Question 17

A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?

Accepted Answer

The Admin console audit log for mobile management. The device audit log provides the necessary visibility into whether a command was successfully executed by the server and acknowledged by the device.

Answer

The Google Cloud Platform logs

Answer

The user's account status in the directory

Answer

The user's Gmail sent items

Question 18

Which THREE of the following attributes can be used in Context-Aware Access policies?

Accepted Answer

OS version. Device management status, encryption, and OS version are commonly used in access policies.

Answer

User's favorite browser

Answer

User's physical GPS location

Question 19

A user has left the company. You need to ensure all corporate data is removed from their Android device, but you want to keep their personal data intact. Which action should you take?

Accepted Answer

Select 'Wipe account' from the device details page. A 'Work wipe' removes only the work profile and corporate data from the device, leaving personal data untouched.

Answer

Disable the user's account in the Admin console

Answer

Remove the device from the domain

Answer

Perform a Factory reset

Question 20

Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?

Accepted Answer

Configure SSO profile assignment to exclude Super Administrators or use the 'Allow users to sign in with Google password' option on the SSO profile page.. Google Workspace allows you to configure a secondary SSO profile or enable network/admin bypass settings to allow admin sign-in via Google credentials.

Answer

Disable SAML SSO entirely and rely exclusively on Google's built-in OAuth service.

Answer

Enable the 'Turn on SSO for administrative accounts' option and assign a backup password.

Answer

Create a Context-Aware Access rule that triggers emergency recovery mode when the IdP IP is unreachable.