GWS-ADMIN Practice Test 6 — 10 Questions

Question 1

You want to ensure that users cannot change their profile photo. Where is this setting located?

Accepted Answer

Account > Account settings > Profile editing. The setting to prevent users from changing their profile photo is located under Account > Account settings > Profile editing. In the Google Admin console, this section contains controls for what users can edit in their directory profile, including photo, name, and other fields. Disabling photo editing here enforces the restriction.

Answer

Security > Account settings

Answer

Directory > Users > Permissions

Answer

Apps > Google Workspace > Directory

Question 2

Where do you go to view a list of all devices currently accessing your organization's data?

Accepted Answer

Devices > Mobile & endpoints > Devices. The 'Devices' section in the Admin console provides a centralized view of all mobile and desktop devices.

Answer

Reports > Audit > Mobile

Answer

Directory > Users > Device list

Answer

Security > Devices

Question 3

Where can an administrator view the status of a user's 2-Step Verification enrollment?

Accepted Answer

Directory > Users > [User] > Security. User security information, including 2SV status, is found in the individual user's profile within the Directory.

Answer

Security > Authentication > 2SV

Answer

Reports > Audit > Security

Answer

Account > Security Dashboard

Question 4

An administrator mistakenly deleted a user account 10 days ago. How can you restore this account?

Accepted Answer

Use the Restore User tool in the Admin console. Deleted users can be restored within 20 days via the Admin console.

Answer

Contact Google Support for data recovery

Answer

Restore from a Vault export

Answer

Create a new user with the same email

Question 5

Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?

Accepted Answer

SAML Single Logout (SLO) URL configuration in the SSO profile.. Single Logout (SLO) allows users to terminate their session across both Google Workspace and the configured SAML IdP.

Answer

Context-Aware Access session termination

Answer

OAuth token revocation API

Answer

Automated user provisioning via SCIM

Question 6

Which THREE settings can be enforced on Android devices using Advanced mobile management?

Accepted Answer

Managed application deployment. Advanced management allows for mandatory passcodes, managed applications, and remote wipe capabilities.

Answer

Enable the device's GPS tracking

Answer

Force an OS update

Question 7

You need to add a secondary domain to your Google Workspace account. What must you perform after adding the domain in the Admin console?

Accepted Answer

Verify domain ownership. Verification is mandatory to prove domain ownership via DNS records.

Answer

Create a new OU

Answer

Set up SPF records

Answer

Provision user accounts

Question 8

You are automating user creation via the Directory API. Which scope is required to create users?

Accepted Answer

https://www.googleapis.com/auth/admin.directory.user. The admin.directory.user scope is required for CRUD operations on user objects.

Answer

https://www.googleapis.com/auth/admin.reports.audit.readonly

Answer

https://www.googleapis.com/auth/admin.directory.group

Answer

https://www.googleapis.com/auth/admin.directory.domain.readonly

Question 9

Your organization uses a third-party Identity Provider (IdP) for SSO. Users are reporting that they cannot sign in. Where do you verify the SAML configuration?

Accepted Answer

Security > Authentication > SSO with third-party IdP. SAML configuration for third-party providers is managed in Security > Authentication > SSO with third-party IdP.

Answer

Apps > Web and mobile apps

Answer

Directory > Users

Answer

Account > Domain settings

Question 10

Your company has a mix of ChromeOS devices and Windows laptops. You want to ensure that only devices that are company-owned and enrolled in your domain can access Google Workspace. You have already set up Context-Aware Access with an access level that requires the device to be company-owned. However, users on Windows laptops are still able to access Workspace from personal devices. What is the most likely cause?

Accepted Answer

Windows devices are not reporting the company-owned attribute because Endpoint Verification does not collect that attribute. The company-owned attribute is not natively collected by Endpoint Verification on unmanaged Windows devices. To have this attribute, the device must be enrolled in a management system that reports ownership, such as GCPW with device management or a third-party UEM integrated with Google. Without that, the attribute is missing, and the access level may not enforce as expected.

Answer

The access level is not applied to the correct organizational units

Answer

The access level requires the device to be encrypted, which is not supported on Windows

Answer

ChromeOS devices are inherently trusted, so the access level only applies to them