GWS-ADMIN Practice Test 7 — 10 Questions

Question 1

You have a mix of company-owned and BYOD mobile devices. You want to apply different policies to each. What is the recommended strategy?

Accepted Answer

Create two separate OUs and apply different mobile settings to each. Using different Organizational Units (OUs) allows you to apply different MDM policies to different groups of devices or users.

Answer

Create a Google Group and apply policies to the group

Answer

Use a third-party MDM for the BYOD devices only

Answer

Create a single OU and use groups for individual device settings

Question 2

You are configuring a 'Work profile' for Android. What is the primary benefit of this setup?

Accepted Answer

It separates work data and apps from personal data on the same device. Work profiles isolate work data from personal data, ensuring privacy for the user and security for the company.

Answer

It allows the company to see all personal messages

Answer

It prevents the user from taking photos

Answer

It forces the user to use a specific launcher

Question 3

You want to ensure that only managed Chrome devices can access your organization's Google Workspace data. Which tool should you configure to verify the security posture of the device before allowing access?

Accepted Answer

Chrome Endpoint Verification. Endpoint Verification is the tool used to verify device security posture and report it to the Admin console.

Answer

Google Workspace Migrate

Answer

Google Cloud Identity

Answer

Chrome Remote Desktop

Question 4

Which THREE of the following are valid ways to manage Google Calendar resource availability?

Accepted Answer

Auto-accept invitations. Resources are managed via building assignment, auto-accept rules, and visibility settings.

Answer

Enable recurring meeting limits

Answer

Restrict resource access by device type

Question 5

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 6

You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?

Accepted Answer

Context-Aware Access access levels referencing IP subnets and device policy compliance, assigned to targeted apps.. Context-Aware Access allows you to combine IP address subnets and device-policy compliance (corporate-owned status via endpoint management) to control access.

Answer

Google Cloud IAM conditions with Context-Aware Access and Security Health Analytics

Answer

Domain-wide SAML SSO with custom attribute mapping for IP addresses

Answer

Advanced Protection Program combined with Context-Aware Access

Question 7

A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?

Accepted Answer

The Admin console audit log for mobile management. The device audit log provides the necessary visibility into whether a command was successfully executed by the server and acknowledged by the device.

Answer

The Google Cloud Platform logs

Answer

The user's account status in the directory

Answer

The user's Gmail sent items

Question 8

Which THREE of the following attributes can be used in Context-Aware Access policies?

Accepted Answer

OS version. Device management status, encryption, and OS version are commonly used in access policies.

Answer

User's favorite browser

Answer

User's physical GPS location

Question 9

A user has left the company. You need to ensure all corporate data is removed from their Android device, but you want to keep their personal data intact. Which action should you take?

Accepted Answer

Select 'Wipe account' from the device details page. A 'Work wipe' removes only the work profile and corporate data from the device, leaving personal data untouched.

Answer

Disable the user's account in the Admin console

Answer

Remove the device from the domain

Answer

Perform a Factory reset

Question 10

Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?

Accepted Answer

Configure SSO profile assignment to exclude Super Administrators or use the 'Allow users to sign in with Google password' option on the SSO profile page.. Google Workspace allows you to configure a secondary SSO profile or enable network/admin bypass settings to allow admin sign-in via Google credentials.

Answer

Disable SAML SSO entirely and rely exclusively on Google's built-in OAuth service.

Answer

Enable the 'Turn on SSO for administrative accounts' option and assign a backup password.

Answer

Create a Context-Aware Access rule that triggers emergency recovery mode when the IdP IP is unreachable.