GWS-ADMIN Practice Test 7 — 10 Questions

Question 1

What is the difference between a primary domain and a secondary domain?

Accepted Answer

Primary is the identity foundation for the account. The primary domain is the identity foundation of the Workspace account, used for initial setup and service naming.

Answer

Secondary domains cost more

Answer

Secondary domains do not support OUs

Answer

Primary is for email; secondary is for Drive

Question 2

You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?

Accepted Answer

Account > Account settings. Account settings, including time zone and language, are configured per OU under Account > Account settings.

Answer

Security > General > Account

Answer

Directory > Users > Account settings

Answer

Apps > Google Workspace > Profile

Question 3

Which TWO of the following tasks can be performed in the Users section of the Admin console?

Accepted Answer

Assigning a user to a group. Option A is correct because the Users section of the Admin console allows administrators to assign users to groups, controlling group membership and the permissions that come with it. Option E is correct because resetting a user's password is a core user-management task performed from the Users section, where an admin can set a new password for the account. Options B, C, and D do not belong: domain verification is handled in the Domains section (via a TXT or CNAME record), SMTP relay configuration is done in the Apps/Gmail settings (SMTP relay service), and creating a new domain is also a Domains-section task, not a Users-section task.

Answer

Verifying the domain

Answer

Configuring SMTP relays

Answer

Creating a new domain

Question 4

A company has a Google Workspace account with multiple domains. The administrator needs to ensure that when users sign in with their email address, they are redirected to the correct domain's login page. The company uses SAML SSO with a third-party IdP. Which setting should the administrator configure?

Accepted Answer

Configure the third-party IdP to use the 'domain_hint' parameter or implement a discovery service.. When using SAML SSO with multiple domains, the IdP must be configured to route users to the correct login page based on their email domain. This is typically done using the 'domain_hint' parameter or a discovery service. Google Workspace's SSO settings are account-level and do not provide per-domain redirection; the IdP is responsible for this behavior.

Answer

In the Google Admin console, set the primary domain for SSO and add secondary domains as aliases.

Answer

Enable the 'Domain Discovery' feature in the Admin console under Security > SSO.

Answer

Set up a secondary domain and configure SSO for each domain separately.

Question 5

You want to ensure that only managed Chrome devices can access your organization's Google Workspace data. Which tool should you configure to verify the security posture of the device before allowing access?

Accepted Answer

Chrome Endpoint Verification. Endpoint Verification is the tool used to verify device security posture and report it to the Admin console.

Answer

Google Workspace Migrate

Answer

Google Cloud Identity

Answer

Chrome Remote Desktop

Question 6

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

Accepted Answer

Enforce hardware security keys as the only allowed 2-Step Verification method for administrator accounts.. Securing admin accounts involves mandating strict 2SV methods and restricting admin access to known IPs or devices.

Answer

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Answer

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Answer

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Question 7

A security team wants to enforce a policy that only company-managed devices can access Gmail and Drive, while personal devices are denied. Which TWO configurations are required in Google Workspace to implement this using Context-Aware Access? (Choose two.)

Accepted Answer

Assign the access level to the Gmail and Drive applications for the target organizational unit.. Context-Aware Access enforces device-based restrictions through access levels that evaluate device attributes. The two required steps are creating an access level that requires company-owned and approved devices, and then assigning that access level to Gmail and Drive for the target organizational unit. Without both steps, the policy either does not exist or does not apply to the apps, so the restriction would not take effect.

Answer

Configure a sign-in challenge that requires a security key for all users in the organizational unit.

Answer

Deploy a Chrome policy to force users to sign in with their managed Google Account on personal devices.

Answer

Enable 2-Step Verification enforcement for all users in the organizational unit.

Question 8

A user reports that emails are not being sent to an external mailing list. The logs show '550 5.1.1'. What does this code indicate?

Accepted Answer

The recipient address is invalid.. A 550 5.1.1 error code indicates that the recipient address does not exist or is invalid.

Answer

The sender is blocked.

Answer

The message was marked as spam.

Answer

The server is temporarily down.

Question 9

An administrator needs to view a report showing which users in the organization have not enabled 2-Step Verification. Where should the administrator look in the Google Admin console?

Accepted Answer

Reporting > Reports > Security > 2-Step Verification adoption. The correct location is Reporting > Reports > Security > 2-Step Verification adoption. This built-in report provides a list of users who have not enrolled in 2-Step Verification, along with their enrollment status. It is specifically designed to monitor 2SV adoption across the organization.

Answer

Account settings > Security metrics > Export

Answer

Security > Authentication > Dashboard > User status

Answer

Directory > Users > Filter > 2SV Status

Question 10

A school district wants to prevent students from installing any third-party apps that request access to Gmail data. Administrators need to ensure that only pre-approved apps can access Gmail. Which Google Workspace setting should they configure?

Accepted Answer

API controls in Admin console under Security > API Controls > App Access Control.. App Access Control in Admin console allows administrators to restrict which third-party apps can access Google Workspace services like Gmail. By setting Gmail to 'Restricted' and listing trusted apps, administrators can block unapproved apps. This is the correct location for managing OAuth-based access to Workspace data. The other options refer to unrelated security settings.

Answer

Gmail security settings under Apps > Google Workspace > Gmail > Safety.

Answer

OAuth consent screen configuration in Google Cloud Console.

Answer

User security settings under Security > Settings > User Security.