GWS-ADMIN Practice Test 8 — 10 Questions

Question 1

A Workspace administrator wants to ensure that users in the Sales org unit can only sign in from corporate-managed Chromebooks and Windows devices, and block personal devices from accessing Gmail and Drive. Which enforcement mechanism should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set up a Context-Aware Access access level based on device policy, then assign it to the Sales org unit in the Gmail and Drive apps.. Context-Aware Access is the Workspace feature that evaluates device posture and other signals before granting access to apps. By defining an access level that requires a company-owned, managed device and assigning it to the Sales org unit for Gmail and Drive, the administrator ensures that only corporate Chromebooks and Windows machines can reach those services, while personal devices are denied.

Answer

Enable 2-Step Verification enforcement for the Sales org unit so only users who completed the second factor can sign in.

Answer

Create a Google Group for Sales and apply a Drive sharing restriction to prevent external sharing of files.

Answer

Configure a password policy with a minimum length of 14 characters for the Sales org unit to restrict access from insecure devices.

Question 2

Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?

Accepted Answer

The SAML app service status is set to OFF for the user's organizational unit or access group.. This error occurs when the SAML app is configured in the Google Admin console, but access is turned OFF for the user or their organizational unit.

Answer

The IdP signing certificate has expired.

Answer

The user's password has expired and needs to be reset.

Answer

The user does not have a Google Cloud Platform billing account attached.

Question 3

How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?

Accepted Answer

Set a Gmail retention rule in Google Vault. Google Vault retention rules override user actions — even if a user empties Trash or permanently deletes a message, Vault retains a copy for the configured period. Setting a 3-year retention rule on Gmail messages ensures deleted emails remain discoverable and recoverable for exactly that duration, satisfying legal/regulatory requirements.

Answer

Enable endpoint management

Answer

Use an Admin Console report

Answer

Configure a Gmail filter

Question 4

You are the Workspace administrator for a healthcare company. A new compliance policy requires that all external email sent from your domain be digitally signed so that recipients can verify the messages are genuinely from your organization. You need to configure this in the Google Workspace Admin console. What should you do?

Accepted Answer

Configure DKIM (DomainKeys Identified Mail) in the Admin console under Apps > Google Workspace > Gmail > Authenticate email, and publish the public key in DNS.. DKIM is the email authentication method that adds a digital signature to outgoing messages, allowing recipients to verify the message was sent by your domain and was not altered. Enabling DKIM in the Admin console and publishing the public key in DNS is the standard way to meet a requirement for digitally signed external email. SPF and DMARC are policy and validation mechanisms but do not sign messages, and S/MIME requires per-user certificates and does not automatically sign all outbound mail.

Answer

Enable DMARC (Domain-based Message Authentication, Reporting & Conformance) by adding a TXT record to your DNS with a policy of p=reject.

Answer

Enable S/MIME for Gmail in the Admin console under Apps > Google Workspace > Gmail > User settings, and upload a root certificate.

Answer

Set up SPF (Sender Policy Framework) by adding a TXT record to your domain's DNS that lists authorized sending IP addresses.

Question 5

Your organization has a policy that all Google Drive files must be owned by the organization, not by individual users. A user creates a new Google Doc and shares it with an external collaborator. You need to ensure that the file remains owned by the organization even if the user leaves. What should you do?

Accepted Answer

Set up a shared drive and enforce that all new files are created in it.. Shared drives are owned by the organization, not by individual users. By enforcing that files are created in shared drives, you ensure that ownership remains with the organization even if the user leaves. This is the most effective way to meet the policy requirement.

Answer

Enable Google Drive ownership transfer for all users.

Answer

Configure Google Vault to retain all files indefinitely.

Answer

Enable Drive File Stream for all users.

Question 6

Your company has a regulatory requirement to retain all Gmail messages sent by employees for exactly seven years, after which they must be permanently deleted. You need to enforce this automatically without user intervention. What should you configure?

Accepted Answer

A Google Vault retention rule for Gmail with a custom retention period of 7 years and an action to permanently delete messages after the period.. Google Vault retention rules are the correct tool for enforcing data retention policies across Google Workspace. You can create a custom rule for Gmail that retains messages for seven years and then permanently deletes them. This ensures compliance without relying on user actions. Other options either do not enforce deletion, lack central control, or are not designed for retention lifecycle management.

Answer

A Gmail content compliance rule that routes messages to a third-party archive and deletes them from Gmail after 7 years.

Answer

A Gmail user setting that automatically deletes messages older than 7 years from the inbox.

Answer

A Google Workspace default retention policy in Vault that retains all Gmail data indefinitely.

Question 7

Your company's security team wants to ensure that all outgoing email from your Google Workspace domain is authenticated so that external recipients can verify it. They ask you to check the current email authentication configuration for the domain. Where should you look in the Google Workspace Admin console to review and manage these settings?

Accepted Answer

Apps > Google Workspace > Gmail > Authenticate email (DKIM). Email authentication for a Google Workspace domain centers on SPF, DKIM, and DMARC. The Admin console provides DKIM management under Apps > Google Workspace > Gmail > Authenticate email, where you can generate and rotate the DKIM key. SPF and DMARC are configured in DNS. The other listed locations deal with compliance rules, account security, or user access, none of which contain the authentication settings the security team needs.

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Account settings > Security

Answer

Apps > Google Workspace > Gmail > End User Access

Question 8

A healthcare organization must comply with HIPAA and wants to ensure that Google Workspace data is protected against insider threats. The security team needs to monitor and alert on suspicious user behavior, such as mass downloads of Drive files and unusual login locations. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable and configure Security Center's investigation tool to create activity rules that trigger alerts on mass download events.. To monitor and alert on suspicious user behavior, the administrator should use Security Center's investigation tool to create activity rules for mass downloads and configure Admin console alerts for unusual login locations. These two actions provide the necessary detection and alerting capabilities. Other options, while important for security, do not directly address the monitoring and alerting requirements for insider threats.

Answer

Use Google Vault to set retention policies that prevent data deletion.

Answer

Configure Data Loss Prevention (DLP) rules to block sharing of sensitive files externally.

Answer

Enforce 2-Step Verification for all users to prevent unauthorized access.

Question 9

An employee lost their company-issued Android device. What is the most effective way to secure the data?

Accepted Answer

Use the 'Wipe device' command in the Admin console. Performing a 'Wipe account' or 'Wipe device' command removes corporate data or everything from the device remotely.

Answer

Disable the user's account in Active Directory

Answer

Change the user's password

Answer

Send an email to the employee to delete the data

Question 10

Your organization has a policy that employees must not be able to download Google Drive files on unmanaged devices. You have already set up Context-Aware Access with an access level that requires managed devices. However, users report they can still download files from Drive on personal devices. What is the most likely reason?

Accepted Answer

The access level only blocks access to Drive, but does not prevent downloading files once access is granted.. Context-Aware Access controls whether a user can access a service like Google Drive based on device context, but it does not manage what actions a user can perform once access is granted. To prevent downloads on unmanaged devices, administrators must also configure Drive sharing settings to disable download, print, and copy for users accessing from unmanaged devices. The most likely reason users can still download is that the access level permits access, and download restrictions are not separately enforced.

Answer

Users are bypassing Context-Aware Access by using the Google Drive mobile app, which is exempt from these policies.

Answer

Context-Aware Access does not apply to Google Drive; it only applies to Gmail and Google Meet.

Answer

The access level is not assigned to the correct organizational unit; it must be assigned to the root OU to take effect.