GWS-ADMIN Practice Test 9 — 10 Questions

Question 1

Your organization uses Google Workspace and wants to enforce context-aware access for users accessing Gmail from desktop browsers. You need to ensure that only company-owned Windows devices with up-to-date OS patches and encrypted drives are allowed. Which two components are required to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Context-Aware Access access level with conditions for device ownership and encryption.. To enforce Context-Aware Access based on device attributes like ownership, encryption, and OS version, you need the Endpoint Verification extension to gather those attributes and an access level that specifies the conditions. These two components work together to allow or deny access to Gmail from desktop browsers.

Answer

Install the Google Credential Provider for Windows on all company-owned devices.

Answer

Set up a Windows device policy in the Admin console to enforce OS updates and encryption.

Answer

Enable advanced mobile management for Windows devices.

Question 2

Your organization allows employees to use personal iOS devices for work. You need to ensure that when a user adds their corporate Google Workspace account to the native iOS Mail app, the device is automatically enrolled in advanced mobile management and a passcode is enforced. What should you do?

Accepted Answer

Enable 'Advanced' mobile management for iOS in the Admin console under Devices > Mobile & endpoints > Settings > Universal settings.. Advanced mobile management for iOS, when enabled for an organizational unit, automatically enrolls personal iOS devices when the user adds a managed Google Workspace account to the native iOS Mail app. This enrollment enforces passcode and encryption policies without requiring the user to install a separate app. It is the designated method for securing BYOD iOS devices in Google Workspace.

Answer

Deploy the Google Device Policy app to all iOS devices via a third-party EMM provider.

Answer

Create a device policy in the Admin console under Devices > Mobile & endpoints > Devices and manually add each iOS device.

Answer

Configure a Context-Aware Access access level that requires a passcode and apply it to the Gmail service.

Question 3

A user reports that their company-owned Android device is not receiving work emails. You check the Admin console and see that the device is listed but the status is 'Pending'. What should you do first?

Accepted Answer

Ask the user to open the Google Device Policy app and complete enrollment.. A 'Pending' device status means the enrollment process was initiated but not completed. The user must open the Google Device Policy app and finish the steps to enroll the device. This app is essential for advanced mobile management and applies the necessary policies. Once enrollment is complete, the device status changes to 'Approved' or similar, and work email will begin syncing. Other actions like re-enrolling or checking licenses are not appropriate first steps.

Answer

Check if the user has exceeded their license limit.

Answer

Verify that the device has an active internet connection.

Answer

Remove the device from the Admin console and re-enroll it.

Question 4

You are the Google Workspace administrator for a company with 5,000 users. The HR department needs to update the 'Department' and 'Manager' fields for all users. They will provide a CSV file. You want to minimize manual effort and ensure the updates are applied correctly. Which method should you use?

Accepted Answer

Use the Google Workspace Admin console's bulk upload feature with a CSV file.. The Admin console provides a bulk upload feature that accepts CSV files to update user profiles in bulk. This is the most efficient method for applying a large set of updates from HR. It directly targets standard fields like Department and Manager, avoiding the need for scripting or manual edits. Other methods either do not scale or target the wrong data fields.

Answer

Use Google Cloud Directory Sync (GCDS) to synchronize the HR database with Google Workspace.

Answer

Use the Directory API to update each user's custom attributes via a script.

Answer

Use the Google Admin console to edit each user's profile individually.

Question 5

A Workspace administrator receives reports that several users in the sales organizational unit cannot sign in to their accounts from newly issued corporate Android devices. The users can sign in successfully from their laptops. The administrator has already confirmed the users' passwords are correct and that no account suspensions are in place. Which TWO of the following should the administrator check to resolve the mobile sign-in failures? (Choose two.)

Accepted Answer

Whether a Google Context-Aware Access access level assigned to the sales OU blocks devices that do not meet device trust requirements.. Sign-in failures that affect only mobile devices while laptops work often point to conditional access or network restrictions. Context-Aware Access access levels can deny devices that lack required security attributes, and IP allowlists can block devices outside approved networks. Both settings can be scoped to an organizational unit and produce exactly the pattern described. Reviewing these two configurations for the sales OU is the most efficient path to resolution.

Answer

Whether the users' Gmail IMAP access is disabled for the sales OU, preventing mobile mail clients from authenticating.

Answer

Whether the sales OU has a password policy that forces a password change on next sign-in for mobile clients only.

Answer

Whether the sales OU has a session length policy that signs users out of mobile apps every hour.

Question 6

A helpdesk administrator needs to reset passwords for users in the Sales organizational unit but must not be able to reset passwords for users in the Finance organizational unit. The helpdesk admin already has a custom role with the 'Users: Reset password' privilege. What should you do to restrict the role's scope to only the Sales organizational unit?

Accepted Answer

Assign the custom role to the helpdesk admin at the Sales organizational unit level in the Admin console.. Administrative privileges in Google Workspace are scoped by organizational unit. When a custom role is assigned at the Sales organizational unit, the admin can perform the included actions only on users within that OU. This allows granular delegation, such as letting helpdesk reset passwords for Sales but not Finance. Assigning the role at the root would grant domain-wide access, so the OU-level assignment is essential.

Answer

Create an access group containing only Sales users and assign the custom role to that group, then remove the helpdesk admin from all other groups.

Answer

Use the 'Delegated admin' setting to specify that the helpdesk admin can only manage users whose last name starts with a letter in the range A-M.

Answer

Create a new organizational unit named 'Sales-Helpdesk' and move the helpdesk admin into it, then assign the role at the root level.

Question 7

You are the Workspace administrator for a company that has just acquired a smaller business. The acquired business currently uses its own Google Workspace account with the domain 'acme-parts.com'. Your leadership team wants users from 'acme-parts.com' to appear in the same Global Directory as your primary domain 'yourcompany.com' and to share Google Workspace services, but they must keep sending and receiving email using '@acme-parts.com' addresses. You have already added and verified 'acme-parts.com' as a secondary domain in your Admin console. What should you do next to meet these requirements?

Accepted Answer

Create user accounts with @acme-parts.com addresses in the yourcompany.com account, and stop paying for the acquired business's old Workspace subscription.. Once a secondary domain is verified, users can be created directly on that domain inside the same Workspace account, giving them distinct @acme-parts.com identities that share the directory and services. A domain alias cannot provide separate mailboxes or sign-in identities, and keeping a separate tenant or swapping the primary domain fails the goal of a unified directory with preserved email addresses.

Answer

Leave the acquired business on its own separate Google Workspace account and configure mail routing between the two tenants.

Answer

Convert 'acme-parts.com' into the primary domain of your account and move 'yourcompany.com' to a secondary domain.

Answer

Configure 'acme-parts.com' as a domain alias of 'yourcompany.com' so that every existing user can receive mail sent to the alias and send as the alias address.

Question 8

A Google Workspace administrator is troubleshooting an issue with Google Groups. A user reports that they are not receiving email sent to a group they are a member of. The administrator checks the group's settings and confirms that the user is a direct member with 'Email' subscription. The group's access settings allow external senders. The administrator also verifies that the group's email address is correct and that messages are not being caught by spam filters. Which is the MOST likely cause of the user not receiving group emails?

Accepted Answer

The user has a filter in Gmail that archives or deletes messages from the group's email address.. When group settings and spam filters are ruled out, the next likely cause is a Gmail filter in the user's mailbox that archives or deletes messages from the group. The administrator should check the user's Gmail settings under Filters and Blocked Addresses. If a filter exists, it should be modified or removed. This is a common oversight because filters operate silently and can affect specific senders.

Answer

The user's Google Workspace account is not authorized to receive email from external senders due to a compliance rule.

Answer

The group's email address is configured to forward to a different address, and the user is not included in the forwarding list.

Answer

The group's membership is set to 'Direct members' only, and the user is actually a member via a nested group.

Question 9

An organization uses Google Cloud Directory Sync (GCDS) to keep its Workspace directory aligned with an on-premises LDAP directory. The administrator must ensure that local directory attributes map correctly and that deletes in the source system do not accidentally wipe out Workspace accounts and their data, while still allowing legitimate departures to be processed. Which two configuration practices should the administrator apply? (Choose two.)

Accepted Answer

Enable the option to suspend rather than delete users removed from the source directory.. Exclusion rules keep designated accounts out of the sync scope so they are never modified or deleted, and the suspend-instead-of-delete option preserves data when a source account disappears. Together these practices prevent accidental data loss while still allowing legitimate departures to be reflected as suspended accounts.

Answer

Map every LDAP attribute to a corresponding Workspace field to avoid missing data.

Answer

Grant the sync service account the Super Admin role to avoid permission errors during synchronization.

Answer

Configure the sync to run continuously in real time so attribute changes propagate instantly.

Question 10

An organization wants to prevent users from signing in to their Google Workspace accounts from outside their home country. Which feature should the administrator configure?

Accepted Answer

Context-Aware Access. Context-Aware Access allows administrators to define access levels based on attributes such as IP address, device type, and user identity, and apply them to Google Workspace apps. By configuring an access level that restricts access to the organization's home country IP ranges, the admin can block sign-ins from outside that country.

Answer

Data Region Policy

Answer

Advanced Protection Program

Answer

Password Monitoring