GWS-ADMIN Core Workspace Services Practice Test 3 — 15 Questions

Question 1

A user in your organization reports that they cannot add a Google Meet link to a Calendar event because the option is missing. You verify that the user has a Google Workspace license that includes Meet. Where should you check to ensure that Meet links can be automatically added to Calendar events for this user?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the Google Admin console, go to Apps > Google Workspace > Calendar > Calendar settings and verify that "Automatically add Google Meet video calls to events" is enabled.. The Calendar service settings contain the control for automatically adding Google Meet links to events. Enabling that setting restores the option for users in the organizational unit. Other locations either control unrelated sharing features or are not where the Meet-Calendar integration is configured.

Answer

In the Google Admin console, go to Apps > Google Workspace > Drive and Docs > Sharing settings and enable "Allow users to use Google Meet".

Answer

In the Google Admin console, go to Apps > Google Workspace > Google Meet > Meet settings and ensure that "Let users add Meet video calls to Calendar events" is enabled.

Answer

In the Google Admin console, go to Apps > Google Workspace > Calendar > Sharing settings and verify that video conferencing is enabled.

Question 2

You are the Workspace administrator at Contoso. The security team wants to prevent users from installing any Google Workspace Marketplace app that requests access to Gmail data. You need to enforce this for all users in the organization. What should you do?

Accepted Answer

In the Google Admin console, go to Apps > Google Workspace Marketplace apps > App access control and set the Gmail service to "Trusted" and add only approved apps to the trusted list.. The App access control setting for Gmail allows you to specify which apps are trusted to access Gmail. By setting it to Trusted and adding only approved apps, you prevent users from installing any other Marketplace app that requests Gmail access. This meets the security team's requirement without over-restricting all Gmail access.

Answer

In the Google Admin console, go to Apps > Google Workspace Marketplace apps > Settings and enable "Allow users to install apps" only for trusted apps.

Answer

In the Google Admin console, go to Apps > Google Workspace > Gmail > User settings and disable "Allow users to grant Gmail access to third-party apps".

Answer

In the Google Admin console, go to Apps > Google Workspace Marketplace apps > App access control and set the Gmail service to "Restricted" for all users.

Question 3

Your organization has a policy that all email sent to external recipients must be encrypted using S/MIME. You need to enforce this for all users in the sales department. What should you do?

Accepted Answer

Enable S/MIME in the Gmail advanced settings for the sales organizational unit and upload the root certificate.. To enforce S/MIME encryption for outgoing messages, you must enable S/MIME in the Gmail advanced settings for the specific organizational unit and upload the root certificate. This ensures that all messages sent by users in that OU are encrypted and that recipients' certificates are trusted.

Answer

Configure a compliance rule in Gmail to reject messages that are not encrypted with S/MIME.

Answer

Set up a hosted S/MIME certificate in the Google Admin console under Security > Authentication > S/MIME.

Answer

Use the Gmail API to programmatically encrypt all outgoing messages with S/MIME.

Question 4

Which setting allows you to see what files are being shared externally across your entire domain?

Accepted Answer

Security Investigation Tool. The Security Investigation Tool is the correct setting because it allows admins to search across all Drive files in the domain and filter by sharing visibility, including externally shared files. It provides a domain-wide view of file sharing activity and is the only surface that supports querying external sharing at scale. This is the tool designed for security investigations and reporting on sharing exposure.

Answer

Drive Audit Log

Answer

Apps > Google Workspace > Drive > Sharing audit

Answer

Report > User Reports > Drive

Question 5

You need to prevent users from sharing Google Drive files with people outside the organization. Which setting should you modify?

Accepted Answer

Apps > Google Workspace > Drive and Docs > Sharing settings. In the Google Workspace Admin console, the setting to control external sharing for Google Drive is found under Apps > Google Workspace > Drive and Docs > Sharing settings. This section allows administrators to set policies such as preventing users from sharing files outside the organization. Modifying this setting enforces the restriction at the organizational unit level.

Answer

Directory > Users > Sharing

Answer

Account > Organizational units > Restrictions

Answer

Security > Access and data control > Drive

Question 6

Your organization requires that all Google Meet recordings be saved to a specific shared folder. How can you automate this?

Accepted Answer

It is not possible to change the default location via Admin Console settings. Google Meet recordings are saved to the meeting organizer's Drive by default, and the Admin Console does not provide a setting to redirect recordings to a specific shared folder. Admins can control whether recordings are allowed and who can record, but the storage location is determined by the organizer's Drive. To centralize recordings, organizations must use Drive sharing or a third-party tool, not an Admin Console path setting.

Answer

Set the 'Default storage' path in Apps > Google Workspace > Meet

Answer

Configure the 'Recording location' in Meet settings

Answer

Create a Drive retention policy for Meet

Question 7

You want to ensure that users cannot change their profile photo. Where is this setting located?

Accepted Answer

Account > Account settings > Profile editing. The setting to prevent users from changing their profile photo is located under Account > Account settings > Profile editing. In the Google Admin console, this section contains controls for what users can edit in their directory profile, including photo, name, and other fields. Disabling photo editing here enforces the restriction.

Answer

Security > Account settings

Answer

Directory > Users > Permissions

Answer

Apps > Google Workspace > Directory

Question 8

You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?

Accepted Answer

Security > Access and data control > API controls > Manage domain-wide delegation. For service accounts performing domain-wide delegation, scopes must be defined in the Security > Access and data control > API controls > Manage domain-wide delegation section.

Answer

Account > Security > App access

Answer

Directory > Users > Service Accounts

Answer

Apps > Google Workspace > Gmail > API

Question 9

You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?

Accepted Answer

Account > Account settings. Account settings, including time zone and language, are configured per OU under Account > Account settings.

Answer

Security > General > Account

Answer

Directory > Users > Account settings

Answer

Apps > Google Workspace > Profile

Question 10

Where can an administrator view the status of a user's 2-Step Verification enrollment?

Accepted Answer

Directory > Users > [User] > Security. User security information, including 2SV status, is found in the individual user's profile within the Directory.

Answer

Security > Authentication > 2SV

Answer

Reports > Audit > Security

Answer

Account > Security Dashboard

Question 11

Which report would you use to identify users who haven't logged in for more than 30 days?

Accepted Answer

Reports > User Reports > User accounts. The report to identify users who haven't logged in for more than 30 days is found under Reports > User Reports > User accounts. This report provides a list of user accounts with their last login time, allowing you to filter by inactivity. It is the designated place for user account activity metrics.

Answer

Reports > Security > Login

Answer

Apps > Google Workspace > Reports

Answer

Directory > Users > Account status

Question 12

Which TWO of the following are valid methods to audit file access in Google Drive?

Accepted Answer

Use the Security Investigation Tool. Option C is correct because the Security Investigation Tool in the Google Admin console lets admins run targeted searches on Drive log events (e.g., by user, file, or event type such as view, download, or share) to audit file access across the organization. Option D is correct because the Drive Audit log under Reports > Audit in the Admin console records Drive activity events, including who accessed, viewed, downloaded, or shared files, providing the standard audit trail for file access. Option A is not a file-access auditing method; Google Vault is used for retention, legal holds, and eDiscovery exports, not for routine access auditing. Option B is incorrect because alerts for file deletions only notify on deletion events and do not provide a general audit of file access. Option E is incorrect because a user's 'My Drive' settings control personal sharing and storage preferences, not administrative auditing of access.

Answer

Enable Google Vault for Drive exports

Answer

Set up alerts for all file deletions

Answer

Check the user's 'My Drive' settings

Question 13

Which THREE settings can be configured within the Gmail Compliance section?

Accepted Answer

Content compliance. In the Google Admin console, the Gmail Compliance section (Apps > Google Workspace > Gmail > Compliance) provides rules for inspecting and acting on messages, and it includes Content compliance (A), which lets admins define rules that match message content, headers, or attachments and then route, quarantine, or reject them. It also includes Attachment compliance (D), which applies policies specifically to attachments based on file type, name, or size, such as blocking or quarantining messages with certain files. Profanity check (B) is likewise a configurable compliance rule that scans message content against a predefined or custom word list and can block, quarantine, or route offending messages. SPF record generation (C) is not part of Gmail compliance; SPF is a DNS TXT record configured in domain DNS settings, not in the Gmail Compliance UI. Default signature settings (E) are configured under Gmail > General settings (or per-user signatures), not within the Compliance section.

Answer

SPF record generation

Answer

Default signature settings

Question 14

Your organization wants to ensure that all outgoing mail is routed through a third-party email security gateway for scanning. What is the correct configuration?

Accepted Answer

Apps > Google Workspace > Gmail > Routing. Outbound routing is configured in Apps > Google Workspace > Gmail > Routing by setting an outbound gateway.

Answer

Security > Compliance > Gateway

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Network > SMTP relay

Question 15

Which TWO of the following can be configured in the Google Workspace Admin Console to restrict user access to Google Drive?

Accepted Answer

Restrict sharing settings for external domains. Option A is correct because the Admin console's Drive and Docs sharing settings let you restrict how users can share files outside your domain, such as turning off external sharing or limiting it to whitelisted domains, which directly restricts user access to Drive content. Option E is correct because Drive can be turned ON or OFF per Organizational Unit (or group), so disabling Drive for a specific OU prevents those users from accessing Drive entirely. Option B is not a Drive access control; file creation counts are governed by storage quotas, not a per-user file-count limit in the Admin console. Option C is not configurable as a Drive access restriction; Drive does not offer an Admin console setting to block access by file type. Option D is not a Drive access restriction either; upload size limits are not an Admin console Drive access control (Drive enforces a 5 TB per-file maximum, not a configurable Admin setting).

Answer

Limit the number of files a user can create

Answer

Restrict access to specific file types

Answer

Set a file size limit for all uploads