GWS-ADMIN Core Workspace Services Practice Test 4 — 15 Questions

Question 1

Which THREE items can be managed through the 'Directory' section in the Admin Console?

Accepted Answer

User profile editing permissions. In the Google Admin Console, the Directory section is where administrators manage directory-related settings and resources. Option A (User profile editing permissions) is correct because the Directory > Directory settings area lets you control whether users can edit their own profiles and which fields they may change. Option B (Building resources) is correct because Directory > Buildings and Resources is where you create and manage buildings and resource calendars (such as meeting rooms and equipment). Option E (Shared contacts) is correct because Directory > Shared contacts allows you to add external contacts that appear in the directory for your users. Option C (Device management policies) is not in Directory; device policies are configured under Devices (e.g., Mobile & endpoints or Chrome management). Option D (Gmail routing rules) is not in Directory; routing and compliance rules are configured under Apps > Google Workspace > Gmail > Routing, not the Directory section.

Answer

Device management policies

Answer

Gmail routing rules

Question 2

Which TWO of the following can be restricted in Google Drive sharing settings?

Accepted Answer

Sharing with users who do not have a Google account. Option B is correct because Google Drive's sharing settings include an admin control that limits whether files can be shared with people who don't have a Google account, typically by restricting sharing to only users within the domain or requiring recipients to sign in with a Google account. Option D is correct because Google Workspace admins can configure sharing settings to control whether files can be shared outside the organization, including options like turning off external sharing entirely or limiting it to allowlisted domains. Option A is incorrect because file size limits are governed by storage quotas and upload limits, not by Drive sharing settings. Option C is incorrect because who can use the Drive app is controlled through user licensing and app access settings, not sharing settings. Option E is incorrect because there is no per-day file sharing limit configurable in Drive sharing settings.

Answer

The size of files shared via links

Answer

The specific users who can use the Drive app

Answer

The number of files a user can share per day

Question 3

Which THREE of the following are valid ways to manage Google Calendar resource availability?

Accepted Answer

Auto-accept invitations. Resources are managed via building assignment, auto-accept rules, and visibility settings.

Answer

Enable recurring meeting limits

Answer

Restrict resource access by device type

Question 4

You are the Workspace administrator for a healthcare company. A new compliance policy requires that all external email sent from your domain be digitally signed so that recipients can verify the messages are genuinely from your organization. You need to configure this in the Google Workspace Admin console. What should you do?

Accepted Answer

Configure DKIM (DomainKeys Identified Mail) in the Admin console under Apps > Google Workspace > Gmail > Authenticate email, and publish the public key in DNS.. DKIM is the email authentication method that adds a digital signature to outgoing messages, allowing recipients to verify the message was sent by your domain and was not altered. Enabling DKIM in the Admin console and publishing the public key in DNS is the standard way to meet a requirement for digitally signed external email. SPF and DMARC are policy and validation mechanisms but do not sign messages, and S/MIME requires per-user certificates and does not automatically sign all outbound mail.

Answer

Enable DMARC (Domain-based Message Authentication, Reporting & Conformance) by adding a TXT record to your DNS with a policy of p=reject.

Answer

Enable S/MIME for Gmail in the Admin console under Apps > Google Workspace > Gmail > User settings, and upload a root certificate.

Answer

Set up SPF (Sender Policy Framework) by adding a TXT record to your domain's DNS that lists authorized sending IP addresses.

Question 5

A user in your organization reports that they cannot access their Google Drive files from their mobile device. They can access Drive from their laptop without issue. You suspect a device-based access policy is blocking mobile access. Where in the Google Admin console should you check?

Accepted Answer

Security > Access and data control > Context-Aware Access. Context-Aware Access in the Admin console allows administrators to define granular access levels based on device and user context, such as device encryption status, screen lock, or whether the device is managed. If a user can access Drive from a laptop but not a mobile device, it suggests a context-aware access level is applied to Drive that requires certain device conditions not met by the mobile device. Checking this section is the correct troubleshooting step.

Answer

Devices > Mobile & endpoints > Android settings

Answer

Directory > Users > [user] > Security

Answer

Apps > Google Workspace > Drive and Docs > Sharing settings

Question 6

Your organization uses Google Workspace and has a mix of full-time employees and temporary contractors. You need to ensure that contractors cannot access Google Drive from unmanaged mobile devices, while employees can. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Create a separate organizational unit for contractors and apply a device policy that requires mobile devices to be managed.. To prevent contractors from accessing Google Drive on unmanaged mobile devices while allowing employees, you should create a separate organizational unit for contractors and apply a device policy requiring managed devices. Additionally, enabling Context-Aware Access with a policy that requires company-owned or managed devices adds an extra layer of enforcement. Together, these configurations ensure that only compliant devices can access Drive for the contractor OU.

Answer

Set up a Google Group for contractors and restrict Drive sharing to only members of that group.

Answer

Disable Google Drive for the contractors' organizational unit entirely.

Answer

Enforce 2-Step Verification for all contractors and require security keys.

Question 7

A user in your organization reports that they accidentally deleted a Google Calendar event that contained important meeting notes and attachments. The event was deleted from a secondary calendar they own. Where can the user recover the deleted event?

Accepted Answer

From the calendar's trash, accessible via Calendar settings for that specific calendar. Deleted events in Google Calendar are moved to a per-calendar trash, and users can restore them from the settings of the specific calendar where the event lived. Because the event was on a secondary calendar the user owns, the correct action is to open that calendar's settings and use its trash to restore the event. Admin tools and Vault serve different purposes and do not restore events to a user's calendar.

Answer

From the Google Drive trash, because calendar attachments are stored in Drive

Answer

From the Admin console's Calendar recovery tool

Answer

By asking a super administrator to restore the event from Google Vault

Question 8

Your organization has a policy that all Google Drive files must be owned by the organization, not by individual users. A user creates a new Google Doc and shares it with an external collaborator. You need to ensure that the file remains owned by the organization even if the user leaves. What should you do?

Accepted Answer

Set up a shared drive and enforce that all new files are created in it.. Shared drives are owned by the organization, not by individual users. By enforcing that files are created in shared drives, you ensure that ownership remains with the organization even if the user leaves. This is the most effective way to meet the policy requirement.

Answer

Enable Google Drive ownership transfer for all users.

Answer

Configure Google Vault to retain all files indefinitely.

Answer

Enable Drive File Stream for all users.

Question 9

Your organization is migrating from Microsoft Exchange to Google Workspace. The IT director wants to ensure that all existing calendar events, including recurring meetings and resource bookings, are transferred to Google Calendar with minimal user intervention. Which Google Workspace service should you use to accomplish this?

Accepted Answer

Google Workspace Data Migration Service. The Data Migration Service is the only Google Workspace tool specifically built to migrate calendar data from Exchange, including recurring events and resource bookings. It operates at the domain level and does not require user intervention, making it the correct choice for a bulk migration.

Answer

Google Takeout

Answer

Google Workspace Sync for Microsoft Outlook (GWSMO)

Answer

Google Calendar API

Question 10

You are the Google Workspace administrator for a company that wants to enforce stricter controls on how users share Google Drive files. You need to configure sharing settings at the organizational unit level. Which TWO of the following actions can you perform in the Google Drive sharing settings for an organizational unit? (Choose two.)

Accepted Answer

Prevent users from granting access to files to users outside the organization.. The Drive sharing settings for an organizational unit allow administrators to set the default visibility for new files and to restrict sharing outside the organization. These controls directly shape how users can share files and help enforce stricter governance. The other options describe capabilities that are not part of the native sharing settings, such as forcing files into a shared drive, setting upload size limits, or requiring admin approval for external shares.

Answer

Force all files to be stored in a specific shared drive regardless of where the user creates them.

Answer

Set a maximum file size limit for uploads to Drive for the organizational unit.

Answer

Require that all shared files be reviewed by an administrator before external sharing is allowed.

Question 11

Your company's security team wants to ensure that all outgoing email from your Google Workspace domain is authenticated so that external recipients can verify it. They ask you to check the current email authentication configuration for the domain. Where should you look in the Google Workspace Admin console to review and manage these settings?

Accepted Answer

Apps > Google Workspace > Gmail > Authenticate email (DKIM). Email authentication for a Google Workspace domain centers on SPF, DKIM, and DMARC. The Admin console provides DKIM management under Apps > Google Workspace > Gmail > Authenticate email, where you can generate and rotate the DKIM key. SPF and DMARC are configured in DNS. The other listed locations deal with compliance rules, account security, or user access, none of which contain the authentication settings the security team needs.

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Account settings > Security

Answer

Apps > Google Workspace > Gmail > End User Access

Question 12

You are the Workspace administrator for a retail company. The legal department needs to ensure that all email sent to and received from a specific external domain is archived for eDiscovery, even if users delete the messages. Which Google Workspace feature should you configure?

Accepted Answer

Google Vault retention rules and holds for Gmail.. Google Vault is the correct feature for archiving email for eDiscovery. It allows you to create retention rules based on specific conditions, such as messages to or from a particular external domain, and ensures those messages are preserved even if users delete them. Vault also supports holds and searches for legal investigations. Other Gmail settings like retention rules or content compliance do not provide a separate, searchable archive.

Answer

Gmail delegation settings to allow the legal team to access user mailboxes.

Answer

Content compliance rules in Gmail settings to route messages to a third-party archiving system.

Answer

Gmail retention rules in the Admin console under Apps > Google Workspace > Gmail > Compliance.

Question 13

A manager needs to know which users in the sales organizational unit have not signed in to their Google Workspace account in the past 30 days. The manager does not have admin access. What should the administrator do to provide this information?

Accepted Answer

Generate a user accounts report in the Admin console and filter by last login date for the sales organizational unit.. The user accounts report in the Admin console includes last login information and can be filtered by organizational unit. An administrator can use it to identify sales users who have not signed in within the past 30 days and share that information with the manager. Vault and Drive audit logs serve different purposes and do not provide the needed last login overview.

Answer

Ask the manager to review each user's Gmail last login from their profile page.

Answer

Check the Google Drive audit log for file access by sales users.

Answer

Use the Google Vault audit log to search for user sign-in events.

Question 14

Your company has a Google Workspace subscription. The IT team wants to ensure that all users' Chrome browsers are configured to block third-party cookies and that this setting cannot be changed by users. Which Google Workspace setting should you configure?

Accepted Answer

Chrome user policies in the Admin console under Devices > Chrome > Settings.. To enforce Chrome browser settings such as blocking third-party cookies and preventing users from changing them, you must configure Chrome user policies in the Admin console. This allows granular control over browser behavior for managed users. Other settings are unrelated to Chrome configuration.

Answer

Security settings under Security > Authentication > Google Session control.

Answer

Google Drive sharing settings under Apps > Google Workspace > Drive and Docs.

Answer

Google Meet safety settings under Apps > Google Workspace > Google Meet.

Question 15

Your organization uses Google Workspace and you have been asked to ensure that all email sent from your domain passes SPF, DKIM, and DMARC checks. You have already published SPF and DKIM records. Which action should you take to complete the DMARC configuration?

Accepted Answer

Publish a DMARC TXT record at _dmarc.yourdomain.com with a policy of p=quarantine or p=reject.. DMARC is implemented by publishing a TXT record at _dmarc.yourdomain.com with a policy such as quarantine or reject. This tells receiving servers how to treat messages that fail SPF and DKIM alignment. Admin console settings and MX records do not configure DMARC, so the DNS TXT record is the required action.

Answer

Configure a DMARC policy in the Google Workspace Security center under Authentication.

Answer

Enable DMARC in the Google Admin console under Apps > Google Workspace > Gmail > Compliance.

Answer

Add a DMARC record to the Google Workspace MX records list.