GWS-ADMIN Data Governance And Compliance Practice Test 2 — 15 Questions

Question 1

Your organization uses Google Workspace. A compliance officer needs to be notified whenever a user shares a Drive file with someone outside the company. You want to receive these alerts in the Admin Console's alert center. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Drive DLP rule that triggers on external sharing and set the action to 'Alert only'.. A Drive DLP rule is designed to monitor and alert on sensitive content and sharing events. By creating a rule that triggers on external sharing and choosing the 'Alert only' action, administrators receive notifications in the alert center without disrupting user workflows. This is the standard method to gain visibility into external sharing for compliance purposes.

Answer

Configure a Drive sharing setting to 'On - Files can be shared outside your domain' and enable alerts for sharing changes.

Answer

Use the Security Investigation tool to run a search for external shares and schedule a daily export to the compliance officer.

Answer

Set up a Gmail content compliance rule that scans for Drive links in emails and notifies the compliance officer.

Question 2

A user is leaving the company. You need to keep their data for 7 years. What is the best practice?

Accepted Answer

Create a Vault hold for the user's account. A Vault hold preserves all data (Gmail, Drive, Meet, etc.) for a user indefinitely, regardless of retention rules or user actions, making it the best practice for legal/regulatory retention when an employee leaves. Holds are the only mechanism that guarantees data cannot be purged until the hold is removed, which is essential for 7-year retention requirements.

Answer

Export all data to a PST file

Answer

Transfer Drive ownership to another user

Answer

Suspend the user account and keep it

Question 3

You need to ensure that credit card numbers are not sent via Gmail by your employees. Which tool should you configure?

Accepted Answer

DLP rules. Data Loss Prevention (DLP) rules in Google Workspace can scan Gmail content for predefined detectors like credit card numbers (using regex and checksum validation) and take actions such as block, quarantine, or warn. This is the purpose-built tool for preventing sensitive data like PANs from being emailed. Other tools handle access, retention, or investigation, not content-based blocking.

Answer

Context-aware access

Answer

Google Vault retention rules

Answer

Security center investigation tool

Question 4

You need to prevent users from sharing sensitive files outside the organization. Which setting should you modify?

Accepted Answer

Drive sharing options in the Admin Console. Drive sharing options in the Admin Console let you restrict whether users can share files outside the organization, set default sharing visibility, and block external sharing entirely or by OU. This is the direct control for preventing sensitive files from leaving the org via Drive. Other settings address different concerns (endpoint security, retention, app access) and do not govern Drive sharing.

Answer

Endpoint management

Answer

Vault retention settings

Answer

App access control

Question 5

How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?

Accepted Answer

Set a Gmail retention rule in Google Vault. Google Vault retention rules override user actions — even if a user empties Trash or permanently deletes a message, Vault retains a copy for the configured period. Setting a 3-year retention rule on Gmail messages ensures deleted emails remain discoverable and recoverable for exactly that duration, satisfying legal/regulatory requirements.

Answer

Enable endpoint management

Answer

Use an Admin Console report

Answer

Configure a Gmail filter

Question 6

Your legal team requires that all emails from a specific user be preserved for an upcoming audit. Which tool should you use to ensure these messages are not deleted?

Accepted Answer

Google Vault. Google Vault is the eDiscovery and retention tool designed for legal and compliance use cases. It lets admins place holds on specific users' Gmail messages, ensuring they cannot be deleted even by the user, and supports search/export for audits. This directly satisfies the legal team's requirement to preserve a specific user's emails.

Answer

Data Loss Prevention (DLP) rules

Answer

Google Workspace Migration for Microsoft Outlook

Answer

Admin Console Reporting

Question 7

You need to investigate a potential data breach where a user downloaded a large number of sensitive files. Which tool provides the most granular audit logs for Drive file downloads?

Accepted Answer

Security center investigation tool. The Security Center (Google Workspace Security Center) investigation tool provides the most granular, event-level audit data for Drive, including who downloaded which file, when, from what IP/device, and allows filtering and pivoting on those events. It is purpose-built for security investigations like mass-download detection.

Answer

DLP policy logs

Answer

Vault eDiscovery search

Answer

Reports dashboard

Question 8

Where do you go in the Admin Console to view the current data region for your organization?

Accepted Answer

Account > Account settings > Data regions. The 'Account settings' section under 'Account' contains the data regions configuration.

Answer

Vault > Settings

Answer

Apps > Google Workspace

Answer

Security > Data protection

Question 9

You need to monitor for potentially malicious third-party apps accessing Drive data. Which feature should you use?

Accepted Answer

App access control. App access control (also called app allowlisting/blocklisting) lets admins see which third-party OAuth apps have been granted access to Workspace data, review their scopes, and restrict or block apps that request risky Drive permissions. This is the feature designed to monitor and control third-party app access to Drive data.

Answer

DLP rules

Answer

Context-aware access

Answer

Vault matters

Question 10

Which dashboard provides a summary of security incidents and potential policy violations?

Accepted Answer

Security center dashboard. The Security center dashboard in the Google Admin console aggregates security-related signals, including potential policy violations, suspicious login activity, and other incident summaries, giving admins a consolidated view of security posture. It is the designated place for security incident overview.

Answer

Vault dashboard

Answer

Compliance reports

Answer

User management dashboard

Question 11

You need to ensure that Google Chat messages are retained for 5 years. How do you do this?

Accepted Answer

Create a Chat retention rule in Vault. Google Vault is the eDiscovery and retention tool for Google Workspace, and it supports retention rules for Chat (as well as Gmail, Drive, and Meet). Creating a Chat retention rule in Vault with a 5-year retention period ensures messages are preserved for that duration regardless of user deletion. This is the only mechanism that enforces a defined retention period for Chat messages.

Answer

Enable chat history for all users

Answer

Export Chat logs via the API

Answer

Set a Gmail retention rule

Question 12

An employee is suspected of leaking data. You need to search their past Gmail and Drive files for specific terms. Which tool do you use?

Accepted Answer

Vault matter search. Vault matter search is the correct tool to search an employee's past Gmail and Drive files for specific terms. It allows administrators to create matters, define search queries, and examine data across Google Workspace services for eDiscovery and investigation purposes.

Answer

DLP incident report

Answer

Security investigation tool

Answer

Admin audit logs

Question 13

You want to prevent sensitive Drive documents from being printed. Which setting is appropriate?

Accepted Answer

Drive sharing options for viewers/commenters. In Google Drive sharing settings, admins can disable the 'Viewers and commenters can see the option to download, print, and copy' setting, which removes the print/download/copy options for users with view or comment access. This is the appropriate control to prevent printing of sensitive documents shared with those roles.

Answer

Context-aware access

Answer

Endpoint management

Answer

DLP policy

Question 14

When a user leaves the company, which status should you set their account to if you want to keep their data but stop them from logging in?

Accepted Answer

Suspend the account. Suspending a Google Workspace account immediately blocks sign-in while preserving all data, including Gmail, Drive, and Calendar content. The account remains in the directory and can be restored later. This matches the requirement to keep data but stop logins.

Answer

Reset the 2-Step Verification

Answer

Change the password

Answer

Delete the account

Question 15

Which Google Workspace service should you use to search and export user data for legal requests?

Accepted Answer

Google Vault. Google Vault is the eDiscovery and information governance service in Google Workspace, purpose-built for searching, holding, and exporting user data (Gmail, Drive, Meet, Chat) in response to legal requests. It provides the search, hold, and export workflows required for litigation and compliance.

Answer

Google Cloud Storage

Answer

Data migrations

Answer

Security center