GWS-ADMIN Data Governance And Compliance Practice Test 3 — 15 Questions

Question 1

Which TWO actions can you perform in Google Vault?

Accepted Answer

Search and export user data. Option C (Search and export user data) is correct because Google Vault is specifically designed for eDiscovery and compliance, allowing administrators to search across Gmail, Drive, and other Google Workspace services and export the results for legal or investigative purposes. Option E (Place a hold on user data) is also correct because Vault lets you create holds on specific users or organizational units to preserve data indefinitely, even if users delete it, which is essential for litigation and compliance. Option A (Configure DLP policies) is incorrect because data loss prevention is configured in the Google Admin console (Security > Data Loss Prevention), not in Vault. Option B (Set up 2-Step Verification) is incorrect because two-step verification is an authentication setting managed in the Admin console under Security > Authentication. Option D (Manage user passwords) is incorrect because password management is performed in the Admin console under Directory > Users, not in Vault.

Answer

Configure DLP policies

Answer

Set up 2-Step Verification

Answer

Manage user passwords

Question 2

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 3

You have a Data Region policy, but a user is still showing data in the global region. What is the most likely cause?

Accepted Answer

The user's OU is not in a region-mapped group. Data Regions in Google Workspace are enforced through organizational units (OUs) and groups mapped to specific regions. If a user is not placed in a region-mapped group or OU, their data is processed and stored in the default global region, even if a Data Region policy exists. The most likely cause is that the user's OU is not included in the region-mapped group, so the policy does not apply to them.

Answer

The account is suspended

Answer

The user hasn't logged in recently

Answer

Vault hold is preventing the move

Question 4

You need to verify if an email was sent to an external address. Where can you see this in the Admin Console?

Accepted Answer

Email log search. The Email Log Search tool in the Admin Console allows administrators to trace email delivery and identify recipients.

Answer

Vault search

Answer

Compliance reports

Answer

Security center

Question 5

Which TWO settings in Drive sharing can help prevent data leakage?

Accepted Answer

Prevent viewers from downloading, printing, or copying. Option A is correct because the 'Viewers and commenters can see the option to download, print, and copy' setting in Google Drive sharing can be disabled, which removes the download, print, and copy controls for viewers and commenters, directly reducing the risk of data exfiltration. Option B is correct because limiting sharing to specific domains (via the 'Sharing outside of <domain>' / target audience and allowlist settings) restricts content distribution to trusted organizational domains, preventing leakage to unauthorized external parties. Option C is incorrect because allowing external sharing for all users broadens exposure and increases leakage risk rather than preventing it. Option D is incorrect because letting users set their own sharing permissions removes centralized control and can lead to overly permissive sharing. Option E is incorrect because disabling all Drive sharing is an overly broad, disruptive measure, not a targeted data-leakage prevention setting.

Answer

Allow external sharing for all users

Answer

Enable 'Allow user to set their own sharing'

Answer

Disable all Drive sharing

Question 6

Which THREE types of data can be managed using Vault retention rules?

Accepted Answer

Gmail messages. Vault retention rules can be applied to Gmail messages (A), Google Drive files (B), and Google Chat messages (D), since these are the core Google Workspace services whose data Vault governs and for which retention policies can be set to retain or expire content. Gmail retention rules control how long messages are preserved or purged, Drive retention rules govern files in My Drive and shared drives, and Chat retention rules manage conversation history and its associated data. User device logs (C) are not a Vault-supported retention data type; device management and endpoint telemetry fall under services like the Admin console or endpoint management, not Vault retention rules. Third-party app tokens (E) are also not a Vault retention category, as Vault does not manage OAuth or access tokens issued to external applications.

Answer

User device logs

Answer

Third-party app tokens

Question 7

Which THREE security settings are commonly configured using Context-Aware Access?

Accepted Answer

Device security posture (e.g., screen lock). Context-Aware Access in Google Workspace evaluates access requests based on attributes of the user, device, and context, so device security posture such as screen lock status (A) is a valid access level condition that can block or allow apps based on whether the device meets requirements like encryption or screen lock. User IP address (B) is a supported condition, allowing admins to restrict access to specific IP ranges or subnets via access levels. Geographical location (E) is also supported, since Context-Aware Access can evaluate the source country or region of the request to grant or deny access. Email signature format (C) is a Gmail compliance/branding setting unrelated to access decisions, and user password strength (D) is enforced through password policies, not Context-Aware Access conditions.

Answer

Email signature format

Answer

User password strength

Question 8

Which TWO actions should be taken when offboarding a user to protect organizational data?

Accepted Answer

Suspend the user account. Option B is correct because suspending the user account immediately blocks the offboarded user from signing in and accessing organizational resources such as email, Drive, and other Workspace services, while preserving the account's data for later transfer or audit. Option C is correct because applying a Vault hold preserves the user's data (mail, Drive files, chat, etc.) beyond the normal retention period and prevents it from being purged, which is essential when legal, compliance, or investigation requirements exist. Option A is wrong because billing settings are unrelated to protecting organizational data during offboarding. Option D is wrong because granting full email access would expand the departing user's access rather than restrict it. Option E is wrong because deleting the account immediately can destroy data and remove the ability to transfer ownership or place holds, so suspension is preferred over deletion.

Answer

Reset the user's billing settings

Answer

Grant user full email access

Answer

Delete the user account immediately

Question 9

Which TWO tools in the Admin Console help you identify potentially compromised accounts?

Accepted Answer

Security dashboard. The Security dashboard (C) is correct because it surfaces security-related metrics and alerts in the Admin Console, including suspicious login activity and other indicators that can point to potentially compromised accounts. The Investigation tool (D) is correct because it lets admins run targeted searches across Gmail, Drive, and other Workspace logs (e.g., login and device events) to dig into anomalous user activity and confirm whether an account has been compromised. Vault search (A) is for eDiscovery and content retention/legal holds, not for identifying compromised accounts. Group settings (B) only manage membership and group configuration, and Data regions (E) controls where data is stored, neither of which helps detect account compromise.

Answer

Vault search

Answer

Group settings

Answer

Data regions

Question 10

Which TWO actions can you take when a user account is under a Vault hold?

Accepted Answer

Prevent data deletion. A Vault hold is a preservation mechanism that overrides retention and deletion policies, so option B (Prevent data deletion) is correct because placing a user account under a hold stops Gmail messages, Drive files, and other covered data from being purged even after the retention period expires. Option D (Ensure data availability for eDiscovery) is also correct because the hold keeps the user's data searchable and exportable in Vault for legal or investigative purposes, which is the core reason holds are applied. The unmarked options do not belong: A (Automatically delete old emails) contradicts the preservation purpose of a hold, C (Enable 2-Step Verification) is an account security setting unrelated to Vault holds, and E (Allow the user to change their password) is a normal account action that a hold neither grants nor blocks.

Answer

Automatically delete old emails

Answer

Enable 2-Step Verification

Answer

Allow the user to change their password

Question 11

You are the Workspace administrator for a financial firm. Compliance requires that every external share of a Drive file be logged with the file owner's identity, the recipient, and the timestamp, and that the log be retained for three years. Which action best satisfies this requirement?

Accepted Answer

Configure a Drive log retention rule of three years in the Admin Console so audit events are preserved.. External sharing events are recorded as Drive audit events, which include the actor, the file, the recipient, and the time. To keep them for three years, the administrator sets the Drive log retention period accordingly. DLP and Vault serve different purposes and do not replace the audit log for this retention requirement.

Answer

Create a DLP rule that alerts when files are shared externally.

Answer

Enable Drive audit logging and rely on the default retention period.

Answer

Place a Vault hold on the user's Drive to capture sharing events.

Question 12

Your organization uses Google Workspace and must comply with a new regulation requiring that all newly created Drive files for the Finance department are stored only in the United States. You have already created a Data Region policy for the US and applied it to the Finance organizational unit. However, you notice that some files created by Finance users are still being stored in the global region. What is the most likely reason for this behavior?

Accepted Answer

The users are creating files in a shared drive that is not covered by the Data Region policy.. Data Region policies apply to user data in My Drive and Gmail, but shared drives require separate configuration. When a policy is applied to an OU, it does not automatically extend to shared drives owned by that OU. Therefore, files created in a shared drive may still be stored in the global region. To ensure compliance, the shared drive must be added to the Data Region policy.

Answer

The Data Region policy must be applied to the user accounts, not the organizational unit.

Answer

The Data Region policy only applies to data created after the policy is applied, but existing files remain in their original region.

Answer

The users have not been assigned a Google Workspace license that supports Data Regions.

Question 13

A healthcare organization uses Google Workspace. A compliance officer asks you to ensure that any Gmail message containing a patient identifier is automatically quarantined for review rather than delivered. Which configuration accomplishes this with the least administrative overhead?

Accepted Answer

Configure a Gmail DLP rule with a custom pattern and set the action to quarantine.. Gmail DLP evaluates message content against detectors and can take actions such as quarantine, which places the message in a review queue. This directly addresses the need to hold messages containing patient identifiers instead of delivering them, and it requires only a single DLP rule rather than custom routing.

Answer

Create a content compliance rule that adds a header to matching messages.

Answer

Add the pattern to the blocked senders list in Gmail settings.

Answer

Use an attachment compliance rule to reject messages with matching attachments.

Question 14

Your organization must ensure that any Google Drive file containing credit card numbers is automatically flagged and the file owner is alerted. You want the least administrative overhead and want the detection to leverage Google's built-in classifiers. Which Google Workspace feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) rule in Drive that uses a predefined detector for credit card numbers and sends an alert to the file owner. DLP in Google Drive is designed to automatically scan file content for sensitive data patterns, including credit card numbers, using predefined detectors. Configuring a DLP rule with the appropriate detector and an action to alert the owner satisfies the need for automatic detection and notification without custom development. Other options either require manual labeling, do not inspect content, or lack automatic alerting.

Answer

Drive labels with a custom classification and a DLP rule that uses the label as a condition

Answer

Alert center rule that monitors Drive audit logs for files shared externally

Answer

Security investigation tool query that searches Drive logs for files with 'credit card' in the name

Question 15

Your company is subject to a regulation that requires all Google Workspace data for EU employees to remain within the European Union. You have already set a Data Region policy for the EU. A new employee in Germany reports that their Drive files show a US data region. What is the most likely explanation?

Accepted Answer

The files were created before the Data Region policy was applied or the policy does not cover the employee's organizational unit.. Data Region policies are forward-looking and scoped to organizational units. Data created before the policy, or by users outside the covered organizational unit, remains in its original region. The administrator must verify the policy scope and, if needed, migrate existing data using the supported migration process.

Answer

The employee is connecting from a non-EU IP address, which forces data to the US region.

Answer

The employee's Drive for desktop client is caching files locally in the US.

Answer

The employee's personal Drive settings override the organizational Data Region policy.