GWS-ADMIN Data Governance And Compliance — Timed 20 Questions

Question 1

An auditor requests a log of all file sharing activities in Drive for the past 6 months. Where can you retrieve this information?

Accepted Answer

Security Center Investigation Tool. The Admin Console audit logs contain detailed information about Drive file sharing and access events.

Answer

User's Drive settings

Answer

DLP incident reports

Answer

Google Vault Matters

Question 2

You have a Data Region policy configured for the US. A user moves from the US to the EU. How do you trigger the migration of their existing data to the EU?

Accepted Answer

Move the user to an OU configured for the EU data region. Data regions are applied based on the organizational unit (OU) a user belongs to. To migrate a user's existing data from the US to the EU region, you move the user into an OU that has the EU data region policy configured, which triggers Google to migrate their data to the EU.

Answer

Manually run a data export in Vault

Answer

Re-provision the user account

Answer

Contact Google Support to initiate a manual migration

Question 3

You need to block Gmail messages containing specific keywords related to a confidential project. Which tool do you use?

Accepted Answer

DLP policy. Compliance rules in the Gmail settings of the Admin Console allow for filtering based on content, including keywords.

Answer

Context-aware access

Answer

Gmail routing rules

Answer

Vault hold

Question 4

Which THREE features are part of the Security Center?

Accepted Answer

Security health page. The Security Center in Microsoft 365 includes a Security health page (A), which surfaces the status of security controls and configuration across the tenant, making it a core feature. It also provides a Security dashboard (D) that aggregates security metrics, alerts, and insights into a single view for monitoring posture. The Investigation tool (E) is likewise part of Security Center, allowing admins to search, filter, and act on threats such as compromised accounts, malicious email, and file activity. Vault retention rules (B) belong to the Vault/eDiscovery and retention feature set, not Security Center. DLP policy configuration (C) is managed through the Microsoft Purview compliance portal (Data loss prevention), so it is not a Security Center feature.

Answer

Vault retention rules

Answer

DLP policy configuration

Question 5

You need to create a report showing which users have been affected by a specific DLP policy violation in the last month. Where can you find this?

Accepted Answer

Security center investigation tool. The Security center investigation tool is the correct place to build a report showing which users were affected by a specific DLP policy violation in the last month. It allows admins to run a targeted search on DLP events, filter by policy name, date range, and user, and then export or chart the results. This is the only surface that supports querying DLP incidents at that level of granularity across the domain.

Answer

Admin audit logs

Answer

Reports dashboard

Answer

Vault matters

Question 6

Which THREE criteria can you use to build a DLP rule in Google Workspace?

Accepted Answer

Custom regular expressions. In Google Workspace DLP, rules are built around content-matching conditions, and option C (Custom regular expressions) is correct because admins can define their own regex patterns to detect sensitive strings such as account numbers or IDs. Option D (Predefined content detectors) is correct because Workspace provides built-in detectors for common data types like credit card numbers, national IDs, and passport numbers that can be selected directly as rule criteria. Option E (Drive labels) is correct because Drive labels (including label-based classification) can be used as a condition so DLP policies trigger on files carrying specific labels. The unmarked options do not belong: option A (User password history) is an authentication/security setting unrelated to content inspection, and option B (Network latency) is a performance metric that has no role in defining DLP rule conditions.

Answer

User password history

Answer

Network latency

Question 7

A compliance officer at your organization wants to ensure that all Google Drive files containing credit card numbers are automatically labeled as "Confidential" and that only users in the Finance department can access them. You need to implement this without requiring users to manually apply labels. What should you do?

Accepted Answer

Create a Data Loss Prevention (DLP) rule in the Admin Console that scans Drive files for credit card numbers and applies the "Confidential" label.. The correct solution uses DLP to automatically detect sensitive content and apply labels, which then drive access control. This ensures compliance without relying on users. The other options either require manual effort, use tools not designed for labeling, or do not enforce department-based access.

Answer

Configure a Drive sharing setting that prevents files from being shared outside the Finance department, and rely on users to add labels.

Answer

Create a Drive label named "Confidential" and instruct users to apply it manually to files containing credit card numbers.

Answer

Use Google Vault to search for files with credit card numbers and then apply the "Confidential" label to the search results.

Question 8

You are the Google Workspace administrator for a healthcare company. To comply with HIPAA, you need to ensure that emails containing protected health information (PHI) are not sent outside your organization. You also need to allow legitimate business emails to external partners. Which TWO actions should you take? (Choose two.)

Accepted Answer

Enable DLP for Gmail and create a rule that allows emails with PHI if the recipient is on an approved list.. DLP rules can scan outgoing email for PHI and take action. Combining a DLP rule that blocks PHI with an exception for approved recipients ensures compliance without hindering business. The other options either do not prevent PHI leakage or are too restrictive.

Answer

Use Google Vault to retain all emails and then manually review them for PHI before sending.

Answer

Configure a content compliance rule that adds a footer to all outgoing emails stating that they contain PHI.

Answer

Set up a Gmail setting to restrict external recipients to only those in a whitelist of partners.

Question 9

As the Google Workspace administrator, you need to enforce a policy that automatically applies a classification label to all new files uploaded to a specific shared drive based on the file's content, and prevents users from changing that label. Which configuration should you implement?

Accepted Answer

Create a Data Loss Prevention (DLP) rule that applies a label based on content matches.. Data Loss Prevention rules are designed to inspect content and take automated actions, including applying labels. By configuring a DLP rule with content detectors and setting the action to apply a label, and by locking the label, you ensure that new files are automatically classified and users cannot alter the label. This provides consistent enforcement across the shared drive.

Answer

Use a Google Vault retention rule to classify files based on content and apply a label.

Answer

Configure an alert in the Security Center for files uploaded to the shared drive, and manually apply labels.

Answer

Set up a Drive label with 'restricted' access and enable 'Lock labels' in the label's properties.

Question 10

A financial services company uses Google Workspace and must ensure that no one can permanently delete emails from Gmail that are subject to a legal hold. Compliance officers need the retention rule to apply to all users in the Sales OU and prevent any user or admin from overriding it. Which configuration should you implement in the Admin Console?

Accepted Answer

Create a Gmail retention rule for the Sales OU with the action 'Retain messages' and enable the option 'Prevent permanent deletion'.. The retention rule with 'Prevent permanent deletion' is the only option that both applies to the Sales OU and stops users and admins from permanently deleting messages. A retain rule without that option allows manual deletion, a rule that expunges messages violates the hold, and Vault holds preserve copies but do not block deletion from the mailbox.

Answer

Create a Gmail retention rule for the Sales OU with the action 'Retain messages' and set the retention period to the maximum allowed (e.g., forever).

Answer

Create a Gmail retention rule for the Sales OU with a specific retention period, and set the action to 'Expunge messages permanently'.

Answer

Place a legal hold on all users in the Sales OU using Google Vault, and instruct users not to delete any emails.

Question 11

Your organization uses Google Workspace Enterprise. A security analyst needs to investigate a potential data exfiltration incident. They need to see a timeline of file sharing events, including who shared what file, with whom, and when, over the past 30 days. Which tool should they use?

Accepted Answer

Security Center. Security Center is the dedicated tool for security investigations, offering a detailed timeline of Drive sharing events. The other tools either lack the timeline view or are not intended for this purpose.

Answer

Google Workspace Alert Center

Answer

Admin Console audit log for Drive

Answer

Google Vault

Question 12

You are the Google Workspace administrator for a company that must comply with GDPR. You need to ensure that you can respond to data subject access requests (DSARs) by searching for and exporting all data belonging to a specific user across Google Workspace services. Which TWO tools should you use to accomplish this? (Choose two.)

Accepted Answer

Data Export tool in Admin Console. To respond to a DSAR, you need to retrieve all data belonging to a user. Google Vault provides search and export capabilities for user data across services, while the Data Export tool in the Admin Console allows a complete export of a user's data. Together, they enable comprehensive data retrieval for compliance. The other tools lack the ability to export user content.

Answer

Security Center

Answer

Admin Console Reporting

Answer

Drive audit log

Question 13

A financial services company uses Google Workspace. Their compliance team requires that all Gmail messages sent by employees to external recipients containing specific financial terms be retained for 7 years, even if users delete them. You need to configure a Gmail retention rule that meets this requirement without affecting other messages. What should you do?

Accepted Answer

Create a Gmail retention rule with a condition that matches messages containing the financial terms, set the action to 'Retain for 7 years', and apply it to all users.. Gmail retention rules in the Admin Console allow content-based conditions, such as specific words or phrases, and can enforce retention for a set period. By creating a rule that matches financial terms and retains messages for 7 years, you ensure compliance without impacting unrelated emails. This is the correct tool because it combines content filtering with retention, which Vault cannot do.

Answer

Create a Gmail content compliance rule that quarantines messages containing the financial terms, and set the retention period to 7 years.

Answer

Configure a Gmail routing rule to send a copy of messages containing the financial terms to a designated compliance mailbox, and set that mailbox to retain messages for 7 years.

Answer

Use Google Vault to create a retention rule for Gmail with a custom retention period of 7 years, and set the scope to all users.

Question 14

A user in your organization has left the company. The legal team requires that all their email and Drive data be preserved for 7 years. You need to ensure that the data is retained and cannot be deleted by anyone, including administrators, during this period. What should you do?

Accepted Answer

Set a Google Vault retention rule for the user's organizational unit for 7 years.. Google Vault retention rules are designed to enforce data retention for a specified period. By creating a rule for the user's organizational unit that applies to Gmail and Drive for 7 years, you ensure that the data is preserved and protected from deletion, including by administrators. This is the correct approach for compliance with legal retention requirements.

Answer

Suspend the user's account in the Admin Console.

Answer

Create a custom retention policy in Google Drive for the user's files.

Answer

Place a legal hold on the user's account in Vault.

Question 15

A multinational corporation uses Google Workspace and has implemented Data Regions for its EU users, storing their data in the European Union. A user in the EU moves to the United States and continues to access Google Workspace. The compliance team wants to ensure that this user's data remains stored in the EU after the move. What should the administrator do?

Accepted Answer

Update the user's organizational unit to one that has the EU Data Region policy applied, and then trigger a data migration for that user.. Data Regions in Google Workspace are enforced by organizational unit policies. When a user moves, their OU may need to be updated to maintain the EU Data Region. After assigning the correct OU, a data migration must be triggered to move any data that was stored in the US back to the EU. This ensures ongoing compliance with data residency requirements.

Answer

Change the user's profile country to the United States, and the Data Region will automatically update to keep data in the EU.

Answer

No action is needed; Data Regions automatically follow the user regardless of their physical location.

Answer

Disable Data Regions for the user, allow data to be stored globally, and then re-enable EU Data Region to force migration.

Question 16

Your organization uses Google Workspace. A compliance officer needs to be notified whenever a user shares a Drive file with someone outside the company. You want to receive these alerts in the Admin Console's alert center. What should you do?

Accepted Answer

Create a Drive DLP rule that triggers on external sharing and set the action to 'Alert only'.. A Drive DLP rule is designed to monitor and alert on sensitive content and sharing events. By creating a rule that triggers on external sharing and choosing the 'Alert only' action, administrators receive notifications in the alert center without disrupting user workflows. This is the standard method to gain visibility into external sharing for compliance purposes.

Answer

Configure a Drive sharing setting to 'On - Files can be shared outside your domain' and enable alerts for sharing changes.

Answer

Use the Security Investigation tool to run a search for external shares and schedule a daily export to the compliance officer.

Answer

Set up a Gmail content compliance rule that scans for Drive links in emails and notifies the compliance officer.

Question 17

A user is leaving the company. You need to keep their data for 7 years. What is the best practice?

Accepted Answer

Create a Vault hold for the user's account. A Vault hold preserves all data (Gmail, Drive, Meet, etc.) for a user indefinitely, regardless of retention rules or user actions, making it the best practice for legal/regulatory retention when an employee leaves. Holds are the only mechanism that guarantees data cannot be purged until the hold is removed, which is essential for 7-year retention requirements.

Answer

Export all data to a PST file

Answer

Transfer Drive ownership to another user

Answer

Suspend the user account and keep it

Question 18

You need to ensure that credit card numbers are not sent via Gmail by your employees. Which tool should you configure?

Accepted Answer

DLP rules. Data Loss Prevention (DLP) rules in Google Workspace can scan Gmail content for predefined detectors like credit card numbers (using regex and checksum validation) and take actions such as block, quarantine, or warn. This is the purpose-built tool for preventing sensitive data like PANs from being emailed. Other tools handle access, retention, or investigation, not content-based blocking.

Answer

Context-aware access

Answer

Google Vault retention rules

Answer

Security center investigation tool

Question 19

You need to prevent users from sharing sensitive files outside the organization. Which setting should you modify?

Accepted Answer

Drive sharing options in the Admin Console. Drive sharing options in the Admin Console let you restrict whether users can share files outside the organization, set default sharing visibility, and block external sharing entirely or by OU. This is the direct control for preventing sensitive files from leaving the org via Drive. Other settings address different concerns (endpoint security, retention, app access) and do not govern Drive sharing.

Answer

Endpoint management

Answer

Vault retention settings

Answer

App access control

Question 20

How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?

Accepted Answer

Set a Gmail retention rule in Google Vault. Google Vault retention rules override user actions — even if a user empties Trash or permanently deletes a message, Vault retains a copy for the configured period. Setting a 3-year retention rule on Gmail messages ensures deleted emails remain discoverable and recoverable for exactly that duration, satisfying legal/regulatory requirements.

Answer

Enable endpoint management

Answer

Use an Admin Console report

Answer

Configure a Gmail filter