GWS-ADMIN Endpoint Management — 15 Questions

Question 1

Your company wants to prevent employees from using personal Google accounts on company-owned ChromeOS devices. Which setting should you enable?

Accepted Answer

Device settings > Sign-in settings > Sign-in restriction. Blocking accounts on managed ChromeOS devices is a standard device policy to prevent data exfiltration.

Answer

User settings > Accounts > Prevent adding accounts

Answer

Security > Chrome > Account management

Answer

App management > Block personal accounts

Question 2

You want to ensure that only company-managed ChromeOS devices can access your Google Workspace environment. Which setting should you modify?

Accepted Answer

Context-Aware Access levels. Context-Aware Access allows you to restrict access based on whether the device is managed by the organization.

Answer

Device enrollment settings

Answer

Security center dashboard

Answer

Chrome browser cloud management settings

Question 3

You have a mix of company-owned and BYOD mobile devices. You want to apply different policies to each. What is the recommended strategy?

Accepted Answer

Create two separate OUs and apply different mobile settings to each. Using different Organizational Units (OUs) allows you to apply different MDM policies to different groups of devices or users.

Answer

Create a Google Group and apply policies to the group

Answer

Use a third-party MDM for the BYOD devices only

Answer

Create a single OU and use groups for individual device settings

Question 4

What is required for a user to be able to manage their own mobile device in the Google Admin console?

Accepted Answer

User must have the 'Mobile device manager' role. Users do not manage their devices in the Admin console; that is for administrators only.

Answer

User must be in the 'Everyone' group

Answer

There is no way for a user to manage devices

Answer

User must be an owner of the device

Question 5

What is the first step to enable mobile management for your organization?

Accepted Answer

Which TWO of the following are benefits of using Google Endpoint Management?. Turning on mobile management in the Admin console is the foundational step for all subsequent MDM tasks.

Answer

Which TWO of the following are benefits of using Google Endpoint Management?

Answer

Which TWO of the following are benefits of using Google Endpoint Management?

Answer

Which TWO of the following are benefits of using Google Endpoint Management?

Answer

Register a domain with Google

Answer

Install a mobile management app on all phones

Answer

Create an Apple Push Certificate

Question 6

Which TWO of the following are prerequisites for setting up iOS device management?

Accepted Answer

Apple Push Certificate. Option B (Apple Push Certificate) is correct because iOS MDM enrollment and ongoing management depend on APNs: the MDM server must authenticate to Apple's push notification service with an Apple Push Certificate (obtained via Apple Push Certificates Portal, tied to an Apple ID) so it can wake devices and deliver commands. Option D (Advanced Mobile Management) is correct because iOS device management requires an advanced mobile management license/configuration in the management console, which enables MDM features such as automated enrollment, configuration profiles, and app distribution for iOS devices. Option A is not required because iOS devices can be enrolled remotely (for example, via Apple Business Manager with Automated Device Enrollment or user-driven enrollment) without physical access. Option C is not required because a custom domain is only relevant to branding or identity/domain verification, not to the core MDM prerequisites. Option E is not required because Android Enterprise registration applies to Android device management, not iOS.

Answer

Physical access to each device

Answer

A custom domain name

Answer

Android Enterprise registration

Question 7

You need to block a specific version of the Chrome browser because of a security vulnerability. Which setting do you use?

Accepted Answer

Browser settings > Apps and extensions > Version pinning. Chrome browser management allows you to enforce version policies to ensure users are on secure versions.

Answer

Device settings > Chrome > Version control

Answer

Admin console > Security > Browser blocking

Answer

User settings > Chrome > Update policy

Question 8

Which THREE of the following are types of reports available in the 'Reports' section of the Admin console regarding mobile devices?

Accepted Answer

Device security report. Device usage, audit events, and compliance reports are standard reports in Google Workspace.

Answer

Data usage report

Answer

User password report

Question 9

Your organization requires that all iOS devices accessing corporate data be encrypted and have a passcode. You have enabled Google Mobile Management. Which configuration setting should you verify in the Google Admin console to ensure all devices enforce these policies?

Accepted Answer

Configure iOS password requirements in Mobile & endpoints > Settings > iOS. The 'Password requirements' setting under Device > Mobile & endpoints > Settings > iOS ensures that MDM-enforced policies apply to the device.

Answer

Use the Google Cloud Directory Sync tool

Answer

Set up Basic mobile management

Answer

Enable Chrome browser management for iOS

Question 10

An employee is reporting that they cannot access corporate Gmail on their personal Android device. You have set up 'Advanced mobile management'. What is the most likely cause if the device is showing as 'Blocked' in the Admin console?

Accepted Answer

The device is pending admin approval in the mobile devices list. Under Advanced mobile management, devices must be approved by an administrator or meet specific compliance rules before they can sync corporate data.

Answer

The device has not been enrolled in the corporate Wi-Fi network

Answer

The user's account is locked in the Admin console

Answer

The user has not installed the Google Device Policy app

Question 11

A user has left the company. You need to ensure all corporate data is removed from their Android device, but you want to keep their personal data intact. Which action should you take?

Accepted Answer

Select 'Wipe account' from the device details page. A 'Work wipe' removes only the work profile and corporate data from the device, leaving personal data untouched.

Answer

Disable the user's account in the Admin console

Answer

Remove the device from the domain

Answer

Perform a Factory reset

Question 12

Your organization uses ChromeOS devices. You want to enforce a policy that prevents users from using guest mode on these devices. Where do you configure this?

Accepted Answer

Device settings. ChromeOS device settings are managed under Devices > Chrome > Settings > Device settings.

Answer

Network settings

Answer

Users & browsers settings

Answer

Apps & extensions settings

Question 13

Which TWO of the following are valid methods to deploy the Endpoint Verification extension to your users' Chrome browsers?

Accepted Answer

Force-install the extension via Chrome user settings in the Admin console. You can force-install the extension via the Admin console or provide a direct link for users to install it themselves.

Answer

Configure it via the ChromeOS device enrollment token

Answer

Upload the extension to the internal company web server

Answer

Install the extension via the Google Cloud SDK

Question 14

A company wants to prevent users from installing any Android apps outside the managed Google Play Store on their personally owned devices that access corporate data through Google Workspace. Mobile management is already enabled for these Android devices. What should you do?

Accepted Answer

Set the 'Allow unknown sources' setting to 'Block' in the Android settings within the Admin console for personal devices.. The 'Allow unknown sources' setting under Android personal device settings specifically controls whether users can install apps from outside managed Google Play. Setting it to 'Block' prevents sideloading and aligns with the requirement. Other settings like passcode enforcement or managed configurations do not address installation source restrictions.

Answer

Deploy a managed configuration profile that restricts app installations to the Google Play Store only.

Answer

Enforce a device policy that requires a passcode and encryption on all personal Android devices.

Answer

Configure the 'Apps' setting in Google Endpoint Management to require approval for all app installations.

Question 15

A user reports that their company-owned Android device has been lost. You need to remotely remove all corporate data from the device while preserving the user's personal data. What should you do?

Accepted Answer

Remove the Google Workspace account from the device via the Admin console.. For company-owned Android devices, removing the Google Workspace account from the Admin console triggers the removal of the work profile and all corporate data, while personal data remains if the device uses a work profile. This is the correct method to selectively remove corporate data without wiping the entire device.

Answer

Use the 'Wipe corporate data' option for the device in the Admin console.

Answer

Perform a remote wipe of the entire device.

Answer

Change the user's password and sign out all sessions.