GWS-ADMIN Endpoint Management — 20 Questions

Question 1

What is the first step to enable mobile management for your organization?

Accepted Answer

Which TWO of the following are benefits of using Google Endpoint Management?. Turning on mobile management in the Admin console is the foundational step for all subsequent MDM tasks.

Answer

Which TWO of the following are benefits of using Google Endpoint Management?

Answer

Which TWO of the following are benefits of using Google Endpoint Management?

Answer

Which TWO of the following are benefits of using Google Endpoint Management?

Answer

Create an Apple Push Certificate

Answer

Register a domain with Google

Answer

Install a mobile management app on all phones

Question 2

Which TWO of the following are valid methods to deploy the Endpoint Verification extension to your users' Chrome browsers?

Accepted Answer

Force-install the extension via Chrome user settings in the Admin console. You can force-install the extension via the Admin console or provide a direct link for users to install it themselves.

Answer

Configure it via the ChromeOS device enrollment token

Answer

Upload the extension to the internal company web server

Answer

Install the extension via the Google Cloud SDK

Question 3

You need to ensure that all corporate-owned Android devices require a screen lock. Where should you configure this setting?

Accepted Answer

Devices > Mobile & endpoints > Settings > Android > Password settings. Mobile settings in the Google Admin console are where device security policies like screen lock requirements are defined.

Answer

Apps > Google Workspace > Android settings

Answer

Security > Authentication > Password policy

Answer

Directory > Users > Security settings

Question 4

You want to require that all corporate-owned iOS devices are encrypted. How is this achieved?

Accepted Answer

Configure a passcode policy in the iOS device management settings. Apple devices (iOS) are encrypted by default when a passcode is set. Therefore, enforcing a passcode policy effectively enforces encryption.

Answer

Enable Advanced Mobile Management for all iOS users

Answer

Use an MDM profile to force file-level encryption

Answer

Enable the 'Require disk encryption' setting in iOS mobile settings

Question 5

You are configuring Endpoint Verification. What is the primary purpose of the Endpoint Verification extension on a user's browser?

Accepted Answer

To collect device information for context-aware access. Endpoint Verification collects device metadata (serial number, encryption, OS) and reports it to the Admin console for access context.

Answer

To enable remote wipe capabilities

Answer

To enforce password complexity

Answer

To block all malicious websites

Question 6

You are setting up Context-Aware Access. You want to deny access to Google Workspace if the device is not encrypted. Which tool identifies the 'is_encrypted' attribute?

Accepted Answer

Endpoint Verification extension. Endpoint Verification reports device attributes like encryption status back to Google, which Context-Aware Access then uses to evaluate policies.

Answer

Device policy controller

Answer

Admin console audit logs

Answer

Google Cloud Identity sync

Question 7

You need to deploy a specific Android application to a subset of users. What is the correct procedure?

Accepted Answer

Use the 'Apps' section in the Admin console to select the app from Managed Google Play and assign it to an OU. You must add the app via the Managed Google Play store and then assign it to the specific Organizational Unit (OU) or group.

Answer

Instruct users to download it themselves from the Play Store

Answer

Upload the APK file to the server and email the link to users

Answer

Use a third-party MDM integration

Question 8

A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?

Accepted Answer

The Admin console audit log for mobile management. The device audit log provides the necessary visibility into whether a command was successfully executed by the server and acknowledged by the device.

Answer

The Google Cloud Platform logs

Answer

The user's account status in the directory

Answer

The user's Gmail sent items

Question 9

Your company wants to prevent employees from using personal Google accounts on company-owned ChromeOS devices. Which setting should you enable?

Accepted Answer

Device settings > Sign-in settings > Sign-in restriction. Blocking accounts on managed ChromeOS devices is a standard device policy to prevent data exfiltration.

Answer

User settings > Accounts > Prevent adding accounts

Answer

Security > Chrome > Account management

Answer

App management > Block personal accounts

Question 10

A user reports that their Android work profile is no longer syncing corporate emails. As an administrator, which action should you perform first in the Google Admin console to investigate?

Accepted Answer

View the device details in the Device Management section of the Admin console. Checking the device status in the Admin console provides immediate insight into sync errors or compliance issues.

Answer

Force a factory reset on the user's device

Answer

Remove the user from the mobile management organizational unit

Answer

Disable the user's account in Google Workspace

Question 11

You want to ensure that only company-managed ChromeOS devices can access your Google Workspace environment. Which setting should you modify?

Accepted Answer

Context-Aware Access levels. Context-Aware Access allows you to restrict access based on whether the device is managed by the organization.

Answer

Device enrollment settings

Answer

Security center dashboard

Answer

Chrome browser cloud management settings

Question 12

Where do you go to view a list of all devices currently accessing your organization's data?

Accepted Answer

Devices > Mobile & endpoints > Devices. The 'Devices' section in the Admin console provides a centralized view of all mobile and desktop devices.

Answer

Reports > Audit > Mobile

Answer

Directory > Users > Device list

Answer

Security > Devices

Question 13

You have a mix of company-owned and BYOD mobile devices. You want to apply different policies to each. What is the recommended strategy?

Accepted Answer

Create two separate OUs and apply different mobile settings to each. Using different Organizational Units (OUs) allows you to apply different MDM policies to different groups of devices or users.

Answer

Create a Google Group and apply policies to the group

Answer

Use a third-party MDM for the BYOD devices only

Answer

Create a single OU and use groups for individual device settings

Question 14

A user is unable to install a managed app on their iOS device. What is the first thing you should verify?

Accepted Answer

If the user's device is correctly enrolled in device management. If the device is not enrolled or is in an 'Unmanaged' state, managed apps cannot be pushed to it.

Answer

If the user has updated their iOS version

Answer

If the App Store is restricted on the device

Answer

If the user has an iPhone 14 or later

Question 15

You want to prevent users from copying data from managed apps into personal apps on their mobile devices. Which feature should you configure?

Accepted Answer

Mobile management > Work profile data sharing settings. Data protection features within mobile management help restrict data movement between work and personal containers.

Answer

Endpoint verification data settings

Answer

Context-Aware Access policies

Answer

Chrome browser management

Question 16

What is required for a user to be able to manage their own mobile device in the Google Admin console?

Accepted Answer

User must have the 'Mobile device manager' role. Users do not manage their devices in the Admin console; that is for administrators only.

Answer

User must be in the 'Everyone' group

Answer

There is no way for a user to manage devices

Answer

User must be an owner of the device

Question 17

An employee lost their company-issued Android device. What is the most effective way to secure the data?

Accepted Answer

Use the 'Wipe device' command in the Admin console. Performing a 'Wipe account' or 'Wipe device' command removes corporate data or everything from the device remotely.

Answer

Disable the user's account in Active Directory

Answer

Change the user's password

Answer

Send an email to the employee to delete the data

Question 18

You need to ensure that Chrome browsers on unmanaged devices are secure. What is a key step to take?

Accepted Answer

Use Chrome browser cloud management to enforce policies. Enforcing Chrome browser management allows you to apply policies to the browser regardless of the OS of the underlying device.

Answer

Force users to use Incognito mode

Answer

Require a VPN for all browser traffic

Answer

Disable all extensions

Question 19

Which TWO of the following actions can be performed on an Android device from the Admin console?

Accepted Answer

Remote removal of the work profile. Wiping an account and checking the device's last sync time are core features of MDM.

Answer

Remote control of the camera shutter

Answer

Remote installation of a specific version of Android OS

Answer

Remote physical battery removal

Question 20

Which TWO of the following are prerequisites for setting up iOS device management?

Accepted Answer

Apple Push Certificate. An Apple Push Certificate and Advanced Mobile Management are required to manage iOS devices effectively.

Answer

Physical access to each device

Answer

A custom domain name

Answer

Android Enterprise registration