GWS-ADMIN Endpoint Management Practice Test 2 — 15 Questions

Question 1

You are a Workspace administrator. Your organization recently purchased 50 new Windows 11 laptops for the sales team. You need to ensure these devices can access Google Workspace only if they meet specific security requirements, such as having disk encryption enabled and a screen lock configured. These devices are not domain-joined to a third-party identity provider. Which Google Workspace feature should you use to enforce these device-based access policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Endpoint Verification. Endpoint Verification is the correct tool because it collects device security signals such as disk encryption and screen lock from Windows, macOS, Linux, and ChromeOS devices. These signals are then evaluated by Context-Aware Access to allow or block access to Workspace apps. The other options either target mobile platforms, lack the ability to gather device posture, or focus solely on browser management, making them unsuitable for enforcing device-based access policies on Windows laptops.

Answer

Context-Aware Access only

Answer

Advanced mobile device management

Answer

Chrome Browser Cloud Management

Question 2

You are managing a fleet of ChromeOS devices. You need to allow users to enroll their own devices (BYOD) but still enforce certain security policies. Which TWO actions must you take? (Choose two.)

Accepted Answer

Enable 'Allow users to enroll their own devices' in the Admin console under Devices > Chrome > Settings > User & browser settings.. To allow BYOD ChromeOS enrollment, you must enable the setting that permits users to enroll their own devices. Once enrolled, you can enforce security policies such as screen lock and minimum OS version through device settings. These two actions together enable BYOD while maintaining security. Other options are either irrelevant or incorrect for ChromeOS management.

Answer

Set up a SAML SSO profile for ChromeOS device enrollment.

Answer

Enable 'Force re-enrollment' to ensure devices are wiped before enrollment.

Answer

Deploy the Google Device Policy app to all ChromeOS devices.

Question 3

You are responsible for managing a large fleet of ChromeOS devices. You need to configure automatic updates so that devices receive ChromeOS updates but are pinned to a specific major version for compatibility with an internal web app. Which TWO settings should you configure in the Admin console? (Choose two.)

Accepted Answer

Set the 'Release channel' to 'LTS' and select the desired major version.. To pin ChromeOS devices to a specific major version while still receiving security updates, you configure the auto update policy to allow updates and specify a target version, and you set the release channel to LTS with the desired major version. LTS channels provide a stable base with only security fixes, and the auto update policy enforces the version. Other settings either do not control version or would prevent updates.

Answer

Enable 'Force re-enrollment' to apply the version pin.

Answer

Set 'Update policy' to 'Manual' and push updates via Google Admin console.

Answer

Configure 'Scheduled update window' to delay updates by 30 days.

Question 4

You are a Workspace administrator managing ChromeOS devices. You need to configure policies that apply to all users on these devices. Which TWO settings can be configured in the Admin console under Device settings > Chrome > User & browser settings? (Choose two.)

Accepted Answer

Block all extensions except those whitelisted.. Under User & browser settings in the Admin console, administrators can configure policies that affect the Chrome browser experience for users on ChromeOS devices. Setting the homepage URL and managing extension allowlists/blocklists are two such settings. These policies apply to all users and help standardize and secure the browsing environment.

Answer

Enforce incognito mode for all users.

Answer

Enable guest mode browsing.

Answer

Automatically reboot the device after updates.

Question 5

You are a Workspace administrator. Your organization has a mix of Android and iOS devices accessing corporate data. You want to apply different security policies to company-owned devices versus employee-owned (BYOD) devices. Which TWO of the following approaches should you use to achieve this? (Choose two.)

Accepted Answer

Apply default mobile settings to the root OU for BYOD devices and create a child OU for company-owned devices with stricter settings.. The correct approaches involve using organizational units to separate users based on device ownership and then applying different mobile management settings to each OU. Option A suggests using OUs directly, and option E uses OU hierarchy with inherited settings. Both achieve differentiated policies. The other options either do not apply mobile device policies (Context-Aware Access), are not granular enough (device-level policies), or do not differentiate by ownership (advanced management for all).

Answer

Use Google Groups to segment users by device ownership, then apply different Context-Aware Access levels to each group.

Answer

Configure device-level policies based on device ownership status in the Admin console under Devices > Mobile & endpoints > Devices.

Answer

Enable advanced mobile management for all devices, then use device approval to differentiate policies.

Question 6

Your organization uses Chrome Browser Cloud Management to manage browsers on Windows and Mac devices. You need to ensure that users cannot bypass the proxy settings configured by your organization. Which policy should you set?

Accepted Answer

ProxySettings with the 'ProxySettings' policy set to 'enforced'. To prevent users from bypassing proxy settings in Chrome Browser Cloud Management, you set the ProxySettings policy to 'enforced'. This locks the proxy configuration and disallows user modifications. Other policies like ProxyMode or ProxySettingsEnabled do not independently enforce the proxy and prevent bypass; they must be used together, but the key is the enforcement setting.

Answer

ProxySettings and ProxySettingsEnabled

Answer

ProxySettings

Answer

ProxyMode

Question 7

You are a Workspace administrator. Your company uses Chrome Browser Cloud Management to manage Chrome browsers on employee devices. You need to ensure that employees cannot install extensions from the Chrome Web Store unless they are explicitly allowed by your organization. Which setting should you configure?

Accepted Answer

Extension install policy set to 'Block all' and allowlist specific extensions. To block all extensions except those explicitly allowed, you must set the extension install policy to block all (using a wildcard in the blocklist) and then specify allowed extensions in the allowlist. This combination ensures that users cannot install arbitrary extensions from the Chrome Web Store. Other options alone, such as an allowlist or blocklist without the block-all setting, do not fully restrict installations to approved extensions.

Answer

Force-installed extensions

Answer

Extension blocklist

Answer

Extension allowlist

Question 8

You are the Workspace administrator for a company that has a mix of company-owned and personally owned iOS devices. Executives have asked you to ensure that work data on all iOS devices is isolated from personal data, without requiring users to enroll their personal devices in full device management. Which Google Workspace endpoint management approach should you implement?

Accepted Answer

Configure iOS mobile management as Advanced, which uses the iOS MDM protocol to create a managed work profile with separate managed apps.. Advanced mobile management for iOS uses Apple's MDM protocol to enroll devices and allows work data to be contained in managed apps while personal data remains outside management. This provides the isolation executives requested without requiring full device management or impacting personal apps. Basic management lacks containerization, and the other options are platform-incompatible or not designed for iOS data separation.

Answer

Deploy the Endpoint Verification extension to all iOS devices, which creates a secure container for work data.

Answer

Configure iOS mobile management as Basic, which enforces a passcode and separates work data using managed Google apps.

Answer

Enable Android work profiles for iOS devices through the Admin console, which separates work and personal apps.

Question 9

You need to ensure that all corporate-owned Android devices require a screen lock. Where should you configure this setting?

Accepted Answer

Devices > Mobile & endpoints > Settings > Android > Password settings. Android screen lock enforcement for corporate-owned devices is configured under Devices > Mobile & endpoints > Settings > Android > Password settings, where admins set password strength, length, and lock requirements that apply to managed Android devices. This is the mobile device management (MDM) policy path, distinct from user account password policy.

Answer

Apps > Google Workspace > Android settings

Answer

Security > Authentication > Password policy

Answer

Directory > Users > Security settings

Question 10

You want to require that all corporate-owned iOS devices are encrypted. How is this achieved?

Accepted Answer

Configure a passcode policy in the iOS device management settings. Apple devices (iOS) are encrypted by default when a passcode is set. Therefore, enforcing a passcode policy effectively enforces encryption.

Answer

Enable Advanced Mobile Management for all iOS users

Answer

Use an MDM profile to force file-level encryption

Answer

Enable the 'Require disk encryption' setting in iOS mobile settings

Question 11

You are configuring Endpoint Verification. What is the primary purpose of the Endpoint Verification extension on a user's browser?

Accepted Answer

To collect device information for context-aware access. Endpoint Verification is a Chrome extension (and mobile agent) that collects device attributes such as OS version, screen lock status, disk encryption, and serial number, and reports them to Google. These signals feed into context-aware access policies, allowing admins to grant or deny access to Workspace apps based on device posture. Its primary purpose is to provide device context for access decisions.

Answer

To enable remote wipe capabilities

Answer

To enforce password complexity

Answer

To block all malicious websites

Question 12

You are setting up Context-Aware Access. You want to deny access to Google Workspace if the device is not encrypted. Which tool identifies the 'is_encrypted' attribute?

Accepted Answer

Endpoint Verification extension. Endpoint Verification reports device attributes like encryption status back to Google, which Context-Aware Access then uses to evaluate policies.

Answer

Device policy controller

Answer

Admin console audit logs

Answer

Google Cloud Identity sync

Question 13

You need to deploy a specific Android application to a subset of users. What is the correct procedure?

Accepted Answer

Use the 'Apps' section in the Admin console to select the app from Managed Google Play and assign it to an OU. The correct procedure is to use the 'Apps' section in the Admin console to select the app from Managed Google Play and assign it to an OU. This allows administrators to deploy specific Android applications to a subset of users by targeting organizational units (OUs), ensuring controlled distribution and policy enforcement.

Answer

Instruct users to download it themselves from the Play Store

Answer

Upload the APK file to the server and email the link to users

Answer

Use a third-party MDM integration

Question 14

A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?

Accepted Answer

The Admin console audit log for mobile management. The device audit log provides the necessary visibility into whether a command was successfully executed by the server and acknowledged by the device.

Answer

The Google Cloud Platform logs

Answer

The user's account status in the directory

Answer

The user's Gmail sent items

Question 15

A user reports that their Android work profile is no longer syncing corporate emails. As an administrator, which action should you perform first in the Google Admin console to investigate?

Accepted Answer

View the device details in the Device Management section of the Admin console. Checking the device status in the Admin console provides immediate insight into sync errors or compliance issues.

Answer

Force a factory reset on the user's device

Answer

Remove the user from the mobile management organizational unit

Answer

Disable the user's account in Google Workspace