GWS-ADMIN Endpoint Management Practice Test 3 — 15 Questions

Question 1

Where do you go to view a list of all devices currently accessing your organization's data?

Accepted Answer

Devices > Mobile & endpoints > Devices. The 'Devices' section in the Admin console provides a centralized view of all mobile and desktop devices.

Answer

Reports > Audit > Mobile

Answer

Directory > Users > Device list

Answer

Security > Devices

Question 2

A user is unable to install a managed app on their iOS device. What is the first thing you should verify?

Accepted Answer

If the user's device is correctly enrolled in device management. If the device is not enrolled or is in an 'Unmanaged' state, managed apps cannot be pushed to it.

Answer

If the user has updated their iOS version

Answer

If the App Store is restricted on the device

Answer

If the user has an iPhone 14 or later

Question 3

You want to prevent users from copying data from managed apps into personal apps on their mobile devices. Which feature should you configure?

Accepted Answer

Mobile management > Work profile data sharing settings. Data protection features within mobile management help restrict data movement between work and personal containers.

Answer

Endpoint verification data settings

Answer

Context-Aware Access policies

Answer

Chrome browser management

Question 4

An employee lost their company-issued Android device. What is the most effective way to secure the data?

Accepted Answer

Use the 'Wipe device' command in the Admin console. Performing a 'Wipe account' or 'Wipe device' command removes corporate data or everything from the device remotely.

Answer

Disable the user's account in Active Directory

Answer

Change the user's password

Answer

Send an email to the employee to delete the data

Question 5

You need to ensure that Chrome browsers on unmanaged devices are secure. What is a key step to take?

Accepted Answer

Use Chrome browser cloud management to enforce policies. Using Chrome browser cloud management to enforce policies is a key step to secure Chrome browsers on unmanaged devices. This allows administrators to apply security policies centrally to Chrome browsers regardless of device management status, ensuring consistent protection.

Answer

Force users to use Incognito mode

Answer

Require a VPN for all browser traffic

Answer

Disable all extensions

Question 6

Which TWO of the following actions can be performed on an Android device from the Admin console?

Accepted Answer

Remote removal of the work profile. Option B is correct because Android Enterprise management through the Admin console allows an administrator to remotely delete/remove a work profile from a managed device, wiping only the corporate data and apps in that profile. Option D is correct because the Admin console supports issuing a remote factory reset (wipe) command that erases the entire device, returning it to its original out-of-box state. Option A is not valid since the Admin console has no capability to control a device's camera shutter remotely. Option C is not valid because OS version installation/updates are handled by the device manufacturer or carrier OTA process, not pushed as a specific Android OS version from the Admin console. Option E is not valid because physically removing a battery is a hardware action that cannot be performed remotely through any management console.

Answer

Remote control of the camera shutter

Answer

Remote installation of a specific version of Android OS

Answer

Remote physical battery removal

Question 7

Which of the following is true regarding 'Advanced' mobile management for iOS?

Accepted Answer

It allows administrators to manage Wi-Fi profiles and certificates. Advanced management provides more control, such as certificate management and enterprise Wi-Fi configuration, compared to Basic management.

Answer

It replaces the need for an Apple Push Certificate

Answer

It automatically removes the device after 30 days

Answer

It is required for all Android devices

Question 8

A user complains that they cannot access their work email. You see the device is marked as 'Blocked' in the Admin console. What should you do?

Accepted Answer

Approve the device in the mobile management list. If a device is blocked, changing the status to 'Approved' or 'Unblocked' will restore access.

Answer

Send a 'Sync' command

Answer

Factory reset the device

Answer

Delete the device record

Question 9

You are configuring a 'Work profile' for Android. What is the primary benefit of this setup?

Accepted Answer

It separates work data and apps from personal data on the same device. Work profiles isolate work data from personal data, ensuring privacy for the user and security for the company.

Answer

It allows the company to see all personal messages

Answer

It prevents the user from taking photos

Answer

It forces the user to use a specific launcher

Question 10

Which THREE of the following attributes can be used in Context-Aware Access policies?

Accepted Answer

OS version. Context-Aware Access policies in Google Workspace evaluate device and user context signals, and OS version (A) is a supported attribute used to allow or block access based on the operating system and its version (e.g., requiring a minimum macOS or Windows build). Device encryption status (B) is also a valid attribute, letting admins require that a device's storage be encrypted before granting access to Workspace apps. Device management status (E) is supported as well, distinguishing Basic, Advanced, and Managed device states so policies can restrict access to managed devices only. The user's favorite browser (C) is not a security-relevant context attribute and is not configurable in Context-Aware Access, and the user's physical GPS location (D) is not an available attribute — geographic restrictions rely on IP address ranges rather than GPS coordinates.

Answer

User's favorite browser

Answer

User's physical GPS location

Question 11

Which TWO of the following methods can be used to enroll Android devices?

Accepted Answer

QR code scanning. QR code scanning (C) is a valid Android enrollment method in which the device's setup wizard or the Android Device Policy app reads a QR code containing the enrollment token and server details, allowing the device to register with the management service without manual configuration. Zero-touch enrollment (D) is also correct because it lets an organization pre-register devices purchased through authorized resellers so they automatically enroll into the EMM/MDM during initial setup, with no user action required. Manually entering the server IP address (A) is not a standard Android enrollment method, as enrollment relies on tokens, QR codes, or managed Google accounts rather than raw IP entry. A physical USB cable connection to the Admin's PC (B) is not an Android enrollment mechanism; USB is used for ADB debugging or flashing, not for EMM enrollment. Installing a third-party root certificate (E) is unrelated to enrollment and would not register a device with a management service.

Answer

Manually entering the server IP address

Answer

Physical USB cable connection to the Admin's PC

Answer

Installing a third-party root certificate

Question 12

Which TWO of the following can be enforced via ChromeOS device settings?

Accepted Answer

Forced re-enrollment after factory reset. Enforcing forced re-enrollment and restricted sign-in are core device security policies.

Answer

Automatic screen cleaning

Answer

Mandatory screen brightness levels

Answer

Automatic battery calibration

Question 13

Which THREE of the following are settings that can be controlled in the Chrome browser for all users?

Accepted Answer

Force-installing extensions. Extension installation, homepage URL, and bookmark sync are controllable browser policies.

Answer

Forcing a specific font size

Answer

Enforcing a specific desktop wallpaper

Question 14

You want to ensure that only managed Chrome devices can access your organization's Google Workspace data. Which tool should you configure to verify the security posture of the device before allowing access?

Accepted Answer

Chrome Endpoint Verification. Endpoint Verification is the tool used to verify device security posture and report it to the Admin console.

Answer

Google Workspace Migrate

Answer

Google Cloud Identity

Answer

Chrome Remote Desktop

Question 15

You need to distribute a specific internal Android app to a subset of users. What is the most efficient way to achieve this using Google Workspace?

Accepted Answer

Add the app to the Managed Google Play store and assign to an OU. Adding the app to the managed Google Play store and assigning it to specific organizational units (OUs) allows for controlled distribution.

Answer

Enable 'Allow all apps' in the mobile device settings

Answer

Manually install the APK on every user's device

Answer

Send the APK via email to all employees