GWS-ADMIN Endpoint Management Practice Test 4 — 15 Questions

Question 1

You are implementing context-aware access and need to ensure that only devices with a disk-encrypted state are allowed to access Google Drive. Which feature enables this check?

Accepted Answer

Access Levels in Context-Aware Access. Access Levels in Context-Aware Access allow admins to define conditions like 'disk encryption enabled' for device access to Google Workspace apps. This is configured in Admin console > Security > Context-Aware Access, where you create access levels based on device state, IP, user identity, etc.

Answer

Google Workspace Alert Center

Answer

Device policy profiles

Answer

Chrome Enterprise Upgrade

Question 2

Which THREE settings can be enforced on Android devices using Advanced mobile management?

Accepted Answer

Managed application deployment. Advanced management allows for mandatory passcodes, managed applications, and remote wipe capabilities.

Answer

Enable the device's GPS tracking

Answer

Force an OS update

Question 3

When managing ChromeOS devices, which TWO settings can be configured within the 'Device settings' section of the Admin console?

Accepted Answer

Auto-update settings. Option C (Auto-update settings) is correct because the Admin console's Device settings section includes an 'Auto-update settings' area where admins can control the ChromeOS release channel (stable/beta/dev/LTS), pin a specific ChromeOS version, and set auto-update behavior for enrolled devices. Option D (Sign-in restrictions) is correct because Device settings provides sign-in controls such as restricting sign-in to specific domains, allowing or blocking guest mode, and controlling which users can sign in to the device. Option A (User password rotation) is not a ChromeOS Device settings control; password policies are handled through Google Workspace user/security settings, not device-level configuration. Option B (Browser history retention) is not configured in Device settings; history retention is a user-level Chrome/Google Workspace setting rather than a device policy. Option E (Default home page for all users) is not part of Device settings; homepage/startup configuration is applied via user-level Chrome policies or managed browser settings, not the device settings section.

Answer

User password rotation

Answer

Browser history retention

Answer

Default home page for all users

Question 4

Your organization uses Google Workspace and has a fleet of company-owned Windows 10 laptops. You want to ensure that only devices that are company-owned and meet specific security requirements (like disk encryption and screen lock) can access Gmail and Drive. You have already enrolled devices in Windows device management. Which additional step is required to enforce these device-based access policies?

Accepted Answer

Deploy the Endpoint Verification extension to Chrome on each device.. To enforce access based on device security attributes, you must deploy Endpoint Verification. It collects signals such as disk encryption, screen lock, and ownership from Windows, macOS, and Linux devices. These signals are then used by Context-Aware Access to allow or block access to Google Workspace apps. Enabling Context-Aware Access without Endpoint Verification leaves no device data to evaluate, so policies cannot function as intended.

Answer

Configure a device policy in the Admin console under Mobile & endpoints.

Answer

Enable Context-Aware Access for the organizational unit.

Answer

Set up single sign-on (SSO) with a third-party identity provider.

Question 5

Your organization uses Google Workspace and wants to enforce context-aware access for users accessing Gmail from desktop browsers. You need to ensure that only company-owned Windows devices with up-to-date OS patches and encrypted drives are allowed. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Configure a Context-Aware Access access level with conditions for device ownership and encryption.. To enforce Context-Aware Access based on device attributes like ownership, encryption, and OS version, you need the Endpoint Verification extension to gather those attributes and an access level that specifies the conditions. These two components work together to allow or deny access to Gmail from desktop browsers.

Answer

Install the Google Credential Provider for Windows on all company-owned devices.

Answer

Set up a Windows device policy in the Admin console to enforce OS updates and encryption.

Answer

Enable advanced mobile management for Windows devices.

Question 6

You are a Workspace admin. Your company issues Android devices to field technicians. You need to ensure that if a device is lost or stolen, you can remotely wipe only corporate data (Gmail, Drive, Calendar) without erasing personal photos and apps. The devices are enrolled in advanced mobile management. Which action should you take?

Accepted Answer

Use the 'Wipe corporate data' option for the device.. For Android devices in advanced mobile management, the 'Wipe corporate data' option selectively removes only the managed Google Workspace accounts and data. This secures corporate information while preserving personal apps and files. A full remote wipe would erase everything, which is unnecessary and harmful to the user. Suspending the account or changing the password does not remove data already on the device, so they do not satisfy the requirement.

Answer

Perform a remote wipe of the device from the Admin console.

Answer

Change the user's password.

Answer

Suspend the user account.

Question 7

You are a Workspace administrator. Your organization provides company-owned Windows 10 laptops to employees. You want to ensure that only these corporate laptops, which are already enrolled in Windows device management, can access Google Workspace services. You also need to block access from personal Windows devices. Which action should you take?

Accepted Answer

Configure a Context-Aware Access access level that requires the device to be company-owned and enrolled in Windows device management, then apply it to the Google Workspace apps.. Context-Aware Access allows administrators to create access levels that evaluate device attributes, such as ownership and management status. By requiring company-owned and enrolled devices, you ensure that only corporate Windows laptops can access Workspace apps. This is the only option that directly enforces device-based access control tailored to the organization's requirement.

Answer

Set up a device policy in the Admin console that requires Windows devices to be encrypted and have a screen lock, which will block personal devices.

Answer

Use Google Endpoint Verification to collect device signals, and then manually approve each device in the Admin console.

Answer

Enforce 2-Step Verification for all users, which will automatically restrict access to company-owned devices.

Question 8

Your organization allows employees to use personal iOS devices for work. You need to ensure that when a user adds their corporate Google Workspace account to the native iOS Mail app, the device is automatically enrolled in advanced mobile management and a passcode is enforced. What should you do?

Accepted Answer

Enable 'Advanced' mobile management for iOS in the Admin console under Devices > Mobile & endpoints > Settings > Universal settings.. Advanced mobile management for iOS, when enabled for an organizational unit, automatically enrolls personal iOS devices when the user adds a managed Google Workspace account to the native iOS Mail app. This enrollment enforces passcode and encryption policies without requiring the user to install a separate app. It is the designated method for securing BYOD iOS devices in Google Workspace.

Answer

Deploy the Google Device Policy app to all iOS devices via a third-party EMM provider.

Answer

Create a device policy in the Admin console under Devices > Mobile & endpoints > Devices and manually add each iOS device.

Answer

Configure a Context-Aware Access access level that requires a passcode and apply it to the Gmail service.

Question 9

You are configuring Chrome policies for your organization's managed Chrome browser on Windows devices. You want to control which extensions users can install. Which two policies should you configure? (Choose two.)

Accepted Answer

ExtensionInstallAllowlist. The ExtensionInstallAllowlist and ExtensionInstallBlocklist policies are designed to control which extensions users can install. The allowlist restricts installations to only approved extensions, while the blocklist explicitly prevents specific extensions. Used together, they enforce a strict extension policy. Other policies like force list or ExtensionSettings serve different purposes, such as mandatory installations or advanced per-extension configurations, and do not directly fulfill the need for user-installation control.

Answer

ExtensionInstallForcelist

Answer

ChromeWebStoreEnabled

Answer

ExtensionSettings

Question 10

Your organization uses Google Workspace and has a fleet of company-owned ChromeOS devices. You want to ensure that these devices automatically install a set of essential web apps and extensions for all users. You also need to prevent users from uninstalling these apps. Which configuration should you implement?

Accepted Answer

In the Admin console, go to Devices > Chrome > Apps & extensions > Users & browsers, and set the apps and extensions to 'Force-install' for the organizational unit.. Force-installing apps and extensions through the Admin console's Chrome management settings ensures they are automatically installed on enrolled ChromeOS devices and cannot be removed by users. This directly meets the need to deploy essential apps and lock them down. Other options either do not enforce installation or are irrelevant to ChromeOS app management.

Answer

Use Google Play for Education to push the apps to the devices, which will automatically install and lock them.

Answer

Configure a user policy that allows users to install apps from the Chrome Web Store, and then instruct users to install the apps manually.

Answer

Enroll the devices in zero-touch enrollment, which will automatically install the required apps and extensions.

Question 11

Your company uses Windows 10 laptops. You want to ensure that only devices with a valid and up-to-date Endpoint Verification extension and a recent sync can access Google Drive. You have already deployed the extension. Which additional step must you take to enforce this requirement?

Accepted Answer

Create a Context-Aware Access access level that requires the device to be 'Verified' and apply it to Google Drive.. Context-Aware Access allows you to define access levels based on device attributes, including whether the device is 'Verified' by Endpoint Verification. By applying such an access level to Google Drive, you ensure that only devices with the extension installed and recently synced can access the service. This is the intended mechanism for enforcing endpoint verification on desktop devices.

Answer

Enable 'Advanced' mobile management for Windows devices in the Admin console.

Answer

Configure a device policy that blocks access to Google Drive unless the device is company-owned.

Answer

Set up a SAML SSO profile that requires device certificate authentication for Google Drive.

Question 12

A user reports that their company-owned Android device is not receiving work emails. You check the Admin console and see that the device is listed but the status is 'Pending'. What should you do first?

Accepted Answer

Ask the user to open the Google Device Policy app and complete enrollment.. A 'Pending' device status means the enrollment process was initiated but not completed. The user must open the Google Device Policy app and finish the steps to enroll the device. This app is essential for advanced mobile management and applies the necessary policies. Once enrollment is complete, the device status changes to 'Approved' or similar, and work email will begin syncing. Other actions like re-enrolling or checking licenses are not appropriate first steps.

Answer

Check if the user has exceeded their license limit.

Answer

Verify that the device has an active internet connection.

Answer

Remove the device from the Admin console and re-enroll it.

Question 13

You are a Workspace administrator. Your organization has a fleet of company-owned Windows devices that are already enrolled in Windows device management and synced to Google Workspace. You want to prevent users from signing in to their Google Account on any Windows device that is not company-owned, without affecting Android or iOS users. What should you do?

Accepted Answer

In Admin console > Security > Access and data control > Context-Aware Access, create an access level that requires the device to be company-owned for Windows devices, then assign it to the Google Workspace apps.. Context-Aware Access is the feature that evaluates device attributes such as ownership and OS to grant or deny access to Workspace apps. By creating an access level that requires company-owned Windows devices and assigning it to the relevant apps, you restrict unmanaged Windows sign-ins while leaving Android and iOS users alone. Other settings either do not exist or do not target Windows specifically.

Answer

In Admin console > Directory > Users, disable 'Allow users to sign in from any device'.

Answer

In Admin console > Devices > Mobile & endpoints > Windows, set 'Windows device management' to 'Block unmanaged devices'.

Answer

In Admin console > Security > Authentication > SSO, require device certificates for Windows.

Question 14

A user reports that their company-owned Android device is not receiving work emails in the Gmail app. You check the Admin console and see that the device is listed as 'Compromised'. What is the most likely cause?

Accepted Answer

The device has been rooted, which triggers the compromised status.. Google Mobile Management marks a device as compromised when it detects security compromises such as rooting (Android) or jailbreaking (iOS). Rooting gives superuser access, undermining device security. The compromised status typically triggers policy actions, such as blocking access to work data. Thus, rooting is the most likely cause for the user's issue.

Answer

The device is running an outdated version of Android, which automatically flags it as compromised.

Answer

The user has installed a third-party app from outside the Google Play Store, which is always considered compromised.

Answer

The device has not been enrolled in Google Mobile Management, so it is flagged as compromised.

Question 15

Your organization uses Google Workspace and has a fleet of Windows 10 laptops managed by a third-party UEM tool. You need to enforce Context-Aware Access so that users can access Workspace apps only from devices that meet your security policies. What should you deploy on each Windows device to enable device-based access levels?

Accepted Answer

Deploy the Endpoint Verification extension to Google Chrome on each device. Context-Aware Access relies on device attributes to make access decisions. For Windows, macOS, and Linux, the Endpoint Verification extension is required to gather those attributes. It reports on disk encryption, OS version, and other security settings, which are then used in access levels. Without it, device-based access levels cannot be enforced.

Answer

Enroll the devices in Advanced mobile management

Answer

Configure a Chrome user policy to force sign-in and enable sync

Answer

Install the Google Credential Provider for Windows (GCPW)