GWS-ADMIN Hard Questions — 25 Difficult Questions

Question 1

Your organization wants to ensure that all outgoing mail is routed through a third-party email security gateway for scanning. What is the correct configuration?

Accepted Answer

Apps > Google Workspace > Gmail > Routing. Outbound routing is configured in Apps > Google Workspace > Gmail > Routing by setting an outbound gateway.

Answer

Security > Compliance > Gateway

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Network > SMTP relay

Question 2

You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?

Accepted Answer

Security > Access and data control > API controls > Manage domain-wide delegation. For service accounts performing domain-wide delegation, scopes must be defined in the Security > Access and data control > API controls > Manage domain-wide delegation section.

Answer

Account > Security > App access

Answer

Directory > Users > Service Accounts

Answer

Apps > Google Workspace > Gmail > API

Question 3

A Google Workspace administrator notices that a user's account is repeatedly locked out after multiple failed login attempts from different IP addresses. The user insists they are not attempting to sign in. What should the administrator do first to mitigate the issue?

Accepted Answer

Check the user's recent login activity and audit logs for suspicious IPs.. Repeated lockouts from different IPs indicate a potential brute-force or credential-stuffing attack. The administrator should first review login audit logs to identify the attacking IPs and assess the threat. This informs subsequent actions, such as blocking IPs, enforcing two-step verification, or resetting passwords. Suspending the account or resetting the password without investigation may not stop the attack or could disrupt the user unnecessarily.

Answer

Enable two-step verification for the user and require it immediately.

Answer

Temporarily suspend the user's account to stop the lockouts.

Answer

Reset the user's password and enforce a password change at next login.

Question 4

A healthcare organization uses Google Workspace. A compliance officer asks you to ensure that any Gmail message containing a patient identifier is automatically quarantined for review rather than delivered. Which configuration accomplishes this with the least administrative overhead?

Accepted Answer

Configure a Gmail DLP rule with a custom pattern and set the action to quarantine.. Gmail DLP evaluates message content against detectors and can take actions such as quarantine, which places the message in a review queue. This directly addresses the need to hold messages containing patient identifiers instead of delivering them, and it requires only a single DLP rule rather than custom routing.

Answer

Create a content compliance rule that adds a header to matching messages.

Answer

Add the pattern to the blocked senders list in Gmail settings.

Answer

Use an attachment compliance rule to reject messages with matching attachments.

Question 5

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 6

A user reports that emails sent to a specific external domain are bouncing with a '550 5.7.1' error. What is the likely reason?

Accepted Answer

The domain's email authentication (SPF/DKIM/DMARC) is failing.. 550 5.7.1 errors are typically related to SPF, DKIM, or DMARC failures, indicating the recipient domain is rejecting the mail due to authentication issues.

Answer

The message size exceeds the limit.

Answer

The user's storage quota is exceeded.

Answer

The recipient's mailbox is full.

Question 7

Your company uses Windows 10 laptops. You want to ensure that only devices with a valid and up-to-date Endpoint Verification extension and a recent sync can access Google Drive. You have already deployed the extension. Which additional step must you take to enforce this requirement?

Accepted Answer

Create a Context-Aware Access access level that requires the device to be 'Verified' and apply it to Google Drive.. Context-Aware Access allows you to define access levels based on device attributes, including whether the device is 'Verified' by Endpoint Verification. By applying such an access level to Google Drive, you ensure that only devices with the extension installed and recently synced can access the service. This is the intended mechanism for enforcing endpoint verification on desktop devices.

Answer

Enable 'Advanced' mobile management for Windows devices in the Admin console.

Answer

Configure a device policy that blocks access to Google Drive unless the device is company-owned.

Answer

Set up a SAML SSO profile that requires device certificate authentication for Google Drive.

Question 8

When troubleshooting a SAML application error, which THREE of the following should you check?

Accepted Answer

SAML application metadata. Option A (SAML application metadata) is correct because the metadata XML defines the entity ID, ACS URL, and signing certificates that the IdP and SP exchange; a mismatched or stale metadata file is a common cause of SAML assertion failures. Option C (User attribute mapping) is correct because SAML assertions must carry the attributes the SP expects (for example NameID, email, or role claims), and incorrect or missing mappings cause authorization or login errors. Option E (Certificate expiration status) is correct because SAML signing and encryption certificates have validity periods, and an expired IdP or SP certificate will invalidate assertions and break the trust relationship. Option B (the user's computer operating system) is not relevant because SAML is a browser-based federation protocol independent of the client OS, and Option D (the user's physical location) is not relevant because SAML troubleshooting focuses on identity configuration, not geographic location.

Answer

The user's computer operating system

Answer

The user's physical location

Question 9

You are migrating users from a secondary domain to the primary domain. What is the impact on their email?

Accepted Answer

The old email address becomes an alias. Changing a primary domain email requires renaming the user, which creates an alias of the old address.

Answer

The user must re-verify their identity

Answer

Data is lost

Answer

The user is automatically suspended

Question 10

Your organization has a mix of Windows, macOS, and Linux devices. You want to use Context-Aware Access to block access to Google Drive from devices that do not have disk encryption enabled. You have deployed Endpoint Verification to all devices. Which access level condition should you use?

Accepted Answer

Device encryption status is 'Encrypted'.. Context-Aware Access access levels can include a condition for disk encryption based on Endpoint Verification data. By requiring the device to be encrypted, you ensure that only devices with encryption enabled can access Drive. Other conditions like management status or screen lock do not verify encryption and would not satisfy the policy.

Answer

Device management status is 'Managed'.

Answer

Device operating system is 'Windows' or 'macOS' or 'Linux'.

Answer

Device screen lock is 'Enabled'.

Question 11

You need to create a custom administrator role that allows a security analyst to use the Security Center Investigation Tool, view audit logs, and manage alerts, but prevents them from modifying user passwords or organizational unit structures. Which exact set of privileges should you assign?

Accepted Answer

Select privileges from Security Center (Investigation Tool, Alerts) and Reporting (Audit logs), while leaving User Management and OU privileges unchecked.. The correct approach is to create a custom role by selecting only the necessary privileges: Security Center (Investigation Tool, Alerts) and Reporting (Audit logs), while leaving User Management and OU privileges unchecked. This grants the security analyst the required access without granting unnecessary permissions.

Answer

Grant 'Super Admin' privileges and restrict access using Context-Aware Access.

Answer

Assign the 'Helpdesk Admin' role combined with 'Security Center Reader'.

Answer

Assign the built-in 'Security Admin' role and remove user management privileges via override.

Question 12

You are the Google Workspace administrator for a company that wants to enforce stricter controls on how users share Google Drive files. You need to configure sharing settings at the organizational unit level. Which TWO of the following actions can you perform in the Google Drive sharing settings for an organizational unit? (Choose two.)

Accepted Answer

Prevent users from granting access to files to users outside the organization.. The Drive sharing settings for an organizational unit allow administrators to set the default visibility for new files and to restrict sharing outside the organization. These controls directly shape how users can share files and help enforce stricter governance. The other options describe capabilities that are not part of the native sharing settings, such as forcing files into a shared drive, setting upload size limits, or requiring admin approval for external shares.

Answer

Force all files to be stored in a specific shared drive regardless of where the user creates them.

Answer

Set a maximum file size limit for uploads to Drive for the organizational unit.

Answer

Require that all shared files be reviewed by an administrator before external sharing is allowed.

Question 13

You have a Data Region policy, but a user is still showing data in the global region. What is the most likely cause?

Accepted Answer

The user's OU is not in a region-mapped group. Data Regions in Google Workspace are enforced through organizational units (OUs) and groups mapped to specific regions. If a user is not placed in a region-mapped group or OU, their data is processed and stored in the default global region, even if a Data Region policy exists. The most likely cause is that the user's OU is not included in the region-mapped group, so the policy does not apply to them.

Answer

The account is suspended

Answer

The user hasn't logged in recently

Answer

Vault hold is preventing the move

Question 14

You have a Data Region policy configured for the US. A user moves from the US to the EU. How do you trigger the migration of their existing data to the EU?

Accepted Answer

Move the user to an OU configured for the EU data region. Data regions are applied based on the organizational unit (OU) a user belongs to. To migrate a user's existing data from the US to the EU region, you move the user into an OU that has the EU data region policy configured, which triggers Google to migrate their data to the EU.

Answer

Manually run a data export in Vault

Answer

Re-provision the user account

Answer

Contact Google Support to initiate a manual migration

Question 15

A Google Workspace administrator needs to delegate the ability to manage user accounts and reset passwords to a helpdesk team, but must ensure they cannot access Gmail content or modify security settings. Which role should be assigned to the helpdesk team?

Accepted Answer

User Management Admin. The User Management Admin role is specifically designed to allow managing users and resetting passwords without granting access to Gmail content or security settings. Super Admin is too broad, while Groups Admin and Services Admin lack the necessary user management capabilities.

Answer

Groups Admin

Answer

Services Admin

Answer

Super Admin

Question 16

Which THREE actions should you take to secure your Google Workspace environment against unauthorized admin access? (Choose three)

Accepted Answer

Enable 'Admin console sign-in restriction' to trusted IPs.. Option A is correct because enabling 'Admin console sign-in restriction' to trusted IPs in Google Workspace limits where administrators can authenticate to the Admin console, blocking admin sign-ins from untrusted networks and reducing the risk of credential-based unauthorized access. Option C is correct because configuring Audit and Investigation logs (e.g., the Admin audit log and login audit log) with alerts on unusual admin activity provides detection and rapid response to suspicious privileged actions, which is essential for identifying compromised or rogue admin accounts. Option D is correct because requiring Security Keys (FIDO2/WebAuthn phishing-resistant 2-step verification) for all Super Admin accounts protects the highest-privilege accounts against phishing, credential theft, and MFA fatigue attacks. Option B does not belong because forced 30-day password rotation is no longer a recommended security practice and does not specifically address unauthorized admin access. Option E does not belong because disabling non-Google Marketplace apps reduces third-party app risk but does not directly secure admin access to the Google Workspace environment.

Answer

Require a password change every 30 days for all users.

Answer

Disable all non-Google apps in the Marketplace.

Question 17

Your organization requires that all Google Meet recordings be saved to a specific shared folder. How can you automate this?

Accepted Answer

It is not possible to change the default location via Admin Console settings. Google Meet recordings are saved to the meeting organizer's Drive by default, and the Admin Console does not provide a setting to redirect recordings to a specific shared folder. Admins can control whether recordings are allowed and who can record, but the storage location is determined by the organizer's Drive. To centralize recordings, organizations must use Drive sharing or a third-party tool, not an Admin Console path setting.

Answer

Set the 'Default storage' path in Apps > Google Workspace > Meet

Answer

Configure the 'Recording location' in Meet settings

Answer

Create a Drive retention policy for Meet

Question 18

An administrator is configuring Context-Aware Access to secure corporate data. Which TWO criteria can be evaluated within a Context-Aware Access access level expression? (Choose two.)

Accepted Answer

User's current geographic location (country/region).. Context-Aware Access access levels in Google Workspace/Cloud Identity are built from attributes about the user's identity, the request context, and the device, evaluated by Access Context Manager. Option D is correct because access levels can include geographic location conditions, such as the source IP's country/region, to allow or block access based on where the request originates. Option E is correct because device-based conditions are a core part of Context-Aware Access: access levels can require device policy compliance attributes like disk encryption, screen lock, and OS version via endpoint verification/device management. Option A is not a supported access level attribute, as Gmail inbox metrics are not part of Access Context Manager expressions. Option B is not evaluated by Context-Aware Access, since local OS password complexity and history are not exposed as access level criteria. Option C is not a supported criterion, as directory schema fields such as a manager name are not used in access level expressions.

Answer

The number of unread emails in the user's Gmail inbox.

Answer

The user's local operating system password complexity and history length.

Answer

The user's direct manager name listed in the directory schema.

Question 19

You are responsible for managing a large fleet of ChromeOS devices. You need to configure automatic updates so that devices receive ChromeOS updates but are pinned to a specific major version for compatibility with an internal web app. Which TWO settings should you configure in the Admin console? (Choose two.)

Accepted Answer

Set the 'Release channel' to 'LTS' and select the desired major version.. To pin ChromeOS devices to a specific major version while still receiving security updates, you configure the auto update policy to allow updates and specify a target version, and you set the release channel to LTS with the desired major version. LTS channels provide a stable base with only security fixes, and the auto update policy enforces the version. Other settings either do not control version or would prevent updates.

Answer

Enable 'Force re-enrollment' to apply the version pin.

Answer

Set 'Update policy' to 'Manual' and push updates via Google Admin console.

Answer

Configure 'Scheduled update window' to delay updates by 30 days.

Question 20

A multinational corporation uses Google Workspace and has implemented Data Regions for its EU users, storing their data in the European Union. A user in the EU moves to the United States and continues to access Google Workspace. The compliance team wants to ensure that this user's data remains stored in the EU after the move. What should the administrator do?

Accepted Answer

Update the user's organizational unit to one that has the EU Data Region policy applied, and then trigger a data migration for that user.. Data Regions in Google Workspace are enforced by organizational unit policies. When a user moves, their OU may need to be updated to maintain the EU Data Region. After assigning the correct OU, a data migration must be triggered to move any data that was stored in the US back to the EU. This ensures ongoing compliance with data residency requirements.

Answer

Change the user's profile country to the United States, and the Data Region will automatically update to keep data in the EU.

Answer

No action is needed; Data Regions automatically follow the user regardless of their physical location.

Answer

Disable Data Regions for the user, allow data to be stored globally, and then re-enable EU Data Region to force migration.