GWS-ADMIN Multiple Select — 40 Questions

Question 1

A company is preparing for a compliance audit and needs to ensure that all Google Workspace data is retained according to legal requirements. The compliance team asks you to identify which two settings can be configured to prevent users from permanently deleting data. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Google Drive retention rule in Vault to retain files for a set period.. Google Vault retention rules for Gmail and Drive are the primary mechanisms to prevent permanent data deletion. They retain data according to policy, even if users delete items. Other settings like Data Regions or labels do not prevent deletion, and there is no Admin Console toggle to disable delete buttons.

Answer

Apply a data classification label to all files to prevent deletion.

Answer

Set up a Google Workspace Admin Console setting to disable the 'Delete' button for all users.

Answer

Enable 'Data Regions' for all users to store data in a specific geographic location.

Question 2

Which TWO of the following are valid methods to verify domain ownership in Google Workspace? (Choose two)

Accepted Answer

Adding a TXT or CNAME record to your DNS settings.. Google Workspace provides multiple methods for domain verification, including DNS records and file uploads.

Answer

Enabling SSO via a SAML metadata file.

Answer

Sending an email to the registrar's abuse alias.

Answer

Creating a new admin account with the '@gmail.com' suffix.

Question 3

When troubleshooting a SAML application error, which THREE of the following should you check?

Accepted Answer

SAML application metadata. Option A (SAML application metadata) is correct because the metadata XML defines the entity ID, ACS URL, and signing certificates that the IdP and SP exchange; a mismatched or stale metadata file is a common cause of SAML assertion failures. Option C (User attribute mapping) is correct because SAML assertions must carry the attributes the SP expects (for example NameID, email, or role claims), and incorrect or missing mappings cause authorization or login errors. Option E (Certificate expiration status) is correct because SAML signing and encryption certificates have validity periods, and an expired IdP or SP certificate will invalidate assertions and break the trust relationship. Option B (the user's computer operating system) is not relevant because SAML is a browser-based federation protocol independent of the client OS, and Option D (the user's physical location) is not relevant because SAML troubleshooting focuses on identity configuration, not geographic location.

Answer

The user's computer operating system

Answer

The user's physical location

Question 4

Which TWO tools in the Admin Console help you identify potentially compromised accounts?

Accepted Answer

Security dashboard. The Security dashboard (C) is correct because it surfaces security-related metrics and alerts in the Admin Console, including suspicious login activity and other indicators that can point to potentially compromised accounts. The Investigation tool (D) is correct because it lets admins run targeted searches across Gmail, Drive, and other Workspace logs (e.g., login and device events) to dig into anomalous user activity and confirm whether an account has been compromised. Vault search (A) is for eDiscovery and content retention/legal holds, not for identifying compromised accounts. Group settings (B) only manage membership and group configuration, and Data regions (E) controls where data is stored, neither of which helps detect account compromise.

Answer

Vault search

Answer

Group settings

Answer

Data regions

Question 5

A mobile device is not syncing corporate email. Which THREE of the following should you investigate?

Accepted Answer

User account password reset. Option A (User account password reset) is correct because if the user's account password was recently reset, the cached credentials on the mobile device become stale, causing authentication failures against the mail server (e.g., Exchange ActiveSync or IMAP) and halting sync until the password is updated on the device. Option B (Mobile management settings in the Admin console) is correct because MDM/MAM policies such as ActiveSync access rules, device enrollment requirements, or conditional access settings can block or disable email synchronization for that user or device. Option C (Device compliance status) is correct because if the device falls out of compliance (e.g., missing encryption, outdated OS, no passcode, or jailbroken/rooted), conditional access policies will deny it access to corporate email until compliance is restored. Option D (The user's home network speed) is not relevant because slow bandwidth would degrade performance but would not selectively stop corporate email sync while other connectivity works. Option E (The user's browser plugin list) is not relevant because mobile email sync relies on native mail clients and MDM/ActiveSync protocols, not browser plugins.

Answer

The user's home network speed

Answer

The user's browser plugin list

Question 6

You are the Google Workspace administrator for a company that wants to enforce stricter controls on how users share Google Drive files. You need to configure sharing settings at the organizational unit level. Which TWO of the following actions can you perform in the Google Drive sharing settings for an organizational unit? (Choose two.)

Accepted Answer

Prevent users from granting access to files to users outside the organization.. The Drive sharing settings for an organizational unit allow administrators to set the default visibility for new files and to restrict sharing outside the organization. These controls directly shape how users can share files and help enforce stricter governance. The other options describe capabilities that are not part of the native sharing settings, such as forcing files into a shared drive, setting upload size limits, or requiring admin approval for external shares.

Answer

Force all files to be stored in a specific shared drive regardless of where the user creates them.

Answer

Set a maximum file size limit for uploads to Drive for the organizational unit.

Answer

Require that all shared files be reviewed by an administrator before external sharing is allowed.

Question 7

Which THREE actions should you take to secure your Google Workspace environment against unauthorized admin access? (Choose three)

Accepted Answer

Enable 'Admin console sign-in restriction' to trusted IPs.. Option A is correct because enabling 'Admin console sign-in restriction' to trusted IPs in Google Workspace limits where administrators can authenticate to the Admin console, blocking admin sign-ins from untrusted networks and reducing the risk of credential-based unauthorized access. Option C is correct because configuring Audit and Investigation logs (e.g., the Admin audit log and login audit log) with alerts on unusual admin activity provides detection and rapid response to suspicious privileged actions, which is essential for identifying compromised or rogue admin accounts. Option D is correct because requiring Security Keys (FIDO2/WebAuthn phishing-resistant 2-step verification) for all Super Admin accounts protects the highest-privilege accounts against phishing, credential theft, and MFA fatigue attacks. Option B does not belong because forced 30-day password rotation is no longer a recommended security practice and does not specifically address unauthorized admin access. Option E does not belong because disabling non-Google Marketplace apps reduces third-party app risk but does not directly secure admin access to the Google Workspace environment.

Answer

Require a password change every 30 days for all users.

Answer

Disable all non-Google apps in the Marketplace.

Question 8

Which TWO settings in Drive sharing can help prevent data leakage?

Accepted Answer

Prevent viewers from downloading, printing, or copying. Option A is correct because the 'Viewers and commenters can see the option to download, print, and copy' setting in Google Drive sharing can be disabled, which removes the download, print, and copy controls for viewers and commenters, directly reducing the risk of data exfiltration. Option B is correct because limiting sharing to specific domains (via the 'Sharing outside of <domain>' / target audience and allowlist settings) restricts content distribution to trusted organizational domains, preventing leakage to unauthorized external parties. Option C is incorrect because allowing external sharing for all users broadens exposure and increases leakage risk rather than preventing it. Option D is incorrect because letting users set their own sharing permissions removes centralized control and can lead to overly permissive sharing. Option E is incorrect because disabling all Drive sharing is an overly broad, disruptive measure, not a targeted data-leakage prevention setting.

Answer

Allow external sharing for all users

Answer

Enable 'Allow user to set their own sharing'

Answer

Disable all Drive sharing

Question 9

An administrator is configuring Context-Aware Access to secure corporate data. Which TWO criteria can be evaluated within a Context-Aware Access access level expression? (Choose two.)

Accepted Answer

User's current geographic location (country/region).. Context-Aware Access access levels in Google Workspace/Cloud Identity are built from attributes about the user's identity, the request context, and the device, evaluated by Access Context Manager. Option D is correct because access levels can include geographic location conditions, such as the source IP's country/region, to allow or block access based on where the request originates. Option E is correct because device-based conditions are a core part of Context-Aware Access: access levels can require device policy compliance attributes like disk encryption, screen lock, and OS version via endpoint verification/device management. Option A is not a supported access level attribute, as Gmail inbox metrics are not part of Access Context Manager expressions. Option B is not evaluated by Context-Aware Access, since local OS password complexity and history are not exposed as access level criteria. Option C is not a supported criterion, as directory schema fields such as a manager name are not used in access level expressions.

Answer

The number of unread emails in the user's Gmail inbox.

Answer

The user's local operating system password complexity and history length.

Answer

The user's direct manager name listed in the directory schema.

Question 10

Which TWO actions should be taken when offboarding a user to protect organizational data?

Accepted Answer

Suspend the user account. Option B is correct because suspending the user account immediately blocks the offboarded user from signing in and accessing organizational resources such as email, Drive, and other Workspace services, while preserving the account's data for later transfer or audit. Option C is correct because applying a Vault hold preserves the user's data (mail, Drive files, chat, etc.) beyond the normal retention period and prevents it from being purged, which is essential when legal, compliance, or investigation requirements exist. Option A is wrong because billing settings are unrelated to protecting organizational data during offboarding. Option D is wrong because granting full email access would expand the departing user's access rather than restrict it. Option E is wrong because deleting the account immediately can destroy data and remove the ability to transfer ownership or place holds, so suspension is preferred over deletion.

Answer

Reset the user's billing settings

Answer

Grant user full email access

Answer

Delete the user account immediately

Question 11

Which THREE settings can be enforced on Android devices using Advanced mobile management?

Accepted Answer

Managed application deployment. Advanced management allows for mandatory passcodes, managed applications, and remote wipe capabilities.

Answer

Enable the device's GPS tracking

Answer

Force an OS update

Question 12

Which TWO of the following tasks can be performed in the Users section of the Admin console?

Accepted Answer

Assigning a user to a group. Option A is correct because the Users section of the Admin console allows administrators to assign users to groups, controlling group membership and the permissions that come with it. Option E is correct because resetting a user's password is a core user-management task performed from the Users section, where an admin can set a new password for the account. Options B, C, and D do not belong: domain verification is handled in the Domains section (via a TXT or CNAME record), SMTP relay configuration is done in the Apps/Gmail settings (SMTP relay service), and creating a new domain is also a Domains-section task, not a Users-section task.

Answer

Verifying the domain

Answer

Configuring SMTP relays

Answer

Creating a new domain

Question 13

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

Accepted Answer

Enforce hardware security keys as the only allowed 2-Step Verification method for administrator accounts.. Securing admin accounts involves mandating strict 2SV methods and restricting admin access to known IPs or devices.

Answer

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Answer

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Answer

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Question 14

A security team wants to enforce a policy that only company-managed devices can access Gmail and Drive, while personal devices are denied. Which TWO configurations are required in Google Workspace to implement this using Context-Aware Access? (Choose two.)

Accepted Answer

Assign the access level to the Gmail and Drive applications for the target organizational unit.. Context-Aware Access enforces device-based restrictions through access levels that evaluate device attributes. The two required steps are creating an access level that requires company-owned and approved devices, and then assigning that access level to Gmail and Drive for the target organizational unit. Without both steps, the policy either does not exist or does not apply to the apps, so the restriction would not take effect.

Answer

Configure a sign-in challenge that requires a security key for all users in the organizational unit.

Answer

Deploy a Chrome policy to force users to sign in with their managed Google Account on personal devices.

Answer

Enable 2-Step Verification enforcement for all users in the organizational unit.

Question 15

A healthcare organization must comply with HIPAA and wants to ensure that Google Workspace data is protected against insider threats. The security team needs to monitor and alert on suspicious user behavior, such as mass downloads of Drive files and unusual login locations. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable and configure Security Center's investigation tool to create activity rules that trigger alerts on mass download events.. To monitor and alert on suspicious user behavior, the administrator should use Security Center's investigation tool to create activity rules for mass downloads and configure Admin console alerts for unusual login locations. These two actions provide the necessary detection and alerting capabilities. Other options, while important for security, do not directly address the monitoring and alerting requirements for insider threats.

Answer

Use Google Vault to set retention policies that prevent data deletion.

Answer

Configure Data Loss Prevention (DLP) rules to block sharing of sensitive files externally.

Answer

Enforce 2-Step Verification for all users to prevent unauthorized access.

Question 16

Your organization uses Google Workspace and wants to enforce context-aware access for users accessing Gmail from desktop browsers. You need to ensure that only company-owned Windows devices with up-to-date OS patches and encrypted drives are allowed. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Configure a Context-Aware Access access level with conditions for device ownership and encryption.. To enforce Context-Aware Access based on device attributes like ownership, encryption, and OS version, you need the Endpoint Verification extension to gather those attributes and an access level that specifies the conditions. These two components work together to allow or deny access to Gmail from desktop browsers.

Answer

Install the Google Credential Provider for Windows on all company-owned devices.

Answer

Set up a Windows device policy in the Admin console to enforce OS updates and encryption.

Answer

Enable advanced mobile management for Windows devices.

Question 17

A Workspace administrator receives reports that several users in the sales organizational unit cannot sign in to their accounts from newly issued corporate Android devices. The users can sign in successfully from their laptops. The administrator has already confirmed the users' passwords are correct and that no account suspensions are in place. Which TWO of the following should the administrator check to resolve the mobile sign-in failures? (Choose two.)

Accepted Answer

Whether a Google Context-Aware Access access level assigned to the sales OU blocks devices that do not meet device trust requirements.. Sign-in failures that affect only mobile devices while laptops work often point to conditional access or network restrictions. Context-Aware Access access levels can deny devices that lack required security attributes, and IP allowlists can block devices outside approved networks. Both settings can be scoped to an organizational unit and produce exactly the pattern described. Reviewing these two configurations for the sales OU is the most efficient path to resolution.

Answer

Whether the users' Gmail IMAP access is disabled for the sales OU, preventing mobile mail clients from authenticating.

Answer

Whether the sales OU has a password policy that forces a password change on next sign-in for mobile clients only.

Answer

Whether the sales OU has a session length policy that signs users out of mobile apps every hour.

Question 18

An organization uses Google Cloud Directory Sync (GCDS) to keep its Workspace directory aligned with an on-premises LDAP directory. The administrator must ensure that local directory attributes map correctly and that deletes in the source system do not accidentally wipe out Workspace accounts and their data, while still allowing legitimate departures to be processed. Which two configuration practices should the administrator apply? (Choose two.)

Accepted Answer

Enable the option to suspend rather than delete users removed from the source directory.. Exclusion rules keep designated accounts out of the sync scope so they are never modified or deleted, and the suspend-instead-of-delete option preserves data when a source account disappears. Together these practices prevent accidental data loss while still allowing legitimate departures to be reflected as suspended accounts.

Answer

Map every LDAP attribute to a corresponding Workspace field to avoid missing data.

Answer

Grant the sync service account the Super Admin role to avoid permission errors during synchronization.

Answer

Configure the sync to run continuously in real time so attribute changes propagate instantly.

Question 19

Which TWO of the following actions can be performed on an Android device from the Admin console?

Accepted Answer

Remote removal of the work profile. Option B is correct because Android Enterprise management through the Admin console allows an administrator to remotely delete/remove a work profile from a managed device, wiping only the corporate data and apps in that profile. Option D is correct because the Admin console supports issuing a remote factory reset (wipe) command that erases the entire device, returning it to its original out-of-box state. Option A is not valid since the Admin console has no capability to control a device's camera shutter remotely. Option C is not valid because OS version installation/updates are handled by the device manufacturer or carrier OTA process, not pushed as a specific Android OS version from the Admin console. Option E is not valid because physically removing a battery is a hardware action that cannot be performed remotely through any management console.

Answer

Remote control of the camera shutter

Answer

Remote installation of a specific version of Android OS

Answer

Remote physical battery removal

Question 20

Which THREE items can be managed through the 'Directory' section in the Admin Console?

Accepted Answer

User profile editing permissions. In the Google Admin Console, the Directory section is where administrators manage directory-related settings and resources. Option A (User profile editing permissions) is correct because the Directory > Directory settings area lets you control whether users can edit their own profiles and which fields they may change. Option B (Building resources) is correct because Directory > Buildings and Resources is where you create and manage buildings and resource calendars (such as meeting rooms and equipment). Option E (Shared contacts) is correct because Directory > Shared contacts allows you to add external contacts that appear in the directory for your users. Option C (Device management policies) is not in Directory; device policies are configured under Devices (e.g., Mobile & endpoints or Chrome management). Option D (Gmail routing rules) is not in Directory; routing and compliance rules are configured under Apps > Google Workspace > Gmail > Routing, not the Directory section.

Answer

Device management policies

Answer

Gmail routing rules