GWS-ADMIN Security Policies And Access Controls — 15 Questions

Question 1

An administrator needs to configure password requirements, such as minimum length and expiration policies, for all users in the domain. Where is this configured in the Google Admin console?

Accepted Answer

Security > Password management. Password requirements such as minimum length, expiration, and strength are configured in the Google Admin console under Security > Password management. This centralized location applies policies across the entire domain for all users. It is the correct path for enforcing domain-wide password rules.

Answer

Apps > Google Workspace > Gmail > Security

Answer

Directory > Users > Password settings

Answer

Account settings > Personalization > Passwords

Question 2

Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?

Accepted Answer

Configure SSO profile assignment to exclude Super Administrators or use the 'Allow users to sign in with Google password' option on the SSO profile page.. Google Workspace allows you to configure a secondary SSO profile or enable network/admin bypass settings to allow admin sign-in via Google credentials.

Answer

Disable SAML SSO entirely and rely exclusively on Google's built-in OAuth service.

Answer

Enable the 'Turn on SSO for administrative accounts' option and assign a backup password.

Answer

Create a Context-Aware Access rule that triggers emergency recovery mode when the IdP IP is unreachable.

Question 3

An administrator needs to grant a helpdesk employee the ability to reset user passwords and view user information without granting them full super administrator privileges. Which built-in admin role should be assigned?

Accepted Answer

User Management Admin. The User Management Admin role grants permissions to reset passwords, manage user profiles, and view organizational units.

Answer

Helpdesk Admin

Answer

Groups Admin

Answer

Services Admin

Question 4

Your company uses a third-party Identity Provider (IdP) for Single Sign-On (SSO) via SAML. A newly hired employee is unable to sign in, and you suspect their account is not properly mapped or provisioned. Where can you check SAML sign-in activity and error logs in the Google Admin console?

Accepted Answer

Reporting > Audit > SAML. Log events related to SAML and SSO authentication failures are recorded in the SAML log events section of the Google Admin console.

Answer

Directory > Users > [User] > Activity > Sign-in activity

Answer

Reporting > Audit > Admin log events

Answer

Security > Authentication > SAML log events

Question 5

Your organization wants to prevent users from sharing Google Drive files externally, but you need to make an exception for a specific partner domain. Where should you configure this allowed domain list?

Accepted Answer

Apps > Google Workspace > Drive and Docs > Sharing settings > Whitelisted domains. The correct location to configure an allowed domain list for external sharing in Google Drive is under Apps > Google Workspace > Drive and Docs > Sharing settings > Whitelisted domains. This setting specifically controls which external domains are permitted for sharing, overriding the default restriction. It is the only place where you can define a whitelist of domains that are exempt from the external sharing block.

Answer

Security > Authentication > Trusted domains

Answer

Directory > Organizational units > External sharing policy

Answer

Security > Access and data control > Whitelisted domains

Question 6

An administrator has configured a new SAML SSO integration with a third-party IdP. Users are complaining that they can log in successfully, but after 30 minutes, they are unexpectedly forced to re-authenticate. Where can the administrator adjust the session duration for SAML apps?

Accepted Answer

Security > Authentication > SSO with third-party IdP > Session length settings. The session duration for SAML SSO with a third-party IdP is configured under Security > Authentication > SSO with third-party IdP > Session length settings, where admins set the maximum session duration before re-authentication is required. This directly controls the 30-minute re-auth behavior described.

Answer

Security > Access and data control > API controls

Answer

Apps > Web and mobile apps > [SAML App] > Service status

Answer

Account settings > Profile > Session duration

Question 7

Your company requires that any user attempting to access Google Drive from an unmanaged mobile device must be blocked, while desktop browsers on unmanaged devices are permitted read-only access via Context-Aware Access. How should you structure your Access Levels and assignments?

Accepted Answer

Create two access levels (one for mobile compliant devices, one for desktop OS/browsers) and assign them conditionally using advanced CAA expressions.. To meet the requirements, you need to create two separate access levels: one for mobile compliant devices (to block unmanaged mobile) and one for desktop OS/browsers (to allow read-only access). Then assign them conditionally using advanced CAA expressions to differentiate between mobile and desktop. This allows granular control based on device type and management status.

Answer

Set up Alert Center policies to automatically revoke OAuth tokens when an unmanaged mobile device accesses Drive.

Answer

Configure mobile device management (MDM) basic rules to block Drive synchronization on unmanaged iOS/Android.

Answer

Create a single access level checking for device policy compliance and assign it to Google Drive for all devices.

Question 8

You need to ensure that administrative actions taken by Super Administrators trigger real-time alerts to the security team's email distribution list. Which tool should you use to set this up?

Accepted Answer

Alert Center > Custom rules > Create rule, selecting Admin log events as the datasource and specifying email recipients.. Alert Center custom rules allow administrators to define alerting conditions based on specific log event sources, including admin activity logs, and route notifications to specified email recipients. Creating a rule with Admin log events as the datasource and adding the security team's distribution list as recipients satisfies the real-time alerting requirement. This is the native, purpose-built tool for this scenario.

Answer

Google Cloud Logging exported to BigQuery with Cloud Pub/Sub triggers

Answer

Reporting > Audit logs > Set alert webhook

Answer

Security Center > Investigation Tool > Save search and set automatic notification schedule.

Question 9

An administrator wants to ensure that users cannot use weak or commonly breached passwords. Where can password monitoring be enabled in the Google Admin console?

Accepted Answer

Security > Password management > Monitor password reuse and strength. Password monitoring for breached credentials is enabled under Security > Password management.

Answer

Security Center > Security health page > Password strength

Answer

Account settings > Legal and compliance > Password audit

Answer

Directory > Users > Security alerts

Question 10

You are troubleshooting an issue where a user is unable to authenticate via SAML SSO. You need to inspect the raw SAML request and response messages sent between the IdP and Google Workspace. What is the most effective way to capture this?

Accepted Answer

Use browser developer tools (Network tab) or a browser extension like SAML Tracer to capture and inspect the SAMLRequest and SAMLResponse POST parameters.. Browser developer tools with SAML tracer extensions or network log analysis capture the Base64 encoded SAMLAssertion payloads.

Answer

View the SAML audit logs in Reporting > Audit > SAML.

Answer

Run the Google Workspace SSO diagnostic tool in the Security Center.

Answer

Enable debug logging in Google Cloud Logging for the Workspace organization.

Question 11

Your security team requires that all administrators must use a hardware security key (FIDO2) for 2-Step Verification and are prohibited from using SMS or phone prompts. Where can you enforce this requirement specifically for admin accounts?

Accepted Answer

Security > Admin security > Enforce 2-Step Verification and specify security keys.. Admin security policies, including strict 2SV methods for administrators, are configured under Security > Admin security.

Answer

Directory > Admin roles > Security policies

Answer

Security > Authentication > 2-step verification > Allow only security keys for administrators

Answer

Account settings > Administrator privileges > Authentication

Question 12

An administrator wants to ensure that users cannot reuse any of their last 5 passwords when changing their password. Where is this setting configured?

Accepted Answer

Security > Password management > Password history. Password history and restriction settings are located under Security > Password management.

Answer

Directory > Users > Security > Passwords

Answer

Account settings > Security > Password recycling

Answer

Apps > Google Workspace > Settings > Password policy

Question 13

Which THREE built-in administrator roles in Google Workspace grant privileges to manage user accounts and reset passwords? (Choose three.)

Accepted Answer

Reseller Admin. User Management Admin, Groups Admin (for group users), and Super Admin have user-related controls. Wait, the roles that manage user accounts directly are Super Admin, User Management Admin, and Reseller Admin or specific custom roles. Let's select Super Admin, User Management Admin, and Advanced Services Admin or similar. Wait, let's look at standard roles: Super Admin, User Management Admin, and Helpdesk Admin (or User Management Admin variants). Let's review standard roles: Super Admin, User Management Admin, and Groups Admin (for group members)? No, Groups Admin manages groups. Let's use Super Admin, User Management Admin, and Desktop Security Admin? Let's check standard Google Workspace admin roles: Super Admin, User Management Admin, and Services Admin? Services Admin doesn't manage users. What about Account Administrator? Let's formulate the correct three standard roles that have user account management privileges.

Answer

Services Admin

Answer

Groups Admin

Question 14

An administrator is reviewing API controls and third-party app access in Google Workspace. Which THREE access states can be configured for third-party OAuth applications? (Choose three.)

Accepted Answer

Trusted (allowed access to all Google Workspace APIs and data scopes). In Google Workspace, third-party OAuth app access can be set to Trusted (A), which allows the app access to all Google Workspace APIs and data scopes without admin review, making it appropriate for vetted internal or partner apps. Limited (D) restricts the app to only specific whitelisted Google APIs or scopes, which is the correct state for granting partial access while reducing risk. Blocked (E) prevents the app from accessing any Google Workspace user data or APIs, which is the correct state for denying unapproved or suspicious apps. The unmarked options do not belong because Supervised (B) is not a Google Workspace OAuth access state—there is no real-time per-API-call approval mechanism—and Read-Only Sandbox (C) is not a configurable third-party OAuth access state in the Admin console.

Answer

Supervised (requiring a Super Administrator to approve every API call in real time)

Answer

Read-Only Sandbox (running apps in an isolated container without data persistence)

Question 15

An organization wants to configure SSO with a third-party SAML IdP. Which THREE advanced settings can be configured within the Google Workspace SAML application settings? (Choose three.)

Accepted Answer

Name ID format selection (e.g., EMAIL, PERSISTENT). Option C is correct because the Google Workspace SAML app configuration includes a NameID format setting where admins choose the identifier format sent to the IdP, such as EMAIL or PERSISTENT, matching the IdP's expected subject identifier. Option D is correct because the SAML app settings provide a signed response option that controls whether Google signs the SAML authentication request and/or whether the IdP's signed response/assertion is required and verified. Option E is correct because the Start URL field defines the deep link (service URL) that users are redirected to after successful SAML authentication, and it is a standard configurable field in the SAML app. Option A is not part of SAML app settings; Google Workspace does not expose a direct database connection pool size for real-time user lookup. Option B is also not configurable there, as Google manages TLS cipher suites for its own login endpoints and does not let admins set custom cipher suites for button rendering.

Answer

Direct database connection pool size for real-time user lookup

Answer

Custom SSL cipher suites for the Google Workspace login button rendering