An administrator needs to configure password requirements, such as minimum length and expiration policies, for all users in the domain. Where is this configured in the Google Admin console?
Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?
An administrator needs to grant a helpdesk employee the ability to reset user passwords and view user information without granting them full super administrator privileges. Which built-in admin role should be assigned?
Your company uses a third-party Identity Provider (IdP) for Single Sign-On (SSO) via SAML. A newly hired employee is unable to sign in, and you suspect their account is not properly mapped or provisioned. Where can you check SAML sign-in activity and error logs in the Google Admin console?
Your organization wants to prevent users from sharing Google Drive files externally, but you need to make an exception for a specific partner domain. Where should you configure this allowed domain list?
An administrator has configured a new SAML SSO integration with a third-party IdP. Users are complaining that they can log in successfully, but after 30 minutes, they are unexpectedly forced to re-authenticate. Where can the administrator adjust the session duration for SAML apps?
Your company requires that any user attempting to access Google Drive from an unmanaged mobile device must be blocked, while desktop browsers on unmanaged devices are permitted read-only access via Context-Aware Access. How should you structure your Access Levels and assignments?
You need to ensure that administrative actions taken by Super Administrators trigger real-time alerts to the security team's email distribution list. Which tool should you use to set this up?
An administrator wants to ensure that users cannot use weak or commonly breached passwords. Where can password monitoring be enabled in the Google Admin console?
You are troubleshooting an issue where a user is unable to authenticate via SAML SSO. You need to inspect the raw SAML request and response messages sent between the IdP and Google Workspace. What is the most effective way to capture this?
Your security team requires that all administrators must use a hardware security key (FIDO2) for 2-Step Verification and are prohibited from using SMS or phone prompts. Where can you enforce this requirement specifically for admin accounts?
An administrator is reviewing API controls and third-party app access in Google Workspace. Which THREE access states can be configured for third-party OAuth applications? (Choose three.)
An organization wants to configure SSO with a third-party SAML IdP. Which THREE advanced settings can be configured within the Google Workspace SAML application settings? (Choose three.)
Your organization requires that users can only access Google Drive when connected to the corporate VPN. How can you achieve this using Context-Aware Access?
An auditor requests that you restrict administrative access to the Google Workspace Admin console to a specific set of IP addresses. What is the most effective way to implement this?
A new IT support staff member needs to manage user passwords but should not be able to delete users or modify billing settings. Which role should you assign?
A financial services company requires that users accessing Google Workspace from unmanaged devices can only view Gmail and Drive in read-only mode, with no ability to download, print, or copy. Administrators must enforce this without blocking access entirely. Which configuration should they implement?
Your organization has a strict security policy requiring that all external file-sharing links created in Google Drive be accessible only to users who authenticate with a company-managed Google Account. Administrators must prevent users from creating links that allow anonymous or public access. Which setting should you configure in the Google Admin console to meet this requirement?
A healthcare organization needs to ensure that only users who have completed annual security training can access Google Drive. The training status is stored in an external HR system. Which Google Workspace feature should administrators use to enforce this requirement?
A Google Workspace administrator needs to let a contractor sign in to only the company's Salesforce SAML app, and must ensure the contractor cannot access Gmail, Drive, or any other core Google service. What should the administrator do?
A Google Workspace administrator for a financial services company needs to ensure that only company-owned devices running Chrome OS can access Gmail and Drive. Employees who use personal Windows laptops must be blocked from accessing these services. Which action should the administrator take?
A security team discovers that a compromised employee account is actively exfiltrating Drive files to an external domain. The administrator needs to immediately suspend the account's ability to sign in and revoke its active OAuth tokens without deleting the user or losing their data. Which action should the administrator take?
A security administrator needs to ensure that all users in the organization are required to use 2-Step Verification (2SV) and that they cannot disable it. However, a subset of users in the sales department must be exempt from this requirement for a limited time due to a temporary business need. What is the most effective way to enforce 2SV for everyone while allowing a temporary exemption for the sales team?
A security team wants to block sign-ins from countries where the company has no employees, but still allow a small set of executives to travel anywhere. Which configuration should the administrator implement?
A company uses Google Workspace and has a policy that all external file sharing must be approved by a data loss prevention (DLP) review. The security team wants to automatically block any attempt to share Google Drive files with external email addresses that are not on an allowlist. Which Google Workspace feature should they use?
A multinational corporation needs to comply with data residency requirements by ensuring that Google Workspace data for European employees is stored only in the European Union. Administrators must configure data regions. Which TWO actions should they take? (Choose two.)
A Google Workspace administrator is configuring a security policy to protect sensitive data in Google Drive. The organization wants to prevent users from sharing files with external domains and also wants to ensure that files containing credit card numbers are automatically detected and blocked from external sharing. Which TWO actions should the administrator take? (Choose two.)
A Google Workspace administrator must ensure that any new OAuth scopes requested by internal apps are reviewed before users can grant them. Which setting should the administrator configure?
A Workspace administrator must ensure that users in the Finance org unit can access Google Workspace only from the corporate office IP range during business hours, and are denied access from any other network. Which configuration should the administrator implement?
Your organization uses Google Workspace and has enabled 2-Step Verification (2SV) for all users. You want to ensure that users cannot install 2SV mobile apps on unmanaged devices and that they are prompted to enroll in 2SV when signing in from a new device. Which setting should you configure?
A small business uses Google Workspace and wants to ensure that only authorized users can access Google Drive from mobile devices. They want to require that mobile devices have a screen lock and are encrypted. Which Google Workspace feature should the administrator configure?
Your organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?
You need to create a custom administrator role that allows specific users to manage Google Meet hardware devices and review their health status, but nothing else. Which privilege category should you select when building this custom role?
You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?
An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?
An organization wants to prevent users from signing in to their Google Workspace accounts from outside their home country. Which feature should the administrator configure?
Your company has an external contractor who needs temporary access to Google Workspace. You want to ensure their account automatically deactivates after 30 days without manual administrative intervention. How can you achieve this securely?
An administrator needs to view a report showing which users in the organization have not enabled 2-Step Verification. Where should the administrator look in the Google Admin console?
Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?
An administrator needs to restrict access to Google Workspace apps so that users can only log in from corporate-managed Chromebooks and Windows devices enrolled in Endpoint Management, while blocking all mobile devices entirely. How should this be implemented?
An administrator needs to delegate the role of creating and managing Google Groups across the entire domain without giving full admin rights. Which built-in role should be assigned?
Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?
You need to create a custom administrator role that allows a security analyst to use the Security Center Investigation Tool, view audit logs, and manage alerts, but prevents them from modifying user passwords or organizational unit structures. Which exact set of privileges should you assign?
Your organization uses Context-Aware Access to restrict access to Google Workspace based on IP address ranges. A remote employee traveling for business is unable to access Gmail from a trusted hotel Wi-Fi. How should the administrator temporarily grant access without compromising long-term security?
An administrator needs to review recent security alerts and proactive recommendations for improving domain security. Where should they look first in the Google Admin console?
An organization wants to integrate Google Workspace with an external SAML IdP. However, some users (such as external contractors) should continue authenticating directly against Google's native login page using their Google password and 2SV. How should the administrator configure SSO to support this mixed environment?
When setting up SAML SSO with a third-party Identity Provider (IdP), which THREE pieces of information must typically be exchanged or configured in the Google Admin console? (Choose three.)
Which THREE features or tools in Google Workspace can be used to monitor and investigate suspicious sign-in activity or security anomalies? (Choose three.)
An administrator is configuring Context-Aware Access to secure corporate data. Which TWO criteria can be evaluated within a Context-Aware Access access level expression? (Choose two.)
Which TWO mechanisms can an administrator use to recover access if a Super Administrator loses their 2-Step Verification device and is locked out? (Choose two.)
An enterprise organization is planning its 2-Step Verification (2SV) rollout. Which THREE methods or tokens are natively supported by Google Workspace for 2SV authentication? (Choose three.)
An administrator wants to configure security policies to protect corporate data on mobile devices. Which THREE actions can be enforced through Google Workspace Endpoint Management? (Choose three.)
You need to enforce 2-Step Verification for a specific department while allowing others to opt-in voluntarily. Which configuration path should you use?
Which TWO reports or logs should an administrator check to verify whether Context-Aware Access rules are successfully blocking unauthorized connection attempts? (Choose two.)
Your organization uses a third-party Identity Provider (IdP) for SSO. Users are reporting that they cannot sign in. Where do you verify the SAML configuration?
A financial services company uses Google Workspace. The security team wants to block all access to Gmail from outside the corporate network, but allow access from the office IP range 203.0.113.0/24. They also want to require a managed device for access. Which Google Workspace feature should the administrator configure to enforce these conditions?
A security team wants to enforce a policy that only company-managed devices can access Gmail and Drive, while personal devices are denied. Which TWO configurations are required in Google Workspace to implement this using Context-Aware Access? (Choose two.)
A helpdesk administrator needs to reset passwords for users in the Sales organizational unit but must not be able to reset passwords for users in the Finance organizational unit. The helpdesk admin already has a custom role with the 'Users: Reset password' privilege. What should you do to restrict the role's scope to only the Sales organizational unit?
A Workspace administrator wants to ensure that users in the Sales org unit can only sign in from corporate-managed Chromebooks and Windows devices, and block personal devices from accessing Gmail and Drive. Which enforcement mechanism should the administrator configure?
A financial services company uses Google Workspace. The security team wants to ensure that when an employee's device is compromised, their active Google Workspace sessions are terminated immediately and they are required to re-authenticate with 2-Step Verification. Which action should the administrator take?
A school district wants to prevent students from installing any third-party apps that request access to Gmail data. Administrators need to ensure that only pre-approved apps can access Gmail. Which Google Workspace setting should they configure?
A Google Workspace administrator wants to ensure that all users in the organization are required to use 2-Step Verification (2SV) when signing in. Where should the administrator enforce this requirement?
A Google Workspace administrator needs to allow a third-party application to access specific Google Drive files on behalf of users. The administrator wants to restrict the application so it can only access files that users explicitly share with it, and cannot access all files in the domain. Which OAuth scopes configuration should be used?
An administrator must allow a partner organization to access a shared Drive folder, but only when the partner users sign in from their own managed devices. The partner has its own Google Workspace domain. Which configuration should the administrator use to enforce this requirement?
A Google Workspace administrator needs to delegate the ability to manage user accounts and reset passwords to a helpdesk team, but must ensure they cannot access Gmail content or modify security settings. Which role should be assigned to the helpdesk team?
A healthcare organization must comply with HIPAA and wants to ensure that Google Workspace data is protected against insider threats. The security team needs to monitor and alert on suspicious user behavior, such as mass downloads of Drive files and unusual login locations. Which TWO actions should the administrator take to meet these requirements? (Choose two.)
An administrator is configuring a Context-Aware Access access level to protect Google Drive for a remote workforce. Which TWO conditions can be used in the access level to evaluate device trust and network origin? (Choose two.)
A company wants to prevent data exfiltration by ensuring that users can only access Google Drive from managed devices, but must allow contractors using personal devices to access Gmail. Which approach should the administrator take?
The security team at Acme Corp wants to block all OAuth scopes that are classified as High Risk and unverified for users under the Sales org unit. Where should the administrator configure this restriction?
A financial services company needs to enforce that all employees use a hardware security key for 2-Step Verification (2SV) and cannot use less secure methods like SMS or phone calls. Which setting in the Admin console should the administrator configure?