GWS-ADMIN Security Policies And Access Controls Practice Test 2 — 15 Questions

Question 1

Your organization requires that users can only access Google Drive when connected to the corporate VPN. How can you achieve this using Context-Aware Access?

Accepted Answer

Configure an IP-based access level and assign it to the Google Drive app.. Context-Aware Access levels are created in Security > Access and data control > Context-Aware access, then assigned to apps.

Answer

Restrict Google Drive access via the 'OAuth app allowlist'.

Answer

Update the 'Password Strength' policy in the Admin console.

Answer

Enable 'Endpoint Verification' on all user devices.

Question 2

An auditor requests that you restrict administrative access to the Google Workspace Admin console to a specific set of IP addresses. What is the most effective way to implement this?

Accepted Answer

Configure 'Admin console sign-in restriction' under Security > Authentication.. Admin console sign-in restrictions under Security > Authentication let administrators define an allowlist of IP addresses (or ranges) from which users can sign in to the Admin console. This is the purpose-built control for limiting administrative access by network origin, and it applies specifically to the admin console rather than all Google services.

Answer

Create an 'Access Level' in Context-Aware Access and apply it to the Admin console app.

Answer

Disable 'Advanced Protection Program' for all users.

Answer

Apply a VPC Service Controls perimeter around the organization.

Question 3

A new IT support staff member needs to manage user passwords but should not be able to delete users or modify billing settings. Which role should you assign?

Accepted Answer

User Management Admin. The 'User Management Admin' role allows for password resets and basic user info updates without full super admin privileges.

Answer

Groups Admin

Answer

Super Admin

Answer

Help Desk Admin

Question 4

You need to prevent users from installing third-party Marketplace apps that request access to their Gmail data. What is the best approach?

Accepted Answer

Use the 'Allowlist' feature to block specific OAuth scopes globally.. The 'Allowlist' feature in Admin console (Security > API Controls > App Access Control) lets admins block specific OAuth scopes globally, such as Gmail read access, for third-party Marketplace apps. This precisely prevents apps from requesting Gmail data without disabling the entire Marketplace.

Answer

Disable the Google Workspace Marketplace for the entire domain.

Answer

Configure an endpoint verification policy.

Answer

Change the 'Sharing settings' in the Drive and Docs settings.

Question 5

You want to ensure that all users have a strong password policy. Where can you enforce password length and complexity requirements?

Accepted Answer

Security > Authentication > Password management. Password policies are managed in the Security section under Password management.

Answer

Directory > User settings

Answer

Security > Context-Aware Access

Answer

Account > Account settings

Question 6

Which TWO of the following are valid criteria for a Context-Aware Access level? (Choose two)

Accepted Answer

Device encryption status. Option A (Device encryption status) is correct because Context-Aware Access levels in Google Workspace/Cloud Identity can evaluate device attributes such as whether the device is encrypted, managed, or has a screen lock, using device policy conditions. Option E (IP subnet) is correct because access levels can include IP subnet conditions, allowing you to grant or deny access based on the source IP range of the request. Option B (User's browser history) is not a supported attribute; Context-Aware Access does not inspect browsing history. Option C (User's favorite color) is not a technical or security-relevant attribute and is not available as an access level criterion. Option D (User's time zone) is not a valid criterion; while time-based conditions are not part of access levels, time zone itself is not an evaluable attribute for Context-Aware Access.

Answer

User's browser history

Answer

User's favorite color

Answer

User's time zone

Question 7

A financial services company requires that users accessing Google Workspace from unmanaged devices can only view Gmail and Drive in read-only mode, with no ability to download, print, or copy. Administrators must enforce this without blocking access entirely. Which configuration should they implement?

Accepted Answer

Apply a Context-Aware Access access level that requires a managed device, and combine it with a rule that grants read-only access when the device is unmanaged.. Context-Aware Access supports device-based conditions and can apply different access levels depending on whether a device is managed. The correct approach uses a conditional policy that grants read-only access for unmanaged devices while still allowing viewing. This satisfies the requirement to restrict actions without blocking access entirely, unlike options that either block all access or only address one application.

Answer

Create a Context-Aware Access access level that requires a corporate-owned device and assign it to the organizational unit.

Answer

Configure a Data Protection rule in Drive that blocks download, print, and copy for users in the organizational unit.

Answer

Enable the 'Limit access to Google Workspace to managed devices' setting in Admin console device management.

Question 8

Your organization has a strict security policy requiring that all external file-sharing links created in Google Drive be accessible only to users who authenticate with a company-managed Google Account. Administrators must prevent users from creating links that allow anonymous or public access. Which setting should you configure in the Google Admin console to meet this requirement?

Accepted Answer

In Apps > Google Workspace > Drive and Docs > Sharing settings, set the default link-sharing access to 'Restricted' and disable 'Allow users to publish to the web'.. The correct configuration is to set the default link-sharing access to 'Restricted' and disable web publishing. This ensures that files are not publicly accessible by default and that users cannot create public links. The other options either block all external sharing (too broad), apply device-based controls that don't affect link sharing, or rely on DLP which is not preventive for authentication.

Answer

In Apps > Google Workspace > Drive and Docs > Sharing settings, set the default link-sharing access to 'Anyone with the link' and rely on Data Loss Prevention (DLP) rules to block external sharing.

Answer

In Security > Access and data control > Context-Aware Access, create an access level that requires a company-owned device and apply it to Google Drive.

Answer

In Apps > Google Workspace > Drive and Docs > Sharing settings, set 'Sharing outside of your organization' to 'OFF' and enable 'Warn users when they share outside the organization'.

Question 9

A healthcare organization needs to ensure that only users who have completed annual security training can access Google Drive. The training status is stored in an external HR system. Which Google Workspace feature should administrators use to enforce this requirement?

Accepted Answer

Context-Aware Access with an access level based on a user's group membership, where group membership is updated by the HR system.. Context-Aware Access supports group membership as an access condition. If the HR system synchronizes training completion status by adding users to a specific Google Group, administrators can configure an access level that requires membership in that group. This allows enforcement of the training requirement for Drive access. The other options misrepresent Context-Aware Access capabilities or confuse it with other features like Secure LDAP.

Answer

Context-Aware Access with a custom access level based on user attributes synchronized from the HR system via LDAP.

Answer

Google Workspace Secure LDAP with a custom schema to map training completion status.

Answer

Context-Aware Access with an access level that uses a third-party partner integration to evaluate training status.

Question 10

A Google Workspace administrator needs to let a contractor sign in to only the company's Salesforce SAML app, and must ensure the contractor cannot access Gmail, Drive, or any other core Google service. What should the administrator do?

Accepted Answer

Place the contractor in an organizational unit with only the Salesforce SAML app turned on, and turn off Gmail and Drive for that OU.. Service availability in Google Workspace is governed by organizational unit membership and per-service ON/OFF toggles. Placing the contractor in a dedicated OU and disabling Gmail and Drive there while leaving the Salesforce SAML app enabled restricts sign-in to that single application, which is the least-privilege outcome the scenario requires.

Answer

Assign the contractor the prebuilt Cloud Startups Administrator role.

Answer

Create a Context-Aware Access access level requiring the contractor's device to be company-owned and apply it to all apps.

Answer

Add the contractor to a Google Group and enable the Salesforce app for that group only.

Question 11

A Google Workspace administrator for a financial services company needs to ensure that only company-owned devices running Chrome OS can access Gmail and Drive. Employees who use personal Windows laptops must be blocked from accessing these services. Which action should the administrator take?

Accepted Answer

Create a Context-Aware Access access level that requires device policy verification and endpoint verification, then apply it to the Gmail and Drive apps.. Context-Aware Access is the correct tool to enforce device-based access controls for Google Workspace apps. By defining an access level that requires device policy verification and endpoint verification, the administrator ensures that only managed Chrome OS devices meet the criteria. Applying this access level to Gmail and Drive blocks personal Windows laptops, because they cannot satisfy the device trust requirements. Other methods do not provide the same granular device-based restriction.

Answer

Configure a device policy in the Admin console that blocks sign-in from Windows devices.

Answer

Enforce 2-Step Verification for all users and require security keys for authentication.

Answer

Set up a SAML SSO profile that only allows authentication from Chrome OS devices.

Question 12

A security team discovers that a compromised employee account is actively exfiltrating Drive files to an external domain. The administrator needs to immediately suspend the account's ability to sign in and revoke its active OAuth tokens without deleting the user or losing their data. Which action should the administrator take?

Accepted Answer

Suspend the user in the Admin console, which blocks sign-in and revokes OAuth tokens while preserving the account and its data.. Suspending the user is the fastest way to stop an active compromise while keeping the account and its data available for investigation and possible restoration. Suspension blocks sign-in and invalidates OAuth tokens, so the attacker loses access to Drive and other services immediately, and the administrator can later restore the user once the incident is resolved.

Answer

Delete the user account and assign the mailbox and Drive data to a manager.

Answer

Reset the user's password and require a change at next sign-in.

Answer

Move the user to an org unit that has Google Drive disabled.

Question 13

A security administrator needs to ensure that all users in the organization are required to use 2-Step Verification (2SV) and that they cannot disable it. However, a subset of users in the sales department must be exempt from this requirement for a limited time due to a temporary business need. What is the most effective way to enforce 2SV for everyone while allowing a temporary exemption for the sales team?

Accepted Answer

Enforce 2SV for the entire organization and move the sales team users to a separate organizational unit where 2SV enforcement is disabled.. The correct approach is to move the sales team to a separate organizational unit where 2SV enforcement is disabled. 2SV enforcement is managed at the OU level, and this method provides a temporary exemption that can be easily reverted. The other options either rely on unsupported features or misunderstand the capabilities of Context-Aware Access and per-user settings.

Answer

Enforce 2SV for the entire organization and use the Google Admin console to set a temporary 2SV exemption for each sales team user individually.

Answer

Enforce 2SV for the entire organization and use a Context-Aware Access policy to allow the sales team to bypass 2SV when accessing from specific IP addresses.

Answer

Enforce 2SV for the entire organization and create a Google Group for the sales team, then exclude that group from the 2SV enforcement policy.

Question 14

A security team wants to block sign-ins from countries where the company has no employees, but still allow a small set of executives to travel anywhere. Which configuration should the administrator implement?

Accepted Answer

Create a Context-Aware Access access level that blocks the disallowed countries and assign it to all users, then add the executives to a separate organizational unit with no access level applied.. Context-Aware Access access levels support country and region conditions and are assigned by organizational unit and app. Blocking the disallowed countries at the main organizational unit covers the general population, and placing executives in a child OU without that access level creates the travel exception the scenario requires.

Answer

Configure a SAML SSO profile with a network mask that excludes the disallowed countries and apply it to all users.

Answer

Turn on 2-Step Verification enforcement for all users and require security keys only for the executives.

Answer

Enable login challenges for the entire domain and disable them for the executives' OU.

Question 15

A company uses Google Workspace and has a policy that all external file sharing must be approved by a data loss prevention (DLP) review. The security team wants to automatically block any attempt to share Google Drive files with external email addresses that are not on an allowlist. Which Google Workspace feature should they use?

Accepted Answer

Data Loss Prevention (DLP) rules for Drive that trigger on external sharing and block shares to unauthorized email addresses.. DLP rules for Drive are designed to inspect content and sharing actions. They can trigger on external sharing and apply actions such as blocking the share if the recipient is not on an allowlist. This provides automatic enforcement and can be configured to allow review workflows. Other options do not offer the same level of automated, content-aware blocking for external sharing.

Answer

Security Center investigation tool to monitor external sharing and manually block violations.

Answer

Drive and Docs sharing settings with 'On' for external sharing and a whitelist of allowed domains.

Answer

Context-Aware Access with an access level that restricts sharing to internal users only.