GWS-ADMIN Security Policies And Access Controls Practice Test 2 — 15 Questions

Question 1

You need to ensure that administrative actions taken by Super Administrators trigger real-time alerts to the security team's email distribution list. Which tool should you use to set this up?

Accepted Answer

Alert Center > Custom rules > Create rule, selecting Admin log events as the datasource and specifying email recipients.. Alert Center rules allow administrators to configure notification triggers for specific admin activity log events.

Answer

Google Cloud Logging exported to BigQuery with Cloud Pub/Sub triggers

Answer

Reporting > Audit logs > Set alert webhook

Answer

Security Center > Investigation Tool > Save search and set automatic notification schedule.

Question 2

An administrator wants to ensure that users cannot use weak or commonly breached passwords. Where can password monitoring be enabled in the Google Admin console?

Accepted Answer

Security > Password management > Monitor password reuse and strength. Password monitoring for breached credentials is enabled under Security > Password management.

Answer

Security Center > Security health page > Password strength

Answer

Account settings > Legal and compliance > Password audit

Answer

Directory > Users > Security alerts

Question 3

Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?

Accepted Answer

The SAML app service status is set to OFF for the user's organizational unit or access group.. This error occurs when the SAML app is configured in the Google Admin console, but access is turned OFF for the user or their organizational unit.

Answer

The IdP signing certificate has expired.

Answer

The user's password has expired and needs to be reset.

Answer

The user does not have a Google Cloud Platform billing account attached.

Question 4

An administrator needs to restrict access to Google Workspace apps so that users can only log in from corporate-managed Chromebooks and Windows devices enrolled in Endpoint Management, while blocking all mobile devices entirely. How should this be implemented?

Accepted Answer

Use Context-Aware Access with access levels checking for device policy compliance and specific operating systems (desktop OS only).. Context-Aware Access rules can evaluate device OS and management state to block mobile devices and permit only managed corporate devices.

Answer

Set up IAM conditions in the Google Cloud console for Google Workspace endpoints.

Answer

Apply an Advanced Protection policy for all mobile users.

Answer

Configure mobile device management settings to turn off Google sync for iOS and Android.

Question 5

You are troubleshooting an issue where a user is unable to authenticate via SAML SSO. You need to inspect the raw SAML request and response messages sent between the IdP and Google Workspace. What is the most effective way to capture this?

Accepted Answer

Use browser developer tools (Network tab) or a browser extension like SAML Tracer to capture and inspect the SAMLRequest and SAMLResponse POST parameters.. Browser developer tools with SAML tracer extensions or network log analysis capture the Base64 encoded SAMLAssertion payloads.

Answer

View the SAML audit logs in Reporting > Audit > SAML.

Answer

Run the Google Workspace SSO diagnostic tool in the Security Center.

Answer

Enable debug logging in Google Cloud Logging for the Workspace organization.

Question 6

Your security team requires that all administrators must use a hardware security key (FIDO2) for 2-Step Verification and are prohibited from using SMS or phone prompts. Where can you enforce this requirement specifically for admin accounts?

Accepted Answer

Security > Admin security > Enforce 2-Step Verification and specify security keys.. Admin security policies, including strict 2SV methods for administrators, are configured under Security > Admin security.

Answer

Directory > Admin roles > Security policies

Answer

Security > Authentication > 2-step verification > Allow only security keys for administrators

Answer

Account settings > Administrator privileges > Authentication

Question 7

An administrator needs to delegate the role of creating and managing Google Groups across the entire domain without giving full admin rights. Which built-in role should be assigned?

Accepted Answer

Groups Admin. The Groups Admin role specifically grants privileges to manage Google Groups.

Answer

Directory Sync Admin

Answer

Helpdesk Admin

Answer

User Management Admin

Question 8

Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?

Accepted Answer

SAML Single Logout (SLO) URL configuration in the SSO profile.. Single Logout (SLO) allows users to terminate their session across both Google Workspace and the configured SAML IdP.

Answer

Context-Aware Access session termination

Answer

OAuth token revocation API

Answer

Automated user provisioning via SCIM

Question 9

An administrator wants to ensure that users cannot reuse any of their last 5 passwords when changing their password. Where is this setting configured?

Accepted Answer

Security > Password management > Password history. Password history and restriction settings are located under Security > Password management.

Answer

Directory > Users > Security > Passwords

Answer

Account settings > Security > Password recycling

Answer

Apps > Google Workspace > Settings > Password policy

Question 10

You need to create a custom administrator role that allows a security analyst to use the Security Center Investigation Tool, view audit logs, and manage alerts, but prevents them from modifying user passwords or organizational unit structures. Which exact set of privileges should you assign?

Accepted Answer

Select privileges from Security Center (Investigation Tool, Alerts) and Reporting (Audit logs), while leaving User Management and OU privileges unchecked.. Building a custom role requires selecting precise privileges from the Security Center and Reporting privilege categories.

Answer

Grant 'Super Admin' privileges and restrict access using Context-Aware Access.

Answer

Assign the 'Helpdesk Admin' role combined with 'Security Center Reader'.

Answer

Assign the built-in 'Security Admin' role and remove user management privileges via override.

Question 11

Your organization uses Context-Aware Access to restrict access to Google Workspace based on IP address ranges. A remote employee traveling for business is unable to access Gmail from a trusted hotel Wi-Fi. How should the administrator temporarily grant access without compromising long-term security?

Accepted Answer

Temporarily move the user to an organizational unit that does not have the Context-Aware Access rule applied, or assign a temporary exception access level.. Administrators can assign temporary access levels or temporarily move the user to an OU without the CAA restriction.

Answer

Permanently add the hotel IP subnet to the global Context-Aware Access access level.

Answer

Disable 2-Step Verification for the user's account.

Answer

Reset the user's OAuth tokens via the Admin SDK.

Question 12

An administrator needs to review recent security alerts and proactive recommendations for improving domain security. Where should they look first in the Google Admin console?

Accepted Answer

Security > Security Center > Dashboard. The Security Center provides a centralized dashboard for security analytics, alerts, and recommendations.

Answer

Directory > Users > Security status

Answer

Reporting > Audit logs > Security overview

Answer

Apps > Google Workspace > Security Center

Question 13

An organization wants to integrate Google Workspace with an external SAML IdP. However, some users (such as external contractors) should continue authenticating directly against Google's native login page using their Google password and 2SV. How should the administrator configure SSO to support this mixed environment?

Accepted Answer

Assign the SAML SSO profile selectively to specific organizational units or access groups, leaving the contractor OU on 'Deactivated' SSO settings.. Google Workspace allows you to assign SSO profiles to specific organizational units or groups, allowing some users to use SAML and others to use Google login.

Answer

Use Context-Aware Access to redirect contractor sign-ins to the third-party IdP while routing employees to Google.

Answer

Set up two separate Google Workspace domains, one for contractors and one for employees.

Answer

Configure domain-wide SAML SSO and check the box to allow emergency Google passwords for all users.

Question 14

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

Accepted Answer

Enforce hardware security keys as the only allowed 2-Step Verification method for administrator accounts.. Securing admin accounts involves mandating strict 2SV methods and restricting admin access to known IPs or devices.

Answer

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Answer

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Answer

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Question 15

When setting up SAML SSO with a third-party Identity Provider (IdP), which THREE pieces of information must typically be exchanged or configured in the Google Admin console? (Choose three.)

Accepted Answer

Entity ID (Issuer) provided by the IdP. SAML setup requires configuring the IdP sign-in URL, entity ID (issuer), and X.509 signing certificate.

Answer

The third-party IdP database connection string (SQL connection)

Answer

Google Workspace master database encryption key