GWS-ADMIN Security Policies And Access Controls Practice Test 3 — 15 Questions

Question 1

A multinational corporation needs to comply with data residency requirements by ensuring that Google Workspace data for European employees is stored only in the European Union. Administrators must configure data regions. Which TWO actions should they take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Select the European Union as the data region for the organizational unit containing European employees.. To enforce data residency, administrators must first enable data regions in the Admin console, then assign a specific region (e.g., European Union) to the organizational unit containing the affected users. This ensures covered data is stored at rest in the chosen region. The other options do not control data storage location and are unrelated to data regions.

Answer

Configure a Context-Aware Access policy to block access from outside the EU.

Answer

Use Google Takeout to export data and store it in a local EU data center.

Answer

Set up a VPC Service Controls perimeter around Google Workspace APIs.

Question 2

A Google Workspace administrator is configuring a security policy to protect sensitive data in Google Drive. The organization wants to prevent users from sharing files with external domains and also wants to ensure that files containing credit card numbers are automatically detected and blocked from external sharing. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

In the Admin console, under Apps > Google Workspace > Drive and Docs > Sharing settings, set the external sharing option to 'Off' for the organizational unit.. The two correct actions are setting external sharing to 'Off' for the organizational unit and creating a DLP rule that detects credit card numbers and blocks external sharing. The first action prevents any external sharing, while the second adds content-specific protection for sensitive data. Together, they enforce a comprehensive policy: no external sharing at all, and specifically block files with credit card numbers if sharing were somehow attempted. Other options either do not prevent sharing or are not content-aware.

Answer

Configure a Context-Aware Access access level that restricts access to Drive based on user location.

Answer

Enable IRM (Information Rights Management) for all files to prevent external sharing.

Answer

Set up a security alert in the Security Center to notify administrators when files are shared externally.

Question 3

A Google Workspace administrator must ensure that any new OAuth scopes requested by internal apps are reviewed before users can grant them. Which setting should the administrator configure?

Accepted Answer

Set the API access control to 'Don't trust internal apps' so that internal apps require review.. API controls under Security > Access and data control > API controls determine how internal and external apps are trusted. Selecting 'Don't trust internal apps' forces internal apps through administrator review before users can consent to their scopes, which is exactly the gate the scenario requires.

Answer

Create a Context-Aware Access access level that requires admin approval for OAuth scopes.

Answer

Enable the 'Unconfigured third-party apps' setting to 'Block' for all organizational units.

Answer

Set the API access control to 'Trust internal, block external' for all apps.

Question 4

A Workspace administrator must ensure that users in the Finance org unit can access Google Workspace only from the corporate office IP range during business hours, and are denied access from any other network. Which configuration should the administrator implement?

Accepted Answer

Create a Context-Aware Access access level with an IP subnet condition for the office range, and assign it to the Finance org unit.. Context-Aware Access is the Workspace mechanism that evaluates network conditions such as source IP subnet before granting access to apps. An access level built from the office IP range and assigned to the Finance org unit denies sign-ins from any other network, which is exactly the restriction the administrator needs to enforce.

Answer

Set a sign-in restriction in the Admin console that limits authentication to the office IP range for the Finance org unit.

Answer

Configure a network firewall rule on the corporate perimeter to block Workspace traffic from outside the office.

Answer

Enable 2-Step Verification for the Finance org unit and require security keys for all sign-ins.

Question 5

Your organization uses Google Workspace and has enabled 2-Step Verification (2SV) for all users. You want to ensure that users cannot install 2SV mobile apps on unmanaged devices and that they are prompted to enroll in 2SV when signing in from a new device. Which setting should you configure?

Accepted Answer

In Security > Authentication > 2-Step Verification, enforce 2SV and rely on mobile device management (MDM) to restrict app installation on unmanaged devices.. The correct approach is to enforce 2SV and use MDM to restrict app installation. 2SV settings alone cannot prevent installation of mobile apps on unmanaged devices; that requires device management policies. The other options incorrectly assume that 2SV settings include app installation controls or that device trust or enrollment periods address the requirement.

Answer

In Security > Authentication > 2-Step Verification, enforce 2SV and enable 'Allow users to trust the device' to reduce prompts on managed devices.

Answer

In Security > Authentication > 2-Step Verification, enforce 2SV for the organization and enable 'New user enrollment period' to prompt users to enroll.

Answer

In Security > Authentication > 2-Step Verification, set 'Allow users to install 2SV mobile apps' to 'Only on managed devices' and enable 'Prompt users to enroll in 2SV'.

Question 6

A small business uses Google Workspace and wants to ensure that only authorized users can access Google Drive from mobile devices. They want to require that mobile devices have a screen lock and are encrypted. Which Google Workspace feature should the administrator configure?

Accepted Answer

Mobile device management (MDM) settings in the Admin console to enforce screen lock and encryption, applied to the organizational unit.. The correct feature is mobile device management (MDM) in the Admin console. It allows administrators to enforce security policies like screen lock and encryption on mobile devices accessing Google Workspace, including Drive. This ensures that only authorized, secure devices can access data. Other options do not provide the direct device-level enforcement required.

Answer

Google Drive sharing settings to restrict access to only users with company-owned devices.

Answer

Context-Aware Access with access levels that require screen lock and encryption for mobile devices.

Answer

Security Center investigation tool to monitor mobile device access and block non-compliant devices.

Question 7

Your organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?

Accepted Answer

Place contractors in a dedicated OU, navigate to Security > Authentication > 2-step verification, and configure the allowed methods to only include security keys.. Security key enforcement can be targeted to specific organizational units or security groups by setting the 2SV policy appropriately.

Answer

Modify the default domain-wide sign-in security policy to require security keys globally and grant exceptions via API.

Answer

Configure Context-Aware Access to block non-security key authentications for the contractors group.

Answer

Create an IAM custom role that revokes prompt-based authentication for external users.

Question 8

You need to create a custom administrator role that allows specific users to manage Google Meet hardware devices and review their health status, but nothing else. Which privilege category should you select when building this custom role?

Accepted Answer

Services > Google Meet hardware. To manage Google Meet hardware devices and review their health, the custom role must include privileges from the 'Services > Google Meet hardware' category. This category contains the specific privileges for viewing and managing Meet hardware devices, such as 'View Devices' and 'Manage Devices', which are exactly what the role requires.

Answer

Organizational Units and Admin Roles

Answer

Mobile and Endpoints > Device Management

Answer

Security Center > Investigation Tool

Question 9

You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?

Accepted Answer

Context-Aware Access access levels referencing IP subnets and device policy compliance, assigned to targeted apps.. Context-Aware Access allows you to combine IP address subnets and device-policy compliance (corporate-owned status via endpoint management) to control access.

Answer

Google Cloud IAM conditions with Context-Aware Access and Security Health Analytics

Answer

Domain-wide SAML SSO with custom attribute mapping for IP addresses

Answer

Advanced Protection Program combined with Context-Aware Access

Question 10

An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?

Accepted Answer

Security > Authentication > 2-step verification. Enforcing 2-Step Verification requires navigating to Security > Authentication > 2-step verification in the Google Admin console.

Answer

Account settings > Security settings > 2SV

Answer

Directory > Users > Security > Access control

Answer

Devices > Mobile & endpoints > Settings > Universal settings

Question 11

An organization wants to prevent users from signing in to their Google Workspace accounts from outside their home country. Which feature should the administrator configure?

Accepted Answer

Context-Aware Access. Context-Aware Access allows administrators to define access levels based on attributes such as IP address, device type, and user identity, and apply them to Google Workspace apps. By configuring an access level that restricts access to the organization's home country IP ranges, the admin can block sign-ins from outside that country.

Answer

Data Region Policy

Answer

Advanced Protection Program

Answer

Password Monitoring

Question 12

Your company has an external contractor who needs temporary access to Google Workspace. You want to ensure their account automatically deactivates after 30 days without manual administrative intervention. How can you achieve this securely?

Accepted Answer

Use Cloud Identity Premium automated user lifecycle management or the Admin SDK API to schedule account suspension after 30 days.. Cloud Identity Premium provides automated user lifecycle management, allowing you to set policies to suspend accounts after a period of inactivity. Alternatively, you can use the Admin SDK API to programmatically suspend the account after 30 days. This achieves automatic deactivation without manual intervention.

Answer

Enable the Advanced Protection Program, which automatically deletes inactive external accounts after 30 days.

Answer

Set the user password expiration policy specifically for that user's OU to 30 days.

Answer

Configure a Context-Aware Access rule with a time-based expiration condition.

Question 13

An administrator needs to view a report showing which users in the organization have not enabled 2-Step Verification. Where should the administrator look in the Google Admin console?

Accepted Answer

Reporting > Reports > Security > 2-Step Verification adoption. The correct location is Reporting > Reports > Security > 2-Step Verification adoption. This built-in report provides a list of users who have not enrolled in 2-Step Verification, along with their enrollment status. It is specifically designed to monitor 2SV adoption across the organization.

Answer

Account settings > Security metrics > Export

Answer

Security > Authentication > Dashboard > User status

Answer

Directory > Users > Filter > 2SV Status

Question 14

Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?

Accepted Answer

The SAML app service status is set to OFF for the user's organizational unit or access group.. This error occurs when the SAML app is configured in the Google Admin console, but access is turned OFF for the user or their organizational unit.

Answer

The IdP signing certificate has expired.

Answer

The user's password has expired and needs to be reset.

Answer

The user does not have a Google Cloud Platform billing account attached.

Question 15

An administrator needs to restrict access to Google Workspace apps so that users can only log in from corporate-managed Chromebooks and Windows devices enrolled in Endpoint Management, while blocking all mobile devices entirely. How should this be implemented?

Accepted Answer

Use Context-Aware Access with access levels checking for device policy compliance and specific operating systems (desktop OS only).. Context-Aware Access is the only Google Workspace mechanism that evaluates device posture (managed/enrolled status, OS type, screen lock, encryption) at authentication time via access levels. By creating an access level that requires 'device policy compliance' and restricting the OS to Chrome OS and Windows (excluding iOS/Android), the admin enforces the exact policy described. Access levels are then bound to Workspace apps (Gmail, Drive, etc.) so users on unmanaged or mobile devices are denied.

Answer

Set up IAM conditions in the Google Cloud console for Google Workspace endpoints.

Answer

Apply an Advanced Protection policy for all mobile users.

Answer

Configure mobile device management settings to turn off Google sync for iOS and Android.