GWS-ADMIN Security Policies And Access Controls Practice Test 4 — 15 Questions

Question 1

An administrator needs to delegate the role of creating and managing Google Groups across the entire domain without giving full admin rights. Which built-in role should be assigned?

Accepted Answer

Groups Admin. The Groups Admin built-in role is specifically designed to grant full management of Google Groups across the domain — creating, deleting, and managing groups, memberships, and settings — without granting other admin privileges. It is a delegated admin role scoped to Groups functionality, matching the requirement exactly.

Answer

Directory Sync Admin

Answer

Helpdesk Admin

Answer

User Management Admin

Question 2

Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?

Accepted Answer

SAML Single Logout (SLO) URL configuration in the SSO profile.. Single Logout (SLO) allows users to terminate their session across both Google Workspace and the configured SAML IdP.

Answer

Context-Aware Access session termination

Answer

OAuth token revocation API

Answer

Automated user provisioning via SCIM

Question 3

You need to create a custom administrator role that allows a security analyst to use the Security Center Investigation Tool, view audit logs, and manage alerts, but prevents them from modifying user passwords or organizational unit structures. Which exact set of privileges should you assign?

Accepted Answer

Select privileges from Security Center (Investigation Tool, Alerts) and Reporting (Audit logs), while leaving User Management and OU privileges unchecked.. The correct approach is to create a custom role by selecting only the necessary privileges: Security Center (Investigation Tool, Alerts) and Reporting (Audit logs), while leaving User Management and OU privileges unchecked. This grants the security analyst the required access without granting unnecessary permissions.

Answer

Grant 'Super Admin' privileges and restrict access using Context-Aware Access.

Answer

Assign the 'Helpdesk Admin' role combined with 'Security Center Reader'.

Answer

Assign the built-in 'Security Admin' role and remove user management privileges via override.

Question 4

Your organization uses Context-Aware Access to restrict access to Google Workspace based on IP address ranges. A remote employee traveling for business is unable to access Gmail from a trusted hotel Wi-Fi. How should the administrator temporarily grant access without compromising long-term security?

Accepted Answer

Temporarily move the user to an organizational unit that does not have the Context-Aware Access rule applied, or assign a temporary exception access level.. Temporarily moving the user to an OU without the Context-Aware Access rule or assigning a temporary exception access level grants access without weakening the overall security posture. This approach is reversible and does not require permanent changes to access levels or disabling security features.

Answer

Permanently add the hotel IP subnet to the global Context-Aware Access access level.

Answer

Disable 2-Step Verification for the user's account.

Answer

Reset the user's OAuth tokens via the Admin SDK.

Question 5

An administrator needs to review recent security alerts and proactive recommendations for improving domain security. Where should they look first in the Google Admin console?

Accepted Answer

Security > Security Center > Dashboard. The Security Center Dashboard in the Google Admin console is the single pane of glass that surfaces current security alerts, a security health score, and proactive recommendations (e.g., enabling 2SV, configuring SPF/DKIM/DMARC, restricting external sharing). It is the intended first stop for reviewing both alerts and hardening recommendations.

Answer

Directory > Users > Security status

Answer

Reporting > Audit logs > Security overview

Answer

Apps > Google Workspace > Security Center

Question 6

An organization wants to integrate Google Workspace with an external SAML IdP. However, some users (such as external contractors) should continue authenticating directly against Google's native login page using their Google password and 2SV. How should the administrator configure SSO to support this mixed environment?

Accepted Answer

Assign the SAML SSO profile selectively to specific organizational units or access groups, leaving the contractor OU on 'Deactivated' SSO settings.. SAML SSO profiles in Google Workspace are assigned per organizational unit, so the administrator can enable the third-party IdP profile for the employee OU while leaving the contractor OU on 'Deactivated' SSO. Contractors in the deactivated OU then authenticate directly against Google's native login page with their Google password and 2SV.

Answer

Use Context-Aware Access to redirect contractor sign-ins to the third-party IdP while routing employees to Google.

Answer

Set up two separate Google Workspace domains, one for contractors and one for employees.

Answer

Configure domain-wide SAML SSO and check the box to allow emergency Google passwords for all users.

Question 7

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

Accepted Answer

Enforce hardware security keys as the only allowed 2-Step Verification method for administrator accounts.. Securing admin accounts involves mandating strict 2SV methods and restricting admin access to known IPs or devices.

Answer

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Answer

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Answer

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Question 8

When setting up SAML SSO with a third-party Identity Provider (IdP), which THREE pieces of information must typically be exchanged or configured in the Google Admin console? (Choose three.)

Accepted Answer

Entity ID (Issuer) provided by the IdP. In the Google Admin console's SAML SSO configuration (Security > Authentication > SSO with third-party IdP), you must supply the IdP's Entity ID (Issuer) so Google can validate the SAML assertion's issuer and audience (Option A). You must also enter the IdP's Sign-in URL (SSO endpoint) so Google can redirect unauthenticated users to the correct IdP login page (Option C). Finally, you upload the IdP's X.509 public signing certificate so Google can verify the digital signature on incoming SAML responses/assertions (Option E). Options B and D are incorrect because SAML SSO is an XML-based authentication federation protocol and never requires a SQL database connection string or any Google Workspace master database encryption key; those are unrelated to SAML metadata exchange.

Answer

The third-party IdP database connection string (SQL connection)

Answer

Google Workspace master database encryption key

Question 9

Which THREE features or tools in Google Workspace can be used to monitor and investigate suspicious sign-in activity or security anomalies? (Choose three.)

Accepted Answer

Security Center > Investigation Tool. Option B (Security Center > Investigation Tool) is correct because it lets admins run targeted queries across Workspace logs (e.g., login, Drive, Gmail) to investigate suspicious sign-in activity and security anomalies, and take remediation actions like deleting emails or suspending users. Option C (Alert Center) is correct because it surfaces security alerts such as suspicious login attempts, leaked passwords, and government-backed attacks, giving admins a centralized place to triage and respond to anomalies. Option E (Reporting > Audit > Log events, e.g., Login, Admin, SAML) is correct because the audit log lets admins review detailed authentication and admin events, including SAML and login activity, to trace suspicious sign-in behavior. Option A (Drive sharing settings) is incorrect because it only controls external sharing and link visibility, not sign-in monitoring. Option D (Directory > Users > Bulk update via CSV) is incorrect because it is a user-provisioning/management feature, not a security monitoring or investigation tool.

Answer

Apps > Google Workspace > Drive sharing settings

Answer

Directory > Users > Bulk update via CSV

Question 10

An administrator is configuring Context-Aware Access to secure corporate data. Which TWO criteria can be evaluated within a Context-Aware Access access level expression? (Choose two.)

Accepted Answer

User's current geographic location (country/region).. Context-Aware Access access levels in Google Workspace/Cloud Identity are built from attributes about the user's identity, the request context, and the device, evaluated by Access Context Manager. Option D is correct because access levels can include geographic location conditions, such as the source IP's country/region, to allow or block access based on where the request originates. Option E is correct because device-based conditions are a core part of Context-Aware Access: access levels can require device policy compliance attributes like disk encryption, screen lock, and OS version via endpoint verification/device management. Option A is not a supported access level attribute, as Gmail inbox metrics are not part of Access Context Manager expressions. Option B is not evaluated by Context-Aware Access, since local OS password complexity and history are not exposed as access level criteria. Option C is not a supported criterion, as directory schema fields such as a manager name are not used in access level expressions.

Answer

The number of unread emails in the user's Gmail inbox.

Answer

The user's local operating system password complexity and history length.

Answer

The user's direct manager name listed in the directory schema.

Question 11

Which TWO mechanisms can an administrator use to recover access if a Super Administrator loses their 2-Step Verification device and is locked out? (Choose two.)

Accepted Answer

Have another Super Administrator reset the locked admin's 2-Step Verification status in the Google Admin console.. Option A is correct because a peer Super Administrator can open the Google Admin console, go to the user's Security settings, and reset the locked admin's 2-Step Verification enrollment, forcing re-enrollment at next sign-in. Option E is correct because Google generates one-time backup verification codes (10 codes) that can be used in place of a 2SV prompt when the primary device is unavailable, provided they were saved in advance. Option B is wrong because Google Workspace support cannot instantly disable 2SV without proper verification and typically requires the customer to have another Super Admin perform the reset. Option C is wrong because an external SAML IdP handles federated authentication, not Google's native 2SV, and cannot bypass it for a non-federated account. Option D is wrong because 'root domain controller administrative credentials' is an on-premises Active Directory concept and has no bearing on Google Workspace Super Admin authentication.

Answer

Call Google Workspace technical support to instantly disable 2SV without verification.

Answer

Send a password reset request to the external SAML IdP to bypass Google 2SV.

Answer

Log in using the root domain controller administrative credentials.

Question 12

Which TWO practices are recommended when configuring organizational units (OUs) for security policy enforcement in Google Workspace? (Choose two.)

Accepted Answer

Regularly audit OU membership and policy inheritance to ensure users receive appropriate security controls.. Option C is correct because Google Workspace policies are inherited down the OU tree, so regularly auditing OU membership and inheritance ensures users actually receive the intended security controls and that no one is misplaced in an OU with weaker settings. Option E is correct because structuring OUs hierarchically to mirror departments or differing security requirements lets child OUs inherit parent policies while allowing targeted overrides only where needed, which is the recommended design for policy enforcement. Option A is not recommended because Super Administrator privileges should be tightly limited, not granted to each OU head, since that role has broad control over all services and settings. Option B is unnecessary and error-prone because child OUs already inherit parent policies, so overriding identical policies at every level adds administrative overhead and risk of inconsistency. Option D is wrong because placing all users in the root OU prevents granular, differentiated policy application by department or security requirement.

Answer

Assign Super Administrator privileges to the head of each organizational unit.

Answer

Override policies at every child OU level even when parent policies are identical to ensure redundancy.

Answer

Place every single user in the root organizational unit to ensure uniform policy application.

Question 13

An enterprise organization is planning its 2-Step Verification (2SV) rollout. Which THREE methods or tokens are natively supported by Google Workspace for 2SV authentication? (Choose three.)

Accepted Answer

Time-based One-Time Password (TOTP) authenticator apps (e.g., Google Authenticator). Google Workspace natively supports several 2SV methods, and the three correct options here are A, D, and E. Option A is correct because Time-based One-Time Password (TOTP) authenticator apps such as Google Authenticator generate 6-digit codes from a shared secret and are a standard 2SV method in Google Workspace. Option D is correct because Google Prompts push a sign-in approval notification to a trusted mobile device signed into the same account, allowing the user to tap Yes/No without typing a code. Option E is correct because FIDO2/U2F security keys like Titan keys are supported as phishing-resistant hardware tokens for 2SV. Option B is not correct because Google Workspace 2SV does not rely on local BIOS firmware biometric retina scanning; biometrics may unlock a device but are not a Workspace 2SV token. Option C is not correct because automatic voice call verification via landline pulse dialing tones is not a supported Google Workspace 2SV method.

Answer

Biometric retina scans processed by local BIOS firmware

Answer

Automatic voice call verification through landline pulse dialing tones

Question 14

An administrator wants to configure security policies to protect corporate data on mobile devices. Which THREE actions can be enforced through Google Workspace Endpoint Management? (Choose three.)

Accepted Answer

Enforce containerization or work profile segregation on Android devices.. Option A is correct because Google Workspace Endpoint Management supports Android work profiles, which containerize corporate apps and data separately from personal apps and data, preventing cross-contamination and enabling IT to manage only the work side. Option B is correct because administrators can enforce device policies such as requiring a screen lock and a strong password/PIN on enrolled mobile devices before granting access to Workspace data. Option C is correct because Endpoint Management allows administrators to remotely wipe corporate data (a selective/account wipe) or perform a full device wipe on lost or stolen devices to protect sensitive information. Option D is not correct because deep packet inspection of all cellular traffic is a network-level capability typically performed by carrier or dedicated security appliances, not a policy enforced by Google Workspace Endpoint Management. Option E is not correct because reading personal text messages on a user's personal phone would violate privacy boundaries and is not a function of Google Workspace Endpoint Management, which manages corporate data and app access rather than personal communications.

Answer

Configure deep packet inspection on all cellular data traffic passing through the device.

Answer

Directly access and read personal text messages stored on the user's personal phone.

Question 15

You need to enforce 2-Step Verification for a specific department while allowing others to opt-in voluntarily. Which configuration path should you use?

Accepted Answer

Move the department users into a dedicated Organizational Unit and enable 'Enforce' in the 2-Step Verification settings.. To enforce 2SV for specific users, you must use Organizational Units (OUs) or Groups and manage the enforcement settings under Security > Authentication > 2-step verification.

Answer

Apply the enforcement policy at the root Organizational Unit level.

Answer

Use the Google Cloud Identity platform to create a conditional access policy for individual users.

Answer

Set the 'Allowed to opt-in' setting to 'Off' for the entire domain.