GWS-ADMIN Security Policies And Access Controls — Timed 15 Questions

Question 1

Which THREE built-in administrator roles in Google Workspace grant privileges to manage user accounts and reset passwords? (Choose three.)

Accepted Answer

Reseller Admin. User Management Admin, Groups Admin (for group users), and Super Admin have user-related controls. Wait, the roles that manage user accounts directly are Super Admin, User Management Admin, and Reseller Admin or specific custom roles. Let's select Super Admin, User Management Admin, and Advanced Services Admin or similar. Wait, let's look at standard roles: Super Admin, User Management Admin, and Helpdesk Admin (or User Management Admin variants). Let's review standard roles: Super Admin, User Management Admin, and Groups Admin (for group members)? No, Groups Admin manages groups. Let's use Super Admin, User Management Admin, and Desktop Security Admin? Let's check standard Google Workspace admin roles: Super Admin, User Management Admin, and Services Admin? Services Admin doesn't manage users. What about Account Administrator? Let's formulate the correct three standard roles that have user account management privileges.

Answer

Services Admin

Answer

Groups Admin

Question 2

Your organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?

Accepted Answer

Place contractors in a dedicated OU, navigate to Security > Authentication > 2-step verification, and configure the allowed methods to only include security keys.. Security key enforcement can be targeted to specific organizational units or security groups by setting the 2SV policy appropriately.

Answer

Modify the default domain-wide sign-in security policy to require security keys globally and grant exceptions via API.

Answer

Configure Context-Aware Access to block non-security key authentications for the contractors group.

Answer

Create an IAM custom role that revokes prompt-based authentication for external users.

Question 3

You need to create a custom administrator role that allows specific users to manage Google Meet hardware devices and review their health status, but nothing else. Which privilege category should you select when building this custom role?

Accepted Answer

Services > Google Meet hardware. Privileges for managing Meet hardware and devices are found under the Services and Devices privilege trees.

Answer

Organizational Units and Admin Roles

Answer

Mobile and Endpoints > Device Management

Answer

Security Center > Investigation Tool

Question 4

An administrator needs to configure password requirements, such as minimum length and expiration policies, for all users in the domain. Where is this configured in the Google Admin console?

Accepted Answer

Security > Password management. Password policies are managed under Security > Password management in the Google Admin console.

Answer

Apps > Google Workspace > Gmail > Security

Answer

Directory > Users > Password settings

Answer

Account settings > Personalization > Passwords

Question 5

Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?

Accepted Answer

Configure SSO profile assignment to exclude Super Administrators or use the 'Allow users to sign in with Google password' option on the SSO profile page.. Google Workspace allows you to configure a secondary SSO profile or enable network/admin bypass settings to allow admin sign-in via Google credentials.

Answer

Disable SAML SSO entirely and rely exclusively on Google's built-in OAuth service.

Answer

Enable the 'Turn on SSO for administrative accounts' option and assign a backup password.

Answer

Create a Context-Aware Access rule that triggers emergency recovery mode when the IdP IP is unreachable.

Question 6

You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?

Accepted Answer

Context-Aware Access access levels referencing IP subnets and device policy compliance, assigned to targeted apps.. Context-Aware Access allows you to combine IP address subnets and device-policy compliance (corporate-owned status via endpoint management) to control access.

Answer

Google Cloud IAM conditions with Context-Aware Access and Security Health Analytics

Answer

Domain-wide SAML SSO with custom attribute mapping for IP addresses

Answer

Advanced Protection Program combined with Context-Aware Access

Question 7

An administrator needs to grant a helpdesk employee the ability to reset user passwords and view user information without granting them full super administrator privileges. Which built-in admin role should be assigned?

Accepted Answer

User Management Admin. The User Management Admin role grants permissions to reset passwords, manage user profiles, and view organizational units.

Answer

Helpdesk Admin

Answer

Groups Admin

Answer

Services Admin

Question 8

Your company uses a third-party Identity Provider (IdP) for Single Sign-On (SSO) via SAML. A newly hired employee is unable to sign in, and you suspect their account is not properly mapped or provisioned. Where can you check SAML sign-in activity and error logs in the Google Admin console?

Accepted Answer

Reporting > Audit > SAML. Log events related to SAML and SSO authentication failures are recorded in the SAML log events section of the Google Admin console.

Answer

Directory > Users > [User] > Activity > Sign-in activity

Answer

Reporting > Audit > Admin log events

Answer

Security > Authentication > SAML log events

Question 9

An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?

Accepted Answer

Security > Authentication > 2-step verification. Enforcing 2-Step Verification requires navigating to Security > Authentication > 2-step verification in the Google Admin console.

Answer

Account settings > Security settings > 2SV

Answer

Directory > Users > Security > Access control

Answer

Devices > Mobile & endpoints > Settings > Universal settings

Question 10

An organization wants to prevent users from signing in to their Google Workspace accounts from outside their home country. Which feature should the administrator configure?

Accepted Answer

Context-Aware Access. Context-Aware Access supports restricting access based on geographic location (country/region).

Answer

Data Region Policy

Answer

Advanced Protection Program

Answer

Password Monitoring

Question 11

Your organization wants to prevent users from sharing Google Drive files externally, but you need to make an exception for a specific partner domain. Where should you configure this allowed domain list?

Accepted Answer

Apps > Google Workspace > Drive and Docs > Sharing settings > Whitelisted domains. Allowed external domains for sharing are managed under Apps > Google Workspace > Drive and Docs > Sharing settings.

Answer

Security > Authentication > Trusted domains

Answer

Directory > Organizational units > External sharing policy

Answer

Security > Access and data control > Whitelisted domains

Question 12

An administrator has configured a new SAML SSO integration with a third-party IdP. Users are complaining that they can log in successfully, but after 30 minutes, they are unexpectedly forced to re-authenticate. Where can the administrator adjust the session duration for SAML apps?

Accepted Answer

Security > Authentication > SSO with third-party IdP > Session length settings. SAML session length settings for third-party applications are configured within the specific SAML app settings in the Google Admin console.

Answer

Security > Access and data control > API controls

Answer

Apps > Web and mobile apps > [SAML App] > Service status

Answer

Account settings > Profile > Session duration

Question 13

Your company requires that any user attempting to access Google Drive from an unmanaged mobile device must be blocked, while desktop browsers on unmanaged devices are permitted read-only access via Context-Aware Access. How should you structure your Access Levels and assignments?

Accepted Answer

Create two access levels (one for mobile compliant devices, one for desktop OS/browsers) and assign them conditionally using advanced CAA expressions.. Context-Aware Access requires creating separate access levels for device policy compliance and assigning them selectively to apps.

Answer

Set up Alert Center policies to automatically revoke OAuth tokens when an unmanaged mobile device accesses Drive.

Answer

Configure mobile device management (MDM) basic rules to block Drive synchronization on unmanaged iOS/Android.

Answer

Create a single access level checking for device policy compliance and assign it to Google Drive for all devices.

Question 14

Your company has an external contractor who needs temporary access to Google Workspace. You want to ensure their account automatically deactivates after 30 days without manual administrative intervention. How can you achieve this securely?

Accepted Answer

Use Cloud Identity Premium automated user lifecycle management or the Admin SDK API to schedule account suspension after 30 days.. Google Workspace accounts do not have a native 'account expiration date' field by default, but you can manage this via Directory Sync or automated scripts using Admin SDK, or by setting calendar alerts. However, the standard administrative feature for automated lifecycle management is Directory Sync or Cloud Identity lifecycle features. Wait, looking at standard admin tools: Google Workspace allows setting user account expiration using the Admin SDK or automated lifecycle rules in cloud identity, or using Context-Aware Access temporary rules. Let's look at the options.

Answer

Enable the Advanced Protection Program, which automatically deletes inactive external accounts after 30 days.

Answer

Set the user password expiration policy specifically for that user's OU to 30 days.

Answer

Configure a Context-Aware Access rule with a time-based expiration condition.

Question 15

An administrator needs to view a report showing which users in the organization have not enabled 2-Step Verification. Where should the administrator look in the Google Admin console?

Accepted Answer

Reporting > Reports > Security > 2-Step Verification adoption. The Security dashboard and reports provide visibility into 2SV adoption status across users.

Answer

Account settings > Security metrics > Export

Answer

Security > Authentication > Dashboard > User status

Answer

Directory > Users > Filter > 2SV Status