GWS-ADMIN User Accounts Domains And Directory — 25 Questions

Question 1

You need to bulk upload 500 users using a CSV file. What is the required format for the CSV header row?

Accepted Answer

First Name, Last Name, Password, Email Address. The Google Admin console bulk upload tool requires specific headers like First Name, Last Name, and Email Address to process the file.

Answer

Email, Phone, Address

Answer

FirstName, LastName, Password

Answer

Username, Role, OU

Question 2

A user in the 'Sales' OU is not receiving policy updates applied to that OU. What is the most likely cause?

Accepted Answer

Inheritance is disabled for the Sales OU. Inheritance is the default behavior; if it is broken, child OUs do not receive parent policies.

Answer

The user is in a group

Answer

The domain is not verified

Answer

The user has a suspended account

Question 3

You want to restrict which users can sign in to Google Workspace based on IP address. Where do you configure this?

Accepted Answer

Security > Authentication > Network access. Network-based sign-in restrictions are configured in the Security > Authentication section.

Answer

Account Settings

Answer

Organizational Units

Answer

Directory settings

Question 4

You need to export a list of all users and their license status. What is the best method?

Accepted Answer

Export via Admin console Users list. The User report in the Admin console allows exporting user data to Google Sheets.

Answer

Use the Security investigation tool

Answer

Check the Billing report

Answer

Use the Directory API

Question 5

You have enabled 'Google+ ' for your organization, but some users cannot see it. What is the most likely cause?

Accepted Answer

They are in the wrong OU. The most likely cause is that the users are in the wrong organizational unit (OU). Google+ (now Google Currents or Google Workspace apps) is enabled or disabled at the OU level. If users are in an OU where the service is turned off, they will not see it.

Answer

They need a higher license

Answer

The API is disabled

Answer

Their browser cache is full

Question 6

Which TWO of the following steps are required to offboard a user and protect company data?

Accepted Answer

Transfer Drive data to another user. Option B is correct because transferring Drive data to another user (e.g., via the Google Workspace Admin console's "Transfer data" tool or the Data Transfer API) preserves the departing employee's files under a new owner before the account is suspended or deleted, preventing loss of company data. Option C is correct because changing the user's password immediately invalidates the user's knowledge of their credentials and, combined with session revocation, prevents further sign-ins and access to company resources during offboarding. Option A is wrong because disabling an entire domain would lock out all users, not just the departing one, and is not a per-user offboarding step. Option D is wrong because deleting an OU removes an organizational container and would affect every account inside it, not just the single user. Option E is wrong because adding the user as an alias does not revoke access or protect data; it merely creates an alternate address that routes mail to an existing mailbox.

Answer

Disable the domain

Answer

Delete the OU

Answer

Add the user as an alias

Question 7

Which TWO of the following are valid ways to verify domain ownership in Google Workspace?

Accepted Answer

Adding a TXT record to your DNS provider. Option A is correct because Google Workspace supports domain verification by placing a unique TXT record (google-site-verification=...) in the domain's DNS zone, which Google then queries to confirm ownership. Option E is correct because Google Workspace also supports verification via a CNAME record pointing a subdomain to google.com, which Google resolves to validate control of the domain. Editing MX records (B) is not a verification method—MX changes are part of enabling Gmail delivery, not proving ownership. Uploading a file to the domain root (C) is an HTML-file verification method used by other services (e.g., Search Console), not a supported Google Workspace domain-verification method. Emailing a verification code to the domain administrator (D) is not a Google Workspace verification mechanism, since Google cannot assume the recipient controls DNS or the domain.

Answer

Editing the MX records

Answer

Uploading a file to the root of your domain

Answer

Emailing a verification code to the domain administrator

Question 8

Which THREE of the following are benefits of using Organizational Units (OUs)?

Accepted Answer

Applying different service settings to different groups of users. Option B is correct because OUs let administrators link Group Policy Objects (GPOs) that deliver different service settings—such as Exchange or SharePoint configuration—to distinct groups of users within the same domain. Option C is correct because OUs provide the scope for applying mobile device management policies (for example, Intune or MDM GPO settings) targeted at specific departments rather than the whole organization. Option D is correct because security settings like password policies, account lockout thresholds, and user rights assignments can be applied via GPOs linked to specific OUs, enabling differentiated security baselines per user group. Option A is not a direct benefit of OUs, since access to shared files is controlled through NTFS and share permissions granted to security groups, not by OU structure itself. Option E is not a benefit of OUs, as automatic email forwarding rules are configured through mail flow rules or mailbox settings in Exchange, not through Organizational Units.

Answer

Controlling access to shared files

Answer

Creating automatic email forwarding rules

Question 9

Which THREE of the following settings are inherited by child OUs from the parent OU?

Accepted Answer

Mobile management policies. In Google Workspace / Cloud Identity, child OUs inherit the mobile management policies (B) configured on the parent OU, so devices in sub-OUs follow the same Android/iOS management settings unless explicitly overridden. Service status ON/OFF (C) is also inherited, meaning a service enabled or disabled at the parent OU applies to all child OUs unless a child OU overrides it. Password strength requirements (D) are inherited as well, since password policies set at the parent OU propagate to sub-OUs by default. Admin roles assigned to the OU (A) are not inherited by child OUs; admin role assignments are scoped to the specific OU where they are granted and do not automatically cascade downward. User email address (E) is a per-user attribute, not an OU-level setting, so it is not inherited from a parent OU.

Answer

Admin roles assigned to the OU

Answer

User email address

Question 10

A Google Workspace administrator needs to bulk update the department and employee ID fields for 1,200 users using a Google Sheets file. Which tool should the administrator use to perform this update without writing code?

Accepted Answer

Bulk upload users with a CSV file in the Admin console. Bulk updating many user profiles without coding is done through the Admin console's bulk upload users feature, which consumes a CSV file. The administrator can export a template to Google Sheets, edit department and employee ID columns, and re-upload the file to apply changes to all existing accounts. Other tools either require code, only handle limited fields, or sync from external directories.

Answer

Google Workspace Admin SDK Directory API

Answer

Google Workspace Admin console bulk update tool

Answer

Google Workspace Directory Sync (GCDS)

Question 11

Your organization is migrating from a legacy identity provider to Google Workspace. You need to automate the creation, update, and suspension of user accounts based on your authoritative HR system, while ensuring that changes made in the HR system propagate to Google Workspace without manual intervention. Which method should you use to provision users at scale?

Accepted Answer

Use Google Cloud Directory Sync (GCDS) to synchronize users from an LDAP directory.. Automated user provisioning from an authoritative source like an HR system is best achieved with Google Cloud Directory Sync (GCDS), which synchronizes LDAP directory data to Google Workspace on a schedule. GCDS handles creation, updates, and suspensions without custom code, whereas manual creation and migration tools do not provide the required automation.

Answer

Use the Admin console to manually create each user account.

Answer

Use Google Workspace Migration for Microsoft Exchange (GWMME) to provision users.

Answer

Use the Directory API to create users programmatically.

Question 12

A Workspace administrator at Contoso needs to configure the account so that when a user is suspended, their mailbox stops accepting new mail but the existing messages remain available to a delegate for 30 days before the account is fully deleted. Which action should the administrator take first to stop new mail from being delivered to the suspended user?

Accepted Answer

Suspend the user account in the Admin console, which immediately disables sign-in and stops new mail delivery to the mailbox.. Suspension is the correct first action because it immediately prevents new mail from being delivered and blocks sign-in, while the mailbox and its contents remain intact and can be accessed by a delegate. It also aligns with the requirement to delay final deletion by placing the account in a suspended state rather than deleting or archiving it.

Answer

Delete the user account and rely on the 30-day recovery window to restore it if needed.

Answer

Move the user to a suspended Organizational Unit (OU) that has Gmail turned off for all members.

Answer

Archive the user in the Admin console, which moves the mailbox to a Google Vault archive and removes the user from the directory.

Question 13

You are setting up Google Workspace for a new company. You need to create Organizational Units (OUs) to reflect the company's structure. Which two of the following statements are true about Organizational Units? (Choose two.)

Accepted Answer

An OU can contain users, groups, and other OUs.. Organizational Units are hierarchical containers for users and other OUs. They are used to apply policies and settings to subsets of users. A user can belong to only one OU, and groups are not contained within OUs. The root OU can have child OUs. Therefore, the true statements are that OUs can contain users and other OUs, and that OUs are used to apply policies.

Answer

A user can belong to multiple OUs simultaneously.

Answer

The root OU cannot have child OUs.

Answer

Moving a user between OUs automatically updates their group memberships.

Question 14

A Google Workspace administrator needs to ensure that all new users in the Sales organizational unit automatically receive the 'Sales Team' Google Group membership upon account creation. The administrator wants to minimize manual effort and ensure consistency. What should they do?

Accepted Answer

Create a Google Group and use the Admin console to add all users in the Sales OU as members, then set up a rule to automatically add new users.. Automating group membership based on OU requires either manual addition of existing users plus a scripted solution for new users, or using Google Groups with dynamic membership if available. Since native dynamic groups based on OU are not supported, the most reliable method is to create a group and use the Admin SDK or Apps Script to add users automatically when they are created in the Sales OU.

Answer

Configure a Google Group with automatic membership via a Google Workspace Directory sync.

Answer

Create a dynamic group with a membership query based on the user's organizational unit.

Answer

Use the Admin console to set up a default group membership for the Sales OU.

Question 15

You are onboarding 300 new employees by uploading a CSV file through the Admin console. You need the upload to create accounts with the correct organisational unit, manager, and employee ID values. Which TWO of the following are required for the CSV bulk upload to succeed? (Choose two.)

Accepted Answer

Any custom attribute columns, such as Employee ID, must already exist in the directory schema before the upload.. Bulk uploads key off a unique primary email address per row, and any custom attribute such as Employee ID must already exist in the directory schema before the file is imported. Passwords are optional, PGP encryption is irrelevant, and the Org Unit Path column does not require a leading slash, so those distractors do not gate a successful upload.

Answer

The organisational unit column must reference the OU by its full path starting with a forward slash.

Answer

The CSV must be encrypted with a PGP key that Google can decrypt during import.

Answer

Each row must include the user's password in plain text so that Google can hash and store it.

Question 16

Your organization has a Google Workspace account with the primary domain 'example.com'. You need to add a domain alias 'example.net' so that users can receive email sent to either domain. After adding the domain alias in the Admin console, what must you do to ensure that email sent to 'user@example.net' is delivered to 'user@example.com'?

Accepted Answer

Verify ownership of example.net by adding a TXT record to its DNS settings.. After adding a domain alias, you must verify ownership of the alias domain by adding a TXT record to its DNS settings. Google Workspace then automatically configures the necessary MX records and routes email for the alias to the corresponding users in the primary domain.

Answer

Configure an MX record for example.net that points to Google's mail servers.

Answer

Create a new user account for each user with the example.net domain.

Answer

Set up a catch-all address for example.net to forward to example.com.

Question 17

Your organization uses Google Workspace and has a large number of users in the 'Sales' organizational unit. A new compliance policy requires that all Sales users' sign-in activity be visible via the Reports API for at least 12 months. You need to ensure that the audit logs for Sales users are retained for the required period without affecting other organizational units. Which configuration should you implement?

Accepted Answer

In the Admin console, go to Reporting > Audit and investigation > Audit log retention, and set the retention period for login audit logs to 12 months for the Sales OU.. Login audit events are retained according to audit log retention settings located under Reporting > Audit and investigation. Setting the retention period for the Sales OU to 12 months ensures that sign-in activity for those users is preserved for the compliance window while leaving other OUs at default retention. Data protection rules and user profile settings do not govern audit log retention.

Answer

In the Admin console, go to Directory > Users > Sales OU and enable 'Extended audit log retention' for each user in the OU.

Answer

In the Admin console, go to Security > Access and data control > Data protection, and create a rule that applies to the Sales OU and retains login audit events for 12 months.

Answer

In the Admin console, go to Security > Access and data control > Data protection, and create a rule for the Sales OU that sets retention to 12 months for Drive files.

Question 18

A Google Workspace administrator needs to delegate administrative privileges to a user to manage user accounts and groups within a specific organizational unit. The administrator wants to follow the principle of least privilege. Which two roles should the administrator assign to the user? (Choose two.)

Accepted Answer

Groups Admin. To delegate management of user accounts and groups within a specific organizational unit while adhering to least privilege, the administrator should assign the User Management Admin and Groups Admin roles. These roles, when scoped to the OU, provide the necessary permissions without granting excessive access. Super Admin, Help Desk Admin, and Services Admin either grant too much or too little privilege for this scenario.

Answer

Super Admin

Answer

Help Desk Admin

Answer

Services Admin

Question 19

A Google Workspace administrator uses GCDS to synchronize users from an on-premises LDAP directory. The administrator wants to prevent a specific set of users from being deleted in Google Workspace when they are removed from the LDAP source. Which GCDS configuration should be used?

Accepted Answer

Deletion policy set to 'Suspend' instead of 'Delete' in the GCDS configuration. GCDS deletes or suspends users based on its deletion policy when they are no longer present in the LDAP source. Setting the policy to suspend ensures accounts are disabled rather than removed, preserving data and allowing review. Exclusion rules, organizational units, and Google Groups do not prevent deletion in this context.

Answer

A Google Group that includes those users, with GCDS configured to ignore group members

Answer

Exclusion rules that filter out those users from the synchronization scope

Answer

A Google Workspace organizational unit that contains only those users

Question 20

A Google Workspace administrator needs to change the primary domain of the account from 'example.com' to 'newdomain.com'. The account currently has 'example.com' as the primary domain and 'newdomain.com' as a secondary domain. What is the correct process to achieve this?

Accepted Answer

In the Admin console, go to Domains > Manage domains, click 'Change primary domain', and select 'newdomain.com'.. The correct method to change the primary domain is to use the 'Change primary domain' feature in the Admin console. This allows promoting a verified secondary domain to primary. The other options either describe unavailable features or incorrect procedures that could disrupt services.

Answer

In the Admin console, go to Domains, select 'newdomain.com', and click 'Set as primary domain'.

Answer

Contact Google Workspace support to change the primary domain, as it cannot be done self-service.

Answer

Remove the secondary domain 'newdomain.com', then add it as the primary domain after removing 'example.com'.