GWS-ADMIN User Accounts Domains And Directory Practice Test 2 — 15 Questions

Question 1

Your organization has a Google Workspace account with the primary domain 'example.com'. You need to add a domain alias 'example.net' so that users can receive email sent to either domain. After adding the domain alias in the Admin console, what must you do to ensure that email sent to 'user@example.net' is delivered to 'user@example.com'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify ownership of example.net by adding a TXT record to its DNS settings.. After adding a domain alias, you must verify ownership of the alias domain by adding a TXT record to its DNS settings. Google Workspace then automatically configures the necessary MX records and routes email for the alias to the corresponding users in the primary domain.

Answer

Configure an MX record for example.net that points to Google's mail servers.

Answer

Create a new user account for each user with the example.net domain.

Answer

Set up a catch-all address for example.net to forward to example.com.

Question 2

Your organization uses Google Workspace and has a large number of users in the 'Sales' organizational unit. A new compliance policy requires that all Sales users' sign-in activity be visible via the Reports API for at least 12 months. You need to ensure that the audit logs for Sales users are retained for the required period without affecting other organizational units. Which configuration should you implement?

Accepted Answer

In the Admin console, go to Reporting > Audit and investigation > Audit log retention, and set the retention period for login audit logs to 12 months for the Sales OU.. Login audit events are retained according to audit log retention settings located under Reporting > Audit and investigation. Setting the retention period for the Sales OU to 12 months ensures that sign-in activity for those users is preserved for the compliance window while leaving other OUs at default retention. Data protection rules and user profile settings do not govern audit log retention.

Answer

In the Admin console, go to Directory > Users > Sales OU and enable 'Extended audit log retention' for each user in the OU.

Answer

In the Admin console, go to Security > Access and data control > Data protection, and create a rule that applies to the Sales OU and retains login audit events for 12 months.

Answer

In the Admin console, go to Security > Access and data control > Data protection, and create a rule for the Sales OU that sets retention to 12 months for Drive files.

Question 3

A Google Workspace administrator needs to delegate administrative privileges to a user to manage user accounts and groups within a specific organizational unit. The administrator wants to follow the principle of least privilege. Which two roles should the administrator assign to the user? (Choose two.)

Accepted Answer

Groups Admin. To delegate management of user accounts and groups within a specific organizational unit while adhering to least privilege, the administrator should assign the User Management Admin and Groups Admin roles. These roles, when scoped to the OU, provide the necessary permissions without granting excessive access. Super Admin, Help Desk Admin, and Services Admin either grant too much or too little privilege for this scenario.

Answer

Super Admin

Answer

Help Desk Admin

Answer

Services Admin

Question 4

A Google Workspace administrator uses GCDS to synchronize users from an on-premises LDAP directory. The administrator wants to prevent a specific set of users from being deleted in Google Workspace when they are removed from the LDAP source. Which GCDS configuration should be used?

Accepted Answer

Deletion policy set to 'Suspend' instead of 'Delete' in the GCDS configuration. GCDS deletes or suspends users based on its deletion policy when they are no longer present in the LDAP source. Setting the policy to suspend ensures accounts are disabled rather than removed, preserving data and allowing review. Exclusion rules, organizational units, and Google Groups do not prevent deletion in this context.

Answer

A Google Group that includes those users, with GCDS configured to ignore group members

Answer

Exclusion rules that filter out those users from the synchronization scope

Answer

A Google Workspace organizational unit that contains only those users

Question 5

A Google Workspace administrator needs to change the primary domain of the account from 'example.com' to 'newdomain.com'. The account currently has 'example.com' as the primary domain and 'newdomain.com' as a secondary domain. What is the correct process to achieve this?

Accepted Answer

In the Admin console, go to Domains > Manage domains, click 'Change primary domain', and select 'newdomain.com'.. The correct method to change the primary domain is to use the 'Change primary domain' feature in the Admin console. This allows promoting a verified secondary domain to primary. The other options either describe unavailable features or incorrect procedures that could disrupt services.

Answer

In the Admin console, go to Domains, select 'newdomain.com', and click 'Set as primary domain'.

Answer

Contact Google Workspace support to change the primary domain, as it cannot be done self-service.

Answer

Remove the secondary domain 'newdomain.com', then add it as the primary domain after removing 'example.com'.

Question 6

A user named Priya in the 'Support' organizational unit reports that she cannot find a colleague in the Global Directory when composing a new email. You confirm the colleague's account exists and is active in the 'Sales' organizational unit. You need to allow Priya to see Sales users in the directory while still preventing her from seeing users in the 'Executive' organizational unit. What should you configure?

Accepted Answer

In the 'Support' OU's directory settings, set the directory visibility to 'All users in the domain' and rely on the 'Executive' OU's own visibility setting to keep its users hidden.. Directory visibility is a per-OU setting that determines which users an OU's members can see, and it also controls whether that OU's users are visible to others. Setting Support to see all domain users makes Sales visible, while the Executive OU's own restricted visibility keeps its users hidden. There is no per-OU exclusion rule to hide a specific OU from another.

Answer

Set the 'Support' OU's directory visibility to 'All users in the domain' and then create a custom directory rule to hide the 'Executive' OU.

Answer

In the 'Support' OU's directory settings, set the directory visibility to include the 'Sales' OU but exclude the 'Executive' OU using a custom visibility rule.

Answer

In the 'Support' OU's directory settings, enable 'Contacts sharing' and add the Sales OU as a trusted group.

Question 7

Contoso's Workspace administrator has set up a super admin account and wants to reduce risk from a compromised admin credential. The security team requires that all super admin sign-ins use a hardware security key and that no super admin can bypass this requirement. Which action should the administrator take?

Accepted Answer

Create a separate organizational unit for super admins and enforce security keys as the only allowed second factor for that OU.. A dedicated organizational unit for super admins allows a 2-Step Verification policy that allows only security keys. Because child OU settings take precedence, the stricter rule cannot be overridden by broader org-level enforcement, and admins cannot choose a weaker factor. This centralizes enforcement and satisfies the requirement that no super admin can bypass the hardware key.

Answer

Enable Advanced Protection Program enrollment for the super admins and rely on Google to enforce the hardware key requirement.

Answer

Disable password login for super admins and require them to authenticate only through a third-party SAML identity provider.

Answer

Enforce 2-Step Verification for the entire organization and allow super admins to use any second factor they prefer.

Question 8

You are the Workspace administrator at Fabrikam. The HR team has asked you to make sure that when employees leave, their accounts are suspended immediately and their managers can still access the leavers' mail and Drive files for 30 days. Which two actions should you take to meet these requirements while keeping the account recoverable? (Choose two.)

Accepted Answer

Suspend the user account in the Admin console so sign-in is blocked but data is retained.. Suspension is the reversible way to block sign-in while retaining all data, and transferring Drive ownership plus delegating Gmail gives the manager legitimate access during the 30-day window. Together they satisfy both immediate lockout and continued business access. Deleting the account or stripping group memberships would either start a purge clock or disrupt resources without adding value.

Answer

Delete the user account and rely on the 30-day recovery window to restore it if needed.

Answer

Remove the user from all groups and organizational units so they cannot access any resources.

Answer

Rename the user account to a shared mailbox address and reset the password for the manager.

Question 9

A Workspace administrator at Litware needs to give the marketing team the ability to manage their own group membership, but the team should not be able to change the group's name or who can join. The administrator creates the group in the Admin console. Which setting should be configured to meet this requirement?

Accepted Answer

Assign the marketing team members the Groups Editor role for the group and leave the group's name and join settings locked to admins.. The Groups Editor role lets designated users manage membership without granting the broader powers of an owner, such as renaming the group or changing join permissions. Assigning that role to the marketing team satisfies the requirement while keeping structural settings under administrative control. Making them owners would give too much authority, and visibility settings do not affect membership management.

Answer

Make the marketing team members group owners so they have full control over the group's settings and membership.

Answer

Change the group type to a collaborative inbox so members can manage conversations and membership.

Answer

Set the group's access permissions so that only group members can view the membership list.

Question 10

You are automating user creation via the Directory API. Which scope is required to create users?

Accepted Answer

https://www.googleapis.com/auth/admin.directory.user. The admin.directory.user scope is required for CRUD operations on user objects.

Answer

https://www.googleapis.com/auth/admin.reports.audit.readonly

Answer

https://www.googleapis.com/auth/admin.directory.group

Answer

https://www.googleapis.com/auth/admin.directory.domain.readonly

Question 11

Which tool would you use to sync local Active Directory users to Google Workspace?

Accepted Answer

Google Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the standard tool for one-way synchronization from AD to Google.

Answer

Google Workspace Migrate

Answer

Directory API

Answer

Admin SDK

Question 12

An administrator mistakenly deleted a user account 10 days ago. How can you restore this account?

Accepted Answer

Use the Restore User tool in the Admin console. Deleted users can be restored within 20 days via the Admin console.

Answer

Contact Google Support for data recovery

Answer

Restore from a Vault export

Answer

Create a new user with the same email

Question 13

You have multiple domains in a single Google Workspace account. How can you provision users in a specific sub-domain?

Accepted Answer

Select the domain from the dropdown in the 'Add user' dialog. When adding a user in the Google Workspace Admin console, the 'Add user' dialog includes a dropdown menu that lists all verified domains and sub-domains in the account. Selecting the desired domain from this dropdown ensures the new user's primary email address is created under that specific domain. This is the standard, direct method for provisioning users in any domain or sub-domain without altering the primary domain or using aliases.

Answer

Rename the primary domain

Answer

Use a group alias

Answer

Create an OU for the domain

Question 14

You need to add a secondary domain to your Google Workspace account. What must you perform after adding the domain in the Admin console?

Accepted Answer

Verify domain ownership. Verification is mandatory to prove domain ownership via DNS records.

Answer

Create a new OU

Answer

Set up SPF records

Answer

Provision user accounts

Question 15

A new employee needs access to Google Workspace. What is the minimum action required in the Google Admin console to create the account?

Accepted Answer

Add a user and assign a Google Workspace license. Creating a user in the Admin console requires defining a primary email address and assigning a license for access.

Answer

Assign a Google Groups membership

Answer

Configure an alias

Answer

Create an organizational unit