GWS-ADMIN User Accounts Domains And Directory Practice Test 4 — 15 Questions

Question 1

You want to automate user account creation based on a specific event. What is the recommended approach?

Accepted Answer

Use the Directory API with a service account. Google Apps Script or the Directory API via a webhook/event-driven architecture is the standard method.

Answer

Use GCDS

Answer

Export/Import CSV daily

Answer

Use Google Forms

Answer

Manual input

Question 2

A user claims they cannot reset their password using the 'Forgot Password' link. What is the most likely cause?

Accepted Answer

The self-service reset feature is disabled in Security settings. If 'Allow users to reset their passwords' is disabled in the Security settings, they cannot use the self-service flow.

Answer

The user is an admin

Answer

The user has 2FA enabled

Answer

The user account is in an OU without a license

Question 3

Which TWO of the following are true regarding the Directory API?

Accepted Answer

It requires OAuth 2.0 for authentication. Option A is correct because the Directory API is a Google Workspace (formerly G Suite) Admin SDK API that requires OAuth 2.0 authorization with appropriate scopes (such as https://www.googleapis.com/auth/admin.directory.user or .group) to authenticate and authorize requests. Option D is correct because the Directory API provides resources for managing groups, including creating, updating, deleting, and listing groups and their members via endpoints like /admin/directory/v1/groups and /admin/directory/v1/groups/{groupKey}/members. Option B is incorrect because the Directory API does support bulk operations, such as batch requests and the members.insert/delete endpoints for managing multiple memberships. Option C is incorrect because access to the Directory API depends on the Google Workspace edition and admin privileges, not being universally free with all licenses. Option E is incorrect because access is governed by delegated admin roles and OAuth scopes, not restricted solely to Super Admins.

Answer

It does not support bulk operations

Answer

It is free to use with all licenses

Answer

It is only available to Super Admins

Question 4

Which TWO of the following are common reasons for a user sync failure in GCDS?

Accepted Answer

Incorrect LDAP query. Option C (Incorrect LDAP query) is correct because GCDS relies on the LDAP search base, scope, and filter configured in the sync settings to enumerate directory objects; a malformed or overly restrictive query returns no users or the wrong set, causing the sync to fail or produce incomplete results. Option E (Invalid OU mapping) is correct because GCDS maps source directory OUs to target Google Workspace OUs, and if a mapped OU does not exist or the mapping is misconfigured, the sync job errors out when it cannot place users in the specified destination. Option A (Expired Google license) is not a typical GCDS sync failure cause, since licensing affects user service access rather than the directory sync process itself. Option B (Incorrect password for the Google Admin) is not the standard failure mode because GCDS authenticates to Google using an OAuth 2.0 service account and JSON key, not an admin password. Option D (Browser compatibility issues) is irrelevant because GCDS is a standalone Windows application that runs as a service or config tool, not a browser-based interface.

Answer

Expired Google license

Answer

Incorrect password for the Google Admin

Answer

Browser compatibility issues

Question 5

Which THREE actions can be performed using the Google Admin console's bulk user management tool?

Accepted Answer

Suspending users. The bulk user management tool in the Google Admin console supports creating multiple users at once by uploading a CSV file with the required fields, so option E is correct. It also supports updating user information in bulk, such as names, organizational units, and other attributes, making option D correct. Suspending users in bulk is another supported action, allowing admins to suspend many accounts simultaneously, so option B is correct. Deleting user data is not a bulk operation available through this tool, and assigning custom admin roles is not supported in bulk here, so options A and C do not belong.

Answer

Deleting user data

Answer

Assigning custom admin roles

Question 6

Which THREE of the following are aspects of the Directory API 'user' resource?

Accepted Answer

Suspension status. The Directory API 'user' resource includes the 'suspended' field, which indicates whether the account is suspended, so option A (Suspension status) is correct. It also contains the 'name' object with givenName, familyName, and fullName properties, making option B (User's full name) correct. The resource's 'primaryEmail' field holds the user's primary email address, so option C (Primary email address) is correct. Option D (Device serial number) belongs to the Chrome/iOS device resources of the Directory API, not the user resource. Option E (Account creation date) is not a field of the user resource; creation time is exposed via the Admin SDK Reports API or the 'creationTime' field in other contexts, not as a standard user resource attribute.

Answer

Device serial number

Answer

Account creation date

Question 7

Which TWO of the following tasks can be performed in the Users section of the Admin console?

Accepted Answer

Assigning a user to a group. Option A is correct because the Users section of the Admin console allows administrators to assign users to groups, controlling group membership and the permissions that come with it. Option E is correct because resetting a user's password is a core user-management task performed from the Users section, where an admin can set a new password for the account. Options B, C, and D do not belong: domain verification is handled in the Domains section (via a TXT or CNAME record), SMTP relay configuration is done in the Apps/Gmail settings (SMTP relay service), and creating a new domain is also a Domains-section task, not a Users-section task.

Answer

Verifying the domain

Answer

Configuring SMTP relays

Answer

Creating a new domain

Question 8

Which THREE of the following are components of the Directory API 'group' resource?

Accepted Answer

Group name. In the Google Workspace Admin SDK Directory API, the group resource is defined by core attributes such as B. Group name (the group's display name), C. Group email address (the unique group email used to address the group), and E. Group description (an optional text field describing the group's purpose). These three fields are standard writable properties of the group resource returned by groups.get and set via groups.insert/groups.update. By contrast, A. Group members list is not part of the group resource itself; membership is managed through the separate Members resource (members.list/insert/delete). D. Group creator ID is also not a field of the group resource; the Directory API group schema does not expose a creator identifier as a group property.

Answer

Group members list

Answer

Group creator ID

Question 9

Which TWO of the following are types of domains in Google Workspace?

Accepted Answer

Secondary domain. In Google Workspace, the two recognized domain types are the Primary domain (E), which is the main domain used to create user accounts and is set during initial signup, and a Secondary domain (A), which is an additional domain added to the same Workspace account that can host its own users and is treated as a distinct domain rather than an alias. Both are officially supported domain types in the Admin console under Domains. The other options are not valid Workspace domain types: a Root domain (B) is DNS terminology, not a Workspace domain category; an External domain (C) is not a Workspace domain type; and a Verified alias (D) is not a domain type — domain aliases are a separate feature that map alternate domain names to existing users, not a type of domain itself.

Answer

Root domain

Answer

External domain

Answer

Verified alias

Question 10

Which TWO of the following can be modified in the Admin console's 'Company Profile' section?

Accepted Answer

Support contact phone number. In the Admin console's Company Profile section, administrators can edit the organization's identity and contact details, which includes the Organization name (E) and the Support contact phone number (C). These fields are part of the company profile information used to identify the organization and provide contact details for support. Individual user password requirements (A) are configured under security or password policies, not the Company Profile. Domain verification records (B) are managed in the Domains section, and user licenses (D) are handled in the Billing or Subscriptions area, so neither belongs to the Company Profile.

Answer

Individual user password requirements

Answer

Domain verification records

Answer

User licenses

Question 11

Your company has a Google Workspace domain, example.com. A new subsidiary, subsidiary.com, will use Google Workspace but must remain a separate domain in the Admin console. You have added subsidiary.com as a secondary domain and verified ownership. Users at subsidiary.com need email addresses such as alice@subsidiary.com, but their accounts must be under the same Google Workspace subscription. What should you do next?

Accepted Answer

Create user accounts with a primary email address in the subsidiary.com domain.. A secondary domain lets you create new user accounts with primary addresses in that domain while keeping the existing primary domain. After verifying ownership, you simply specify the secondary domain when creating each user. This satisfies the need for alice@subsidiary.com under the same subscription without altering the primary domain or using aliases.

Answer

Create a new Google Workspace account for subsidiary.com and link it to the existing account.

Answer

Convert subsidiary.com into the account's primary domain.

Answer

Add subsidiary.com as a domain alias to example.com.

Question 12

You are the Google Workspace administrator for a company with 5,000 users. The HR department needs to update the 'Department' and 'Manager' fields for all users. They will provide a CSV file. You want to minimize manual effort and ensure the updates are applied correctly. Which method should you use?

Accepted Answer

Use the Google Workspace Admin console's bulk upload feature with a CSV file.. The Admin console provides a bulk upload feature that accepts CSV files to update user profiles in bulk. This is the most efficient method for applying a large set of updates from HR. It directly targets standard fields like Department and Manager, avoiding the need for scripting or manual edits. Other methods either do not scale or target the wrong data fields.

Answer

Use Google Cloud Directory Sync (GCDS) to synchronize the HR database with Google Workspace.

Answer

Use the Directory API to update each user's custom attributes via a script.

Answer

Use the Google Admin console to edit each user's profile individually.

Question 13

You are the Workspace administrator at a company where every employee's mailbox must be preserved for seven years after they leave. A user in the Sales organizational unit resigns, and you need to immediately block sign-in and stop new mail from being delivered to that mailbox while keeping all existing mail intact. What should you do?

Accepted Answer

Suspend the user account in the Admin console.. Suspending the account is the standard way to cut off access and inbound mail while keeping all data recoverable. Deletion destroys the mailbox, Vault rules only archive data, and password or 2SV changes do not revoke access. Suspension preserves the mailbox for later migration or Vault export while satisfying the immediate security need.

Answer

Delete the user account and then restore it from the Admin console within 20 days.

Answer

Reset the user's password and enable 2-Step Verification enforcement for the Sales OU.

Answer

Move the user into a dedicated organizational unit and apply a Google Vault retention rule to that OU.

Question 14

A new employee joins the company, and the administrator wants the user's mailbox to be created in the Sales organizational unit with a Google Workspace license applied automatically. Which action accomplishes this?

Accepted Answer

Create the user account and place it in the Sales organizational unit, then assign a license. The correct workflow is to create the user, set the organizational unit to Sales during creation, and assign a Google Workspace license. The organizational unit determines which policies apply, and the license activates services such as Gmail, which provisions the mailbox. Adding to a group or enabling Gmail globally does not meet either requirement.

Answer

Create the user account and add it to a Google Group named Sales

Answer

Create the user account and assign a Google Workspace license, then move the account later

Answer

Create the user account in the root organizational unit and enable Gmail for everyone

Question 15

Your organisation has a primary domain, example.com, and a secondary domain, example.net. The marketing team wants all new hires to receive an address at example.net while existing staff keep their example.com addresses. You have already verified example.net and created the necessary users. What must you do so that mail sent to the new users' example.net addresses is delivered?

Accepted Answer

Add the MX records for example.net in your DNS provider, pointing to Google's mail servers.. Inbound mail routing depends on MX records, not on verification or aliasing. Because example.net is a verified secondary domain, the administrator must publish Google's MX records for that domain in DNS. Verification only establishes ownership, aliasing only adds a receive-only address, and changing the primary domain would rename every existing account.

Answer

Publish a TXT record containing the Google site-verification token for example.net.

Answer

Create an alias domain for example.net and assign it to the marketing organisational unit.

Answer

Set example.net as the primary domain so that new users inherit the correct address.