GWS-ADMIN User Accounts Domains And Directory Practice Test 5 — 15 Questions

Question 1

As a Google Workspace administrator, you need to ensure that all users in your organization are required to use two-step verification. Which setting in the Admin console controls this enforcement?

Accepted Answer

Security > Authentication > Two-step verification. Two-step verification enforcement is configured under Security > Authentication in the Admin console. Administrators can enforce it for the entire organization or specific organizational units, ensuring users must set up and use 2-Step Verification when signing in.

Answer

Devices > Mobile & endpoints > Settings

Answer

Directory > Users > Security

Answer

Apps > Google Workspace > Security

Question 2

A Google Workspace administrator at a company with a single primary domain wants to make a newly created OU named 'Contractors' immediately available as a target for dynamic group membership rules and shared drive access policies. A colleague suggests that the OU must be populated with at least one user before it can be referenced by policy. Which statement describes what actually happens after the OU is created in the Admin console?

Accepted Answer

The OU is created instantly and can be referenced by policies and dynamic group queries even while it is empty.. Organizational units are persistent directory objects created the moment they are saved. Their path can be targeted by dynamic group membership queries, device policies, and access policies without any member present, and users moved in later inherit those settings automatically. No pending state, sync delay, or matching group is required for the OU to function as a policy target.

Answer

The OU can only be referenced by policies after a group with the same name has been created.

Answer

The OU is created, but it appears only in the Admin console after the next directory synchronization completes.

Answer

The OU remains in a pending state until a user is assigned to it, and policies applied to it do not take effect until then.

Question 3

A new employee joins the company and needs a Google Workspace account. The administrator wants to create the account manually, assign a license, and ensure the user is placed in the correct Organizational Unit (OU) from the start. Which sequence of steps should the administrator follow?

Accepted Answer

In the Admin console, go to Directory > Users, click Add new user, enter the user's details, select the appropriate OU, assign a license, and save.. The Admin console's Add new user workflow is the correct manual method. It allows the administrator to enter user details, choose the OU, and assign a license in one process, ensuring the account is correctly configured from the start. This meets the requirement for a manual creation with proper placement and licensing.

Answer

Use the Directory API to create the user, then manually move the user to the desired OU and assign a license in a separate step.

Answer

Create the user in Google Cloud Directory Sync (GCDS) and let the next sync cycle place the user in the correct OU and assign a license.

Answer

Import users from a CSV file using the bulk upload feature, specifying the OU and license in the CSV, then verify the user was created.

Question 4

A Google Workspace administrator is preparing to add a new secondary domain and needs to ensure that users in that domain can sign in and receive mail. Which two actions must the administrator perform after adding the domain in the Admin console? (Choose two.)

Accepted Answer

Verify domain ownership by adding a TXT record to the domain's DNS settings. After adding a secondary domain, the administrator must verify ownership via a TXT record and configure MX records so email is routed to Google. Verification proves control of the domain, and MX records enable mail delivery. Changing the primary domain and adding a domain alias are different features, while SPF and DKIM are optional deliverability enhancements.

Answer

Add the domain to the Google Workspace Directory as a domain alias

Answer

Configure SPF and DKIM records for the new domain to improve deliverability

Answer

Set the new domain as the primary domain for the account

Question 5

A user in your Google Workspace domain has left the company. You need to immediately suspend their account to prevent access, but you may need to restore it later if they return. What should you do?

Accepted Answer

Suspend the user account.. Suspending the account is the correct immediate action to block access while retaining the ability to restore it later. Suspension preserves all data and can be reversed at any time. Deletion starts a recovery window, but suspension is safer when restoration is likely. Other options do not effectively prevent access or are not designed for offboarding.

Answer

Change the user's password and not share it.

Answer

Delete the user account.

Answer

Move the user to a different Organizational Unit.

Question 6

A company has a Google Workspace account with multiple domains. The administrator needs to ensure that when users sign in with their email address, they are redirected to the correct domain's login page. The company uses SAML SSO with a third-party IdP. Which setting should the administrator configure?

Accepted Answer

Configure the third-party IdP to use the 'domain_hint' parameter or implement a discovery service.. When using SAML SSO with multiple domains, the IdP must be configured to route users to the correct login page based on their email domain. This is typically done using the 'domain_hint' parameter or a discovery service. Google Workspace's SSO settings are account-level and do not provide per-domain redirection; the IdP is responsible for this behavior.

Answer

In the Google Admin console, set the primary domain for SSO and add secondary domains as aliases.

Answer

Enable the 'Domain Discovery' feature in the Admin console under Security > SSO.

Answer

Set up a secondary domain and configure SSO for each domain separately.

Question 7

You are the Workspace administrator for a company that has just acquired a smaller business. The acquired business currently uses its own Google Workspace account with the domain 'acme-parts.com'. Your leadership team wants users from 'acme-parts.com' to appear in the same Global Directory as your primary domain 'yourcompany.com' and to share Google Workspace services, but they must keep sending and receiving email using '@acme-parts.com' addresses. You have already added and verified 'acme-parts.com' as a secondary domain in your Admin console. What should you do next to meet these requirements?

Accepted Answer

Create user accounts with @acme-parts.com addresses in the yourcompany.com account, and stop paying for the acquired business's old Workspace subscription.. Once a secondary domain is verified, users can be created directly on that domain inside the same Workspace account, giving them distinct @acme-parts.com identities that share the directory and services. A domain alias cannot provide separate mailboxes or sign-in identities, and keeping a separate tenant or swapping the primary domain fails the goal of a unified directory with preserved email addresses.

Answer

Leave the acquired business on its own separate Google Workspace account and configure mail routing between the two tenants.

Answer

Convert 'acme-parts.com' into the primary domain of your account and move 'yourcompany.com' to a secondary domain.

Answer

Configure 'acme-parts.com' as a domain alias of 'yourcompany.com' so that every existing user can receive mail sent to the alias and send as the alias address.

Question 8

A Google Workspace administrator needs to give a user the ability to reset passwords for other users in the Support organizational unit only, without granting broader privileges. Which role should be assigned?

Accepted Answer

Custom role with the Users > Reset Password privilege scoped to the Support organizational unit. The requirement is least privilege for password resets limited to one organizational unit. A custom role with the Users > Reset Password privilege scoped to the Support organizational unit achieves exactly that. Predefined roles such as Super Admin, User Management Admin, and Help Desk Admin grant broader, account-wide permissions that exceed the stated need.

Answer

User Management Admin

Answer

Help Desk Admin

Answer

Super Admin

Question 9

A school district's Workspace administrator needs every staff member's directory listing to display a job title and department that are visible to all users in the domain, including on the Contacts card in Gmail. The data already exists in the district's HR system. Which action accomplishes this with the least manual effort?

Accepted Answer

Populate the built-in Job title and Department fields using bulk upload or the Directory API, since those fields are directory-visible by default.. Job title and Department are built-in directory fields with domain-wide visibility by default, and they render on the Contacts card. Because the data already exists in HR, a bulk CSV upload or Directory API update loads all staff records efficiently. Custom attributes, groups, and OU naming do not populate these standard visible fields.

Answer

Add the values as custom attributes on each user and instruct staff to share them manually.

Answer

Create a Google Group named after each department and add staff as members so the group name appears on their profile.

Answer

Set the organizational unit name to the department and the user's description field to the job title.

Question 10

A multinational company has a primary domain, example.com, and a secondary domain, example.net, in the same Google Workspace account. The administrator wants users signing in with the example.net alias to appear in the Global Directory under example.net rather than under example.com. What must the administrator configure to achieve this?

Accepted Answer

Keep example.net as a secondary domain and set each user's primary email address to the example.net domain.. A user's primary email address determines which domain they are listed under in the Global Directory. With example.net configured as a secondary domain in the same account, assigning that domain as the primary address for selected users produces listings under example.net while example.com remains the account's primary domain.

Answer

Add example.net as an alias domain of example.com and set each user's primary email in the example.net domain.

Answer

Create a separate Google Workspace account for example.net and enable directory sharing between the two accounts.

Answer

Make example.net the primary domain and demote example.com to a secondary domain.

Question 11

Your company uses Google Cloud Directory Sync to provision users from an on-premises Active Directory. A user who left the company was removed from Active Directory last week, but the account still appears as active in the Google Admin console after multiple sync runs. What is the most likely cause?

Accepted Answer

The GCDS configuration has the option to suspend or delete accounts disabled, so removed users are simply skipped.. GCDS only suspends or deletes Google accounts for users that disappear from the source directory when those actions are explicitly enabled in the configuration. With that option disabled, removed source users are ignored and their Google accounts stay active indefinitely, which is exactly the symptom described.

Answer

The user was moved to a different organisational unit in Active Directory, so GCDS treats the account as newly created rather than deleted.

Answer

The user's account is protected by a Vault retention hold that prevents directory modifications.

Answer

The sync rule excludes the user because their primary email address does not match the domain in the Google Workspace account.

Question 12

An organization uses Google Cloud Directory Sync (GCDS) to keep its Workspace directory aligned with an on-premises LDAP directory. The administrator must ensure that local directory attributes map correctly and that deletes in the source system do not accidentally wipe out Workspace accounts and their data, while still allowing legitimate departures to be processed. Which two configuration practices should the administrator apply? (Choose two.)

Accepted Answer

Enable the option to suspend rather than delete users removed from the source directory.. Exclusion rules keep designated accounts out of the sync scope so they are never modified or deleted, and the suspend-instead-of-delete option preserves data when a source account disappears. Together these practices prevent accidental data loss while still allowing legitimate departures to be reflected as suspended accounts.

Answer

Map every LDAP attribute to a corresponding Workspace field to avoid missing data.

Answer

Grant the sync service account the Super Admin role to avoid permission errors during synchronization.

Answer

Configure the sync to run continuously in real time so attribute changes propagate instantly.

Question 13

Your organisation has multiple departments and you want to delegate password reset duties to a small group of team leads without giving them full administrator privileges. Each team lead should only be able to reset passwords for users in their own department's organizational unit. What is the most appropriate approach?

Accepted Answer

Create a custom role with the Users > Reset password privilege and assign it to each team lead with an organisational unit scope of their department.. Custom roles with a narrowly defined privilege set, assigned at the department organisational unit, deliver exactly the password-reset capability needed without granting unrelated administrative rights. Prebuilt roles like Help Desk Administrator are too broad, super administrator is excessive, and Groups Administrator governs groups rather than user credentials.

Answer

Add each team lead to a Google Group and grant that group the Groups Administrator role.

Answer

Assign the prebuilt Help Desk Administrator role to each team lead.

Answer

Make each team lead a super administrator and instruct them to only reset passwords for their own department.

Question 14

A Google Workspace administrator needs to enforce a policy that requires all users to have a recovery email address set. The administrator wants to monitor compliance and generate a report of users missing a recovery email. What is the most efficient way to achieve this?

Accepted Answer

Use the Admin SDK Directory API to retrieve all users and filter those without a recovery email.. The Admin SDK Directory API is the appropriate tool to retrieve user data, including recovery email, and can be used to programmatically identify users missing this field. This allows for efficient monitoring and reporting, unlike manual checks or using unrelated APIs. The Reports API does not cover profile fields, and Google Groups alerts are not designed for this purpose.

Answer

Set up a Google Groups email alert to notify when a user without a recovery email logs in.

Answer

Use the Admin console to manually check each user's profile for a recovery email.

Answer

Use the Google Workspace Reports API to generate a report on user recovery email status.

Question 15

Your company uses Google Workspace and has a Google Cloud Directory Sync (GCDS) deployment to synchronize users from an on-premises Active Directory. A new HR policy requires that when an employee is terminated, their account must be suspended immediately and not deleted, but their mailbox data must be preserved for eDiscovery. You need to configure GCDS so that terminated employees are suspended rather than deleted. What should you do?

Accepted Answer

In GCDS, under User Accounts, set the 'Suspend' option for users who are no longer in the LDAP search rule, and ensure the 'Delete' option is not selected.. GCDS provides explicit options for handling users removed from the LDAP source: you can choose to suspend or delete them. To meet the policy, configure GCDS to suspend removed users and ensure deletion is not enabled. This preserves mailbox data and allows for eDiscovery while immediately disabling access.

Answer

In the Admin console, set the 'Suspension policy' for the domain to automatically suspend users after 30 days of inactivity, and let GCDS delete them.

Answer

In GCDS, configure the 'User Accounts' rule to move terminated users to a 'Suspended' organizational unit, and then apply a Google Vault retention rule to that OU.

Answer

In GCDS, enable 'Deletion prevention' and set a retention period of 30 days, after which users are automatically suspended.