208 questions total · 3pages · All types, answers revealed
You need to verify if an email was sent to an external address. Where can you see this in the Admin Console?
This tool shows the journey and delivery status of emails.
Why this answer
The Email Log Search tool in the Admin Console allows administrators to trace email delivery and identify recipients.
A user is seeing an 'Unable to verify account' error when signing in. What is the first thing to check?
Suspended accounts will report as unable to be verified.
Why this answer
Checking if the account is suspended in the Admin console is the most common reason for this error.
An administrator wants to ensure that users cannot use weak or commonly breached passwords. Where can password monitoring be enabled in the Google Admin console?
Password monitoring settings are located under Security > Password management.
Why this answer
Password monitoring for breached credentials is enabled under Security > Password management.
You are troubleshooting an issue where a user is unable to authenticate via SAML SSO. You need to inspect the raw SAML request and response messages sent between the IdP and Google Workspace. What is the most effective way to capture this?
SAML protocol traffic is passed via browser HTTP POST bindings, making browser developer tools or tracer extensions ideal for viewing the raw XML assertions.
Why this answer
Browser developer tools with SAML tracer extensions or network log analysis capture the Base64 encoded SAMLAssertion payloads.
An organization is using Google Workspace Sync for Microsoft Outlook (GWSMO). A user is experiencing sync delays. What tool should you use to check the GWSMO status?
This tool shows the synchronization progress and any errors between Outlook and Google.
Why this answer
The GWSMO 'Set up a Google Workspace Sync user' tool or local log files are used to monitor and debug sync status.
Which THREE of the following are components of the Directory API 'group' resource?
The name is a required field.
Why this answer
The group resource includes the group email, name, and description as standard fields.
You want to automate user account creation based on a specific event. What is the recommended approach?
Service accounts provide secure, automated access to the API.
Why this answer
Google Apps Script or the Directory API via a webhook/event-driven architecture is the standard method.
Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?
Enabling the sign-in with Google password option for admins or assigning them to a separate OU without SSO enforcement ensures emergency access.
Why this answer
Google Workspace allows you to configure a secondary SSO profile or enable network/admin bypass settings to allow admin sign-in via Google credentials.
Which THREE features are part of the Security Center?
Shows best practices and configuration recommendations.
Why this answer
The Security Center provides tools for proactive security, incident investigation, and reporting on security metrics.
You are setting up Context-Aware Access. You want to deny access to Google Workspace if the device is not encrypted. Which tool identifies the 'is_encrypted' attribute?
The extension collects the attribute and sends it to the server.
Why this answer
Endpoint Verification reports device attributes like encryption status back to Google, which Context-Aware Access then uses to evaluate policies.
A department requires a custom building resource to be added to Google Calendar. Where do you add this?
This is the correct path to manage room and resource objects.
Why this answer
Building resources are managed under Directory > Buildings and resources.
Which THREE security settings can be enforced for Gmail in the Admin Console?
Enforced by default, but configurable.
Why this answer
Gmail security supports S/MIME, attachment scanning, and link protection.
Which THREE of the following are benefits of using Organizational Units (OUs)?
Service customization is a core use of OUs.
Why this answer
OUs allow you to group users to apply different service settings, security policies, and mobile management settings.
Where can you enable the automatic creation of Google Meet links for calendar events?
This is where you toggle the setting to automatically create Meet links for Calendar events.
Why this answer
This is enabled in the Google Meet service settings.
You need to create a custom administrator role that allows specific users to manage Google Meet hardware devices and review their health status, but nothing else. Which privilege category should you select when building this custom role?
Google Meet hardware management privileges are located under the Services category.
Why this answer
Privileges for managing Meet hardware and devices are found under the Services and Devices privilege trees.
An SPF record specifies which hosts are authorized to send email on behalf of your domain.
Why this answer
The SPF record must include the IP addresses or include mechanism for the third-party gateway to prevent spoofing flags.
An administrator wants to configure security policies to protect corporate data on mobile devices. Which THREE actions can be enforced through Google Workspace Endpoint Management? (Choose three.)
Advanced endpoint management supports Android work profiles to separate personal and corporate data.
Why this answer
Google Endpoint Management allows administrators to enforce device policies such as requiring a screen lock, wiping corporate data remotely, and enforcing password requirements on devices.
You need to deploy a specific Android application to a subset of users. What is the correct procedure?
This is the standard, supported workflow for app deployment.
Why this answer
You must add the app via the Managed Google Play store and then assign it to the specific Organizational Unit (OU) or group.
A new IT support staff member needs to manage user passwords but should not be able to delete users or modify billing settings. Which role should you assign?
This role is designed for managing user accounts, including password resets, without billing or delete permissions.
Why this answer
The 'User Management Admin' role allows for password resets and basic user info updates without full super admin privileges.
An employee has left the company. You need to migrate their email and calendar data to their manager's account. Which tool should you use?
This tool is designed for migrating email, contacts, and calendar data.
Why this answer
The Data Migration Service is the primary tool for migrating user data between Google Workspace accounts.
You need to bulk upload 500 users using a CSV file. What is the required format for the CSV header row?
These are the mandatory fields for bulk user creation.
Why this answer
The Google Admin console bulk upload tool requires specific headers like First Name, Last Name, and Email Address to process the file.
Which THREE of the following settings are inherited by child OUs from the parent OU?
Mobile settings are inherited.
Why this answer
Inheritance applies to most Google Workspace settings, including service status, mobile management, and security policies.
Which TWO of the following actions can an administrator perform using the Google Workspace Data Migration Service?
DMS supports this migration path.
Why this answer
DMS supports IMAP-based mail and calendar migration.
You want to ensure that all users have a strong password policy. Where can you enforce password length and complexity requirements?
This is the correct path for setting password complexity and expiration policies.
Why this answer
Password policies are managed in the Security section under Password management.
You have a Data Region policy configured for the US. A user moves from the US to the EU. How do you trigger the migration of their existing data to the EU?
Moving the user to an OU associated with the EU data region triggers the automated migration process.
Why this answer
Google Workspace automatically migrates data to the new region once the user's organizational unit (OU) is updated to a region mapped to the new location.
An auditor requests that you restrict administrative access to the Google Workspace Admin console to a specific set of IP addresses. What is the most effective way to implement this?
This setting directly restricts access to the Admin console to specific allowed IP addresses.
Why this answer
The 'Admin console sign-in restriction' setting allows administrators to limit console access to trusted networks.
A mobile device is not syncing corporate email. Which THREE of the following should you investigate?
An expired or reset password will break mobile sync until updated.
Why this answer
Device compliance, sync settings, and the user's password/auth status are all critical for mobile sync.
A user reports that they are not receiving emails from an external vendor. As an administrator, where should you first look to verify if the messages reached Google's servers?
Email Log Search is the primary tool for investigating mail flow issues.
Why this answer
The Email Log Search tool allows administrators to track email delivery status, including whether messages were received, rejected, or routed to spam.
You need to export a list of all users and their license status. What is the best method?
The 'Download users' button generates a CSV with license info.
Why this answer
The User report in the Admin console allows exporting user data to Google Sheets.
A user is experiencing 'Storage full' errors. What is the best way to determine which files are using the most space?
This page provides a direct link to view and manage storage for the user.
Why this answer
The Drive storage management tool provides a clear breakdown of file usage by size for each user.
A user reports that their mobile device is no longer syncing corporate data. What is the most likely cause?
When devices fall out of compliance, the server blocks synchronization.
Why this answer
If a security policy change has occurred or the device has become non-compliant, sync will be automatically blocked by Google Workspace.
Which report would you use to identify users who haven't logged in for more than 30 days?
This report displays the last login time for all users.
Why this answer
The 'User accounts' report, found under Reports, provides the last login timestamp for each user.
Which Google Workspace service should you use to search and export user data for legal requests?
Vault is built for eDiscovery, search, and export.
Why this answer
Vault is the primary tool for eDiscovery and legal data requests in Google Workspace.
What is required for a user to be able to manage their own mobile device in the Google Admin console?
This administrative role grants the necessary permissions to manage devices.
Why this answer
Users do not manage their devices in the Admin console; that is for administrators only.
Which TWO of the following are valid criteria for a Context-Aware Access level? (Choose two)
Device attributes like encryption status are valid criteria.
Why this answer
Context-Aware Access levels can be built using IP subnets and device attributes like encryption status or OS versions.
You need to prevent users from sharing sensitive files outside the organization. Which setting should you modify?
You can restrict external sharing at the organizational unit level.
Why this answer
Drive sharing settings allow administrators to restrict sharing to internal users or specific whitelisted domains.
A user in the 'Sales' OU is not receiving policy updates applied to that OU. What is the most likely cause?
If inheritance is disabled, the OU stops receiving policies from its parent.
Why this answer
Inheritance is the default behavior; if it is broken, child OUs do not receive parent policies.
You need to create a report showing which users have been affected by a specific DLP policy violation in the last month. Where can you find this?
You can filter logs by DLP rule name or event type.
Why this answer
The Security Center investigation tool allows for queries specifically filtered by DLP rule violations.
Which TWO actions should be taken when offboarding a user to protect organizational data?
Prevents further access.
Why this answer
Suspending access and ensuring data is preserved or transferred are critical offboarding steps.
You need to grant a user permission to manage only the 'Marketing' OU. Which administrative role do you assign?
You can create a role and scope it to a specific OU.
Why this answer
Custom Admin roles allow granular control over OU access.
A user is complaining that they cannot send emails to a specific external domain. Where do you check for blocklists or routing issues?
This is the correct location for managing email routing and compliance rules.
Why this answer
Gmail routing, including blocklists and custom routing rules, is managed under Apps > Google Workspace > Gmail > Routing.
A user reports that their Android work profile is no longer syncing corporate emails. As an administrator, which action should you perform first in the Google Admin console to investigate?
Viewing device details allows you to see sync status, last sync time, and compliance alerts.
Why this answer
Checking the device status in the Admin console provides immediate insight into sync errors or compliance issues.
Which THREE actions should you take to secure your Google Workspace environment against unauthorized admin access? (Choose three)
Limiting admin access by network location is a best practice.
Why this answer
Securing admin accounts involves multi-factor authentication, monitoring, and limiting the scope of privileges.
You need to ensure that Google Chat messages are retained for 5 years. How do you do this?
Vault provides explicit support for Chat retention.
Why this answer
Vault supports retention rules for Google Chat, which can be configured for a specific time period.
You need to create a custom administrator role that allows a security analyst to use the Security Center Investigation Tool, view audit logs, and manage alerts, but prevents them from modifying user passwords or organizational unit structures. Which exact set of privileges should you assign?
Selecting only specific monitoring and investigation privileges grants the desired visibility without granting destructive user management or structural modification rights.
Why this answer
Building a custom role requires selecting precise privileges from the Security Center and Reporting privilege categories.
A user deleted a document from their Google Drive three days ago. As an administrator, what is the maximum time you can restore this file?
The restoration window for admins is 25 days.
Why this answer
Administrators can restore files deleted by users from the Admin Console for up to 25 days after the file has been emptied from the Trash.
Which TWO of the following are prerequisites for setting up iOS device management?
The certificate is mandatory for communicating with Apple's servers.
Why this answer
An Apple Push Certificate and Advanced Mobile Management are required to manage iOS devices effectively.
An administrator is reviewing API controls and third-party app access in Google Workspace. Which THREE access states can be configured for third-party OAuth applications? (Choose three.)
Trusted apps have unrestricted access to requested scopes.
Why this answer
Third-party OAuth applications can be configured as Trusted, Limited, or Blocked.
A user is receiving 'Account temporarily unavailable' messages. What is the primary thing to check?
The status will indicate if the account is suspended or under restriction.
Why this answer
This error often occurs when an account has exceeded bandwidth limits or is undergoing a security review.
An administrator needs to review recent security alerts and proactive recommendations for improving domain security. Where should they look first in the Google Admin console?
The Security Center dashboard provides an overview of security health, alerts, and actionable recommendations.
Why this answer
The Security Center provides a centralized dashboard for security analytics, alerts, and recommendations.
Which TWO of the following are common reasons for a user sync failure in GCDS?
If the query fails to find users, no sync happens.
Why this answer
Common sync issues include misconfigured LDAP queries and invalid OU mappings in the GCDS configuration.
What happens when you delete an Organizational Unit?
Google prevents deletion of non-empty OUs.
Why this answer
Deleting an OU requires moving all users and sub-OUs out of it first.
You need to prevent users from installing third-party Marketplace apps that request Drive read/write access. How do you configure this?
This area allows you to control which OAuth scopes are granted to third-party apps.
Why this answer
This is managed in Security > Access and data control > API controls > Manage Google Services.
You have configured a new transport rule, but it is not triggering as expected. What is the first troubleshooting step?
Logs show the results of rule processing for specific messages.
Why this answer
Checking the Gmail Audit logs for the specific message can confirm if the rule was applied or why it was skipped.
You want to ensure that only company-managed ChromeOS devices can access your Google Workspace environment. Which setting should you modify?
Access levels allow you to filter by 'Managed device' status.
Why this answer
Context-Aware Access allows you to restrict access based on whether the device is managed by the organization.
Which THREE criteria can you use to build a DLP rule in Google Workspace?
Useful for finding organization-specific sensitive patterns.
Why this answer
DLP rules can be based on predefined content detectors, custom regex, and document metadata like labels.
A user reports that emails are not being sent to an external mailing list. The logs show '550 5.1.1'. What does this code indicate?
5.1.1 specifically means the mailbox is unavailable or does not exist.
Why this answer
A 550 5.1.1 error code indicates that the recipient address does not exist or is invalid.
An administrator mistakenly deleted a user account 10 days ago. How can you restore this account?
The Restore User tool allows restoration within the 20-day window.
Why this answer
Deleted users can be restored within 20 days via the Admin console.
You need to prevent users from adding personal Google accounts to their company-managed devices. How do you restrict this?
This allows you to restrict the addition of accounts on managed mobile devices.
Why this answer
This is managed via Device Management settings, specifically under Devices > Mobile and endpoints > Settings > iOS/Android.
Your organization requires that users can only access Google Drive when connected to the corporate VPN. How can you achieve this using Context-Aware Access?
Creating an access level based on IP ranges and assigning it to the Drive service restricts access accordingly.
Why this answer
Context-Aware Access levels are created in Security > Access and data control > Context-Aware access, then assigned to apps.
A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?
The audit log records all device commands and their statuses.
Why this answer
The device audit log provides the necessary visibility into whether a command was successfully executed by the server and acknowledged by the device.
When managing ChromeOS devices, which TWO settings can be configured within the 'Device settings' section of the Admin console?
This is a critical device-level setting.
Why this answer
Device settings allow for controlling device-level behaviors like Auto-update and sign-in restrictions.
Your organization uses a third-party Identity Provider (IdP) for SSO. Users are reporting that they cannot sign in. Where do you verify the SAML configuration?
This is the correct location for configuring and troubleshooting third-party SAML SSO.
Why this answer
SAML configuration for third-party providers is managed in Security > Authentication > SSO with third-party IdP.
An administrator has configured a new SAML SSO integration with a third-party IdP. Users are complaining that they can log in successfully, but after 30 minutes, they are unexpectedly forced to re-authenticate. Where can the administrator adjust the session duration for SAML apps?
Google Workspace allows you to configure session duration specifically within the SAML app configuration or enterprise app settings.
Why this answer
SAML session length settings for third-party applications are configured within the specific SAML app settings in the Google Admin console.
You need to investigate a potential data breach where a user downloaded a large number of sensitive files. Which tool provides the most granular audit logs for Drive file downloads?
This tool provides detailed event logs including 'download' actions.
Why this answer
The Investigation tool within the Security Center provides the most granular logs for file-level activities, including downloads.
A user complains that they cannot access their work email. You see the device is marked as 'Blocked' in the Admin console. What should you do?
Approving the device restores access to corporate services.
Why this answer
If a device is blocked, changing the status to 'Approved' or 'Unblocked' will restore access.
You need to ensure that Google Meet sessions created by your users always require a password/PIN for external participants. How do you enforce this?
Google Meet does not support meeting PINs for external users.
Why this answer
Google Meet does not use PINs for external participants; it uses host management and entry controls.
You notice that a user's account is generating a large amount of spam. What is the immediate action you should take?
This terminates the attacker's access immediately.
Why this answer
Resetting the user's password and forcing a logout of all sessions is the fastest way to stop an account that has been compromised.
Which THREE actions can be performed using the Google Admin console's bulk user management tool?
Bulk suspension is supported.
Why this answer
The bulk upload tool allows creating new users, updating existing user information, and suspending/unsuspending multiple users via CSV.
When an email is reported as missing, which THREE logs or tools can help you track the issue?
This tool can search across logs for specific message IDs or senders.
Why this answer
Email Log Search, Gmail Audit logs, and the Security Investigation tool are the core diagnostic tools for mail flow.
An employee is suspected of leaking data. You need to search their past Gmail and Drive files for specific terms. Which tool do you use?
Vault search is designed to find specific content within user data.
Why this answer
Vault allows for full-text search across Gmail, Drive, and other services to support eDiscovery investigations.
You need to limit the number of participants in a Google Meet session to 10 for a specific organizational unit. How do you achieve this?
Participant limits are determined by the Google Workspace edition, not by custom admin settings.
Why this answer
Google Meet does not support limiting the number of participants via the Admin Console.
Your company has an external contractor who needs temporary access to Google Workspace. You want to ensure their account automatically deactivates after 30 days without manual administrative intervention. How can you achieve this securely?
Cloud Identity features and the Admin SDK allow automated scheduling or provisioning lifecycle management for temporary accounts.
Why this answer
Google Workspace accounts do not have a native 'account expiration date' field by default, but you can manage this via Directory Sync or automated scripts using Admin SDK, or by setting calendar alerts. However, the standard administrative feature for automated lifecycle management is Directory Sync or Cloud Identity lifecycle features. Wait, looking at standard admin tools: Google Workspace allows setting user account expiration using the Admin SDK or automated lifecycle rules in cloud identity, or using Context-Aware Access temporary rules.
Let's look at the options.
You need to add a custom attribute to user profiles. Where is this configured?
This is the path to define custom user schema fields.
Why this answer
Custom attributes are managed under Directory > Users > More > Manage custom attributes.
An administrator needs to grant a helpdesk employee the ability to reset user passwords and view user information without granting them full super administrator privileges. Which built-in admin role should be assigned?
The User Management Admin role allows resetting passwords, suspending users, and editing user profiles.
Why this answer
The User Management Admin role grants permissions to reset passwords, manage user profiles, and view organizational units.
Practice GWS-ADMIN by domain
Target a specific domain to shore up weak areas.