260 questions total · 4 pages · All types, answers revealed
Page 1 of 4
Page 2What is the maximum number of custom aliases a user can have?
A user can hold up to 30 custom aliases in Microsoft Entra ID, satisfying the stem's maximum-count constraint. This limit applies to additional email addresses beyond the primary address, and each alias must be unique across the tenant's verified domains.
Why this answer
Google allows up to 30 aliases per user.
Which TWO mechanisms can an administrator use to recover access if a Super Administrator loses their 2-Step Verification device and is locked out? (Choose two.)
Another Super Administrator can clear the locked admin's 2-Step Verification enrolment from the Google Admin console, forcing re-enrolment at next sign-in. This satisfies the stem's constraint: recovery without the lost device, using a peer Super Administrator's existing privileged access rather than self-service or backup codes.
Why this answer
Option A is correct because a peer Super Administrator can open the Google Admin console, go to the user's Security settings, and reset the locked admin's 2-Step Verification enrollment, forcing re-enrollment at next sign-in. Option E is correct because Google generates one-time backup verification codes (10 codes) that can be used in place of a 2SV prompt when the primary device is unavailable, provided they were saved in advance. Option B is wrong because Google Workspace support cannot instantly disable 2SV without proper verification and typically requires the customer to have another Super Admin perform the reset.
Option C is wrong because an external SAML IdP handles federated authentication, not Google's native 2SV, and cannot bypass it for a non-federated account. Option D is wrong because 'root domain controller administrative credentials' is an on-premises Active Directory concept and has no bearing on Google Workspace Super Admin authentication.
Exam trap
The trap is assuming Google support can bypass 2SV instantly or that SAML/AD credentials can override Google's 2SV, when in reality only admin reset or backup codes work.
A Google Workspace administrator is troubleshooting a Google Meet issue for a user. The user reports that when they try to join a meeting from a Chrome browser, they see a 'You cannot join this call' error, but other participants can join successfully. The user can join the same meeting from the Google Meet mobile app without issues. The administrator checks the user's OU and confirms that Google Meet is enabled and that the user has a valid license. Which is the MOST likely cause of the browser-specific error?
If the user is signed into Chrome with a personal Google Account while trying to join a meeting that requires their Workspace account, Meet may block access because the meeting is restricted to the organization. The mobile app likely has the correct Workspace account signed in. This mismatch commonly causes 'You cannot join this call' errors in browsers. The administrator should verify which account is active in Chrome and ensure the user signs in with their Workspace account.
Why this answer
The browser-specific error suggests an account mismatch. If Chrome is signed in with a different Google Account than the one used for Google Workspace, Meet may block access because the meeting is restricted to the organization. The mobile app likely has the correct Workspace account signed in, allowing the user to join.
The administrator should instruct the user to sign out of Chrome or switch to the correct Workspace account.
Exam trap
The trap here is focusing on browser or extension issues while overlooking that the user might be signed into Chrome with a personal account, which is a common cause of Meet join failures.
A school district's Workspace administrator needs every staff member's directory listing to display a job title and department that are visible to all users in the domain, including on the Contacts card in Gmail. The data already exists in the district's HR system. Which action accomplishes this with the least manual effort?
Job title and Department are built-in user profile fields that are visible to the entire domain by default and appear on the Contacts card. Bulk CSV upload or the Directory API users.update method can load the HR data for all staff at once, satisfying the requirement with minimal manual effort and consistent visibility.
Why this answer
Job title and Department are built-in directory fields with domain-wide visibility by default, and they render on the Contacts card. Because the data already exists in HR, a bulk CSV upload or Directory API update loads all staff records efficiently. Custom attributes, groups, and OU naming do not populate these standard visible fields.
Exam trap
The trap here is reaching for custom attributes or groups when built-in, domain-visible profile fields already satisfy the requirement.
You are the Workspace administrator for a company that has just acquired a smaller business. The acquired business currently uses its own Google Workspace account with the domain 'acme-parts.com'. Your leadership team wants users from 'acme-parts.com' to appear in the same Global Directory as your primary domain 'yourcompany.com' and to share Google Workspace services, but they must keep sending and receiving email using '@acme-parts.com' addresses. You have already added and verified 'acme-parts.com' as a secondary domain in your Admin console. What should you do next to meet these requirements?
Creating user accounts on the verified secondary domain within your existing Workspace account makes those users part of the same directory and service pool as your primary domain users. They can send and receive mail as @acme-parts.com while sharing directory, Drive, and other services. This is the correct path once the secondary domain is verified and no longer needed as a separate account.
Why this answer
Once a secondary domain is verified, users can be created directly on that domain inside the same Workspace account, giving them distinct @acme-parts.com identities that share the directory and services. A domain alias cannot provide separate mailboxes or sign-in identities, and keeping a separate tenant or swapping the primary domain fails the goal of a unified directory with preserved email addresses.
Exam trap
The trap here is confusing a secondary domain, which hosts its own user accounts, with a domain alias, which only adds an alternate address to existing users.
A user reports that they are unable to access a Google Meet link shared by an external partner. The user can access other Google Meet links from within the organization. Which TWO of the following should the administrator check to resolve this? (Choose two.)
The Admin console has settings that control whether users can join meetings hosted by external organizations or allow external participants to join internal meetings. If these settings are restrictive, the user may be blocked from joining an external partner's meeting. Adjusting these settings can resolve the issue. This is a key check for external access problems.
Why this answer
External Google Meet access can be blocked by Admin console settings that restrict external participants or by the meeting link's own restrictions. Checking the video settings for external participants and verifying the link's validity and authentication requirements are the two most direct steps. Other options like license or device requirements are not relevant because the user can access internal meetings.
Exam trap
The trap here is focusing on the user's internal capabilities or device, when the issue is specifically about external meeting access controlled by Admin console policies or link settings.
Your organization is subject to a regulation that requires all Google Workspace data for users in the European Union to be stored within the EU. You have already set up a data region policy for the EU. However, you discover that some user data is still stored in the United States. What is the most likely reason for this?
Data region policies in Google Workspace apply to data at rest for covered services, but they do not automatically migrate existing data. When you set a data region, only newly created data will be stored in the specified region. Existing data remains in its original location unless you request a migration. This is a common oversight when implementing data regions.
Why this answer
Data region policies in Google Workspace control where data at rest is stored for covered services. However, they do not automatically migrate existing data when enabled. Only new data generated after the policy takes effect is stored in the specified region.
To move existing data, you must initiate a data migration request through Google Support. Therefore, the presence of US-stored data is expected if the policy was recently applied.
Exam trap
The trap here is assuming that setting a data region policy will immediately relocate all existing user data, when in fact it only affects new data unless a migration is requested.
A user in your Google Workspace domain has left the company. You need to immediately suspend their account to prevent access, but you may need to restore it later if they return. What should you do?
Suspending the account immediately blocks sign-in and access to services while preserving all data and settings. You can unsuspend the account at any time if the user returns. This meets the requirement to prevent access immediately and allows easy restoration without a time limit, unlike deletion.
Why this answer
Suspending the account is the correct immediate action to block access while retaining the ability to restore it later. Suspension preserves all data and can be reversed at any time. Deletion starts a recovery window, but suspension is safer when restoration is likely.
Other options do not effectively prevent access or are not designed for offboarding.
Exam trap
The trap here is assuming that deletion is the only way to remove access, but suspension is reversible and immediate, making it ideal for temporary offboarding.
You are the Google Workspace administrator at Northwind Traders. The company has just acquired a small design studio that uses its own domain, studiobright.example. Executive leadership wants the acquired team to keep using their existing email addresses for at least six months while they transition to the corporate domain. You need to add studiobright.example to your Google Workspace account so those users can sign in and receive mail at their current addresses. What should you do first?
Adding studiobright.example as a secondary domain creates a distinct namespace within the same Workspace account, so acquired users can keep their existing addresses while still being managed centrally. Google requires you to prove ownership of the domain by placing a verification record in its DNS before it can be used for Gmail or sign-in.
Why this answer
A secondary domain adds a separate namespace to the same Workspace account, which is exactly what is needed when an acquired company must retain its own addresses while being administered centrally. Domain verification through a DNS TXT record is mandatory before the domain can send or receive mail. A domain alias instead grants extra addresses to existing users and would not create accounts for the acquired staff.
Exam trap
The trap here is confusing a secondary domain, which is a separate namespace for new users, with a domain alias, which simply gives every existing user an additional address on that domain.
How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?
A Google Vault retention rule preserves messages independently of the user's mailbox, so emptying Trash cannot remove them before the three-year period expires. Vault holds data at the archive layer, satisfying the stem's requirement that deletion survive user action.
Why this answer
Google Vault retention rules override user actions — even if a user empties Trash or permanently deletes a message, Vault retains a copy for the configured period. Setting a 3-year retention rule on Gmail messages ensures deleted emails remain discoverable and recoverable for exactly that duration, satisfying legal/regulatory requirements.
Exam trap
GWS-ADMIN often tests the distinction between user-level deletion and admin-level retention — candidates pick Gmail filters or reports because they sound like controls, but only Vault retention rules survive a user emptying Trash.
How to eliminate wrong answers
Option A is wrong because endpoint management controls device access and security policies, not email retention. Option B is wrong because Admin Console reports only show audit/usage data; they do not preserve deleted messages. Option C is wrong because a Gmail filter routes or labels messages at delivery time but cannot prevent permanent deletion or enforce retention after the user empties Trash.
You need to prevent users from sharing Google Drive files with people outside the organization. Which setting should you modify?
Sharing settings under Apps > Google Workspace > Drive and Docs control external sharing at the organisational unit level, letting you restrict files from being shared outside the domain. This directly satisfies the requirement to block external sharing.
Why this answer
In the Google Workspace Admin console, the setting to control external sharing for Google Drive is found under Apps > Google Workspace > Drive and Docs > Sharing settings. This section allows administrators to set policies such as preventing users from sharing files outside the organization. Modifying this setting enforces the restriction at the organizational unit level.
Exam trap
GWS-ADMIN often tests the exact navigation path in the Admin console, and candidates may confuse it with security or directory settings.
How to eliminate wrong answers
Option A is wrong because Directory > Users > Sharing does not exist as a path for sharing settings; user management is under Directory > Users, but sharing settings are not there. Option B is wrong because Account > Organizational units > Restrictions is not the correct path; organizational units are under Directory, and restrictions are not for Drive sharing. Option C is wrong because Security > Access and data control > Drive is not the correct path; while security settings exist, the specific Drive sharing settings are under Apps.
A financial services company needs to enforce that all employees use a hardware security key for 2-Step Verification (2SV) and cannot use less secure methods like SMS or phone calls. Which setting in the Admin console should the administrator configure?
This is the correct configuration because it enforces 2SV for all users and restricts the allowed methods to only security keys. This meets the requirement of using hardware security keys exclusively, preventing the use of SMS or phone calls. The setting is located under Security > Authentication > 2-Step Verification.
Why this answer
The correct answer is to enable 2-Step Verification enforcement and restrict methods to only security keys. This ensures all users must use hardware security keys, aligning with the strict security policy. Other options either allow insecure methods or fail to enforce 2SV, and one incorrectly limits the scope to admins only.
Exam trap
The trap here is assuming that selecting 'Only security key' without enforcement is sufficient, but enforcement must be enabled to require users to set up and use 2SV.
A user reports that their company-owned Android device is not receiving work emails in the Gmail app. You check the Admin console and see that the device is listed as 'Compromised'. What is the most likely cause?
A rooted Android device is considered compromised because root access bypasses security controls. Google Mobile Management detects rooting and marks the device as compromised, which can block access to Workspace data. This is the most likely cause and explains why the device cannot receive work emails.
Why this answer
Google Mobile Management marks a device as compromised when it detects security compromises such as rooting (Android) or jailbreaking (iOS). Rooting gives superuser access, undermining device security. The compromised status typically triggers policy actions, such as blocking access to work data.
Thus, rooting is the most likely cause for the user's issue.
Exam trap
The trap here is assuming that any security policy violation, like sideloading apps or outdated OS, results in 'Compromised' status, when it specifically indicates rooting or jailbreaking.
You are automating user creation via the Directory API. Which scope is required to create users?
The admin.directory.user scope grants full read/write access to user resources in the Directory API, which is precisely what user creation requires. Read-only scopes such as admin.directory.user.readonly cannot create accounts, and the broader admin.directory.user.alias scope only manages aliases, so this scope satisfies the stem's write requirement.
Why this answer
The admin.directory.user scope is required for CRUD operations on user objects.
A Workspace administrator is troubleshooting a report that calendar invitations sent by a user are not appearing on recipients' calendars. The recipients are internal users in the same domain. The administrator confirms that the sender can create events and that recipients receive the invitation emails. Which setting should the administrator check to resolve the issue?
Calendar has a setting that controls whether invitations are automatically added to the calendar. If recipients have this disabled, they receive the email but the event does not appear until they manually respond. Checking the recipients' Calendar settings is the most direct way to explain why invitations are not showing up despite being delivered.
Why this answer
Google Calendar includes a user-level preference that determines whether invitations are automatically added to the calendar. When recipients receive the invitation email but do not see the event, this setting is a common cause. Verifying it on the affected recipients' Calendar settings explains the behavior and provides a straightforward fix, since enabling automatic addition makes future invitations appear without manual action.
Exam trap
The trap here is looking at sender-side sharing or DNS authentication when the symptom is a recipient-side Calendar processing preference.
A Google Workspace administrator is troubleshooting why a user cannot access a Google Drive file shared by another user in the same domain. The file is owned by a user in the same domain, and the sharing settings are set to 'Anyone in the organization with the link can view'. The user reports seeing a 'You need permission' error. The administrator has verified that the user is signed in with the correct account. Which of the following is the most likely cause?
Google Workspace allows administrators to set sharing policies per organizational unit. If the user's OU has a policy that restricts access to files shared with 'Anyone in the organization', they will be blocked even if the file's sharing settings allow it. This is a common cause of permission errors when sharing settings appear correct. The administrator should check the OU's sharing settings in the Admin console.
Why this answer
Drive sharing policies at the organizational unit level can override file-level sharing settings. If the user's OU has a policy that blocks access to files shared with 'Anyone in the organization', the user will see a permission error even though the file's settings allow it. Administrators should review the OU's sharing settings and adjust if necessary.
Exam trap
The trap here is focusing on file-level sharing settings and overlooking organizational unit policies that can restrict access regardless of file settings.
The security team at Acme Corp wants to block all OAuth scopes that are classified as High Risk and unverified for users under the Sales org unit. Where should the administrator configure this restriction?
This is the correct path because App access control in API controls allows administrators to set app access policies per org unit. By configuring the policy for the Sales org unit, the admin can block apps with High Risk and unverified scopes, meeting the requirement precisely.
Why this answer
The correct answer is the option that directs the administrator to API controls > App access control and specifies configuration for the Sales org unit. This setting allows granular control over which apps and scopes users can access, enabling the blocking of High Risk unverified scopes for a specific group. Other options either refer to incorrect settings or apply the policy too broadly, not meeting the requirement.
Exam trap
The trap here is confusing OAuth consent screen settings with app access control, which are distinct features for managing app permissions and blocking risky scopes.
A Google Workspace administrator needs to quickly identify which users have been suspended in the domain. Which tool should the administrator use to get this information?
The Users list in the Admin console displays all users and their status, including whether they are suspended. Administrators can filter by status to see only suspended users. This is the most direct and efficient way to identify suspended accounts in the domain.
Why this answer
The Users list in the Google Admin console provides a comprehensive view of all user accounts, including their current status. Administrators can easily filter the list to show only suspended users, making it the fastest and most straightforward method to identify them.
Exam trap
The trap here is overcomplicating the task by considering audit logs or APIs when the simple Users list already provides the needed information.
Which THREE security settings are commonly configured using Context-Aware Access?
Context-Aware Access evaluates device security posture, such as screen lock and encryption, as an access-level condition. This satisfies the stem's requirement for a commonly configured security setting, since posture signals determine whether a device may reach Workspace apps.
Why this answer
Context-Aware Access in Google Workspace evaluates access requests based on attributes of the user, device, and context, so device security posture such as screen lock status (A) is a valid access level condition that can block or allow apps based on whether the device meets requirements like encryption or screen lock. User IP address (B) is a supported condition, allowing admins to restrict access to specific IP ranges or subnets via access levels. Geographical location (E) is also supported, since Context-Aware Access can evaluate the source country or region of the request to grant or deny access.
Email signature format (C) is a Gmail compliance/branding setting unrelated to access decisions, and user password strength (D) is enforced through password policies, not Context-Aware Access conditions.
Your organization uses Google Workspace and has a legal hold on a user's Gmail and Drive data. The user continues to work and creates new files and emails. You need to ensure that any new content created by this user is also preserved under the same legal hold. What should you do?
In Google Vault, when you place a hold on a user's account for specific services, the hold applies to all existing and future data in those services until the hold is removed. Adding the user to the hold ensures that new emails and files are automatically preserved. No further action is needed.
Why this answer
Google Vault holds are applied to user accounts and cover all data within the specified services, including future data. When you add a user to a hold, any new emails or files they create are automatically preserved until the hold is released. This is the correct and simplest way to ensure ongoing preservation.
Other options either do not provide the same legal protection or are unnecessary.
Exam trap
The trap here is thinking that a new matter or retention rule is needed; however, holds automatically cover future data once the user is added.
An administrator needs to view all changes made to organizational units. Which report should they use?
The Admin audit log records administrative actions, including organizational unit creation, modification and deletion, with actor, timestamp and affected resource. It is the report that surfaces OU changes, unlike the login audit or user reports.
Why this answer
The Admin Audit log records all configuration changes within the Google Admin console.
You are configuring Endpoint Verification. What is the primary purpose of the Endpoint Verification extension on a user's browser?
The Endpoint Verification extension reports device attributes such as screen lock, encryption, OS version and disk status to Google, which context-aware access then evaluates against access levels. It satisfies the stem's requirement by supplying device trust signals for policy decisions.
Why this answer
Endpoint Verification is a Chrome extension (and mobile agent) that collects device attributes such as OS version, screen lock status, disk encryption, and serial number, and reports them to Google. These signals feed into context-aware access policies, allowing admins to grant or deny access to Workspace apps based on device posture. Its primary purpose is to provide device context for access decisions.
Exam trap
GWS-ADMIN often tests whether candidates confuse Endpoint Verification (device posture for context-aware access) with MDM features like remote wipe or password enforcement.
How to eliminate wrong answers
Option B is wrong because remote wipe is a capability of mobile device management (MDM) or the Admin Console's device management, not the Endpoint Verification extension. Option C is wrong because password complexity is enforced via password policies in the Admin Console or Windows/Mac policy, not by Endpoint Verification. Option D is wrong because blocking malicious websites is the job of Chrome's Safe Browsing or a secure web gateway, not Endpoint Verification.
Your organization wants to allow employees to use their personal iOS devices to access Google Workspace, but you need to ensure that corporate data can be wiped if the device is lost. You also want to avoid wiping personal data. Which mobile management setting should you enable?
Advanced mobile management for iOS supports the separation of work and personal data through managed accounts and apps. It allows admins to wipe only corporate data (e.g., managed apps and accounts) without erasing personal content. This meets the requirement of securing corporate data while preserving personal data on BYOD devices. It also provides more granular policies and reporting.
Why this answer
Advanced mobile management for iOS enables the separation of work and personal data. When a device is lost, admins can perform a corporate wipe that removes only managed Google Workspace data and apps, leaving personal data intact. Basic management does not offer this granularity.
Context-Aware Access and Endpoint Verification are for access control and posture assessment, not data wiping. Therefore, advanced mobile management is the correct setting to meet both access and security requirements.
Exam trap
The trap here is thinking that Context-Aware Access or Endpoint Verification can wipe data; they only control access, while advanced mobile management provides the selective wipe capability.
An administrator is configuring a Context-Aware Access access level to protect Google Drive for a remote workforce. Which TWO conditions can be used in the access level to evaluate device trust and network origin? (Choose two.)
IP subnet conditions allow an administrator to allow or deny access based on the source IP address range in CIDR notation. This is a valid network-origin condition that can be combined with device policy to restrict Drive access for the remote workforce.
Why this answer
Context-Aware Access access levels support conditions such as device policy, IP subnet, geographic region, and user identity. Device policy evaluates endpoint attributes like encryption and screen lock, while IP subnet evaluates the source network range, making both valid conditions for protecting Drive access.
Exam trap
The trap here is treating organizational unit or password policy as an access level condition, when OU is the assignment scope and password length is a separate domain policy.
You want to prevent sensitive Drive documents from being printed. Which setting is appropriate?
This setting explicitly disables download, print, and copy for shared files.
Why this answer
In Google Drive sharing settings, admins can disable the 'Viewers and commenters can see the option to download, print, and copy' setting, which removes the print/download/copy options for users with view or comment access. This is the appropriate control to prevent printing of sensitive documents shared with those roles.
Exam trap
GWS-ADMIN often tests the difference between access control (who can open) and action control (what they can do) — candidates pick DLP or context-aware access, but only the Drive sharing setting directly removes the print option.
How to eliminate wrong answers
Option A is wrong because context-aware access controls who can access based on identity/device context, not what actions they can take once inside. Option C is wrong because endpoint management governs device security (screen lock, encryption) but does not remove print options in Drive. Option D is wrong because DLP policies detect and redact/block sensitive content based on rules, but they do not directly disable the print button for viewers/commenters.
What is the primary function of an alias address?
An alias address routes mail to an existing user's mailbox without being a separate account, so messages sent to it land in the same inbox. This satisfies the stem's requirement of providing an alternative email address for an existing user.
Why this answer
An alias is an additional email address for an existing user that routes mail to the same inbox.
Which feature prevents a user from being deleted during a directory sync?
GCDS lets you control what happens to Google accounts that are not found in the LDAP directory, including rules that stop them from being deleted and exclusion rules that make the sync ignore specific users or units entirely. That protects accounts that exist only in Google, such as service accounts or external administrators. Always run a simulated sync first, because its report lists every deletion it would perform.
Why this answer
The 'Do not delete' flag in GCDS prevents the sync process from removing accounts that don't match the source directory.
Your company uses Google Cloud Directory Sync to provision users from an on-premises Active Directory. A user who left the company was removed from Active Directory last week, but the account still appears as active in the Google Admin console after multiple sync runs. What is the most likely cause?
GCDS does not act on users that disappear from the source directory unless the administrator explicitly enables the option to suspend or delete them. With that setting off, the sync treats the missing user as out of scope and leaves the Google account untouched, which explains why repeated syncs change nothing.
Why this answer
GCDS only suspends or deletes Google accounts for users that disappear from the source directory when those actions are explicitly enabled in the configuration. With that option disabled, removed source users are ignored and their Google accounts stay active indefinitely, which is exactly the symptom described.
Exam trap
The trap here is assuming GCDS automatically mirrors deletions from Active Directory, when deletion and suspension behaviour is opt-in and must be enabled per configuration.
Which TWO actions can you take when a user account is under a Vault hold?
A Vault hold preserves all data by placing the user's mailbox and Drive content on indefinite retention, so deletion attempts are blocked until the hold is removed. This satisfies the stem's constraint that the account is under hold, where preservation overrides normal deletion and retention policies.
Why this answer
A Vault hold is a preservation mechanism that overrides retention and deletion policies, so option B (Prevent data deletion) is correct because placing a user account under a hold stops Gmail messages, Drive files, and other covered data from being purged even after the retention period expires. Option D (Ensure data availability for eDiscovery) is also correct because the hold keeps the user's data searchable and exportable in Vault for legal or investigative purposes, which is the core reason holds are applied. The unmarked options do not belong: A (Automatically delete old emails) contradicts the preservation purpose of a hold, C (Enable 2-Step Verification) is an account security setting unrelated to Vault holds, and E (Allow the user to change their password) is a normal account action that a hold neither grants nor blocks.
Exam trap
GWS-ADMIN often tests the confusion between Vault holds (preserve data for eDiscovery) and general account security settings (2SV, password changes), catching candidates who pick unrelated admin actions.
Where do you go to view a list of all devices currently accessing your organization's data?
The Devices > Mobile & endpoints > Devices page in the Admin console lists enrolled computers, phones and tablets accessing organisational data. This is the central inventory satisfying the need to view all devices currently touching your organisation's data.
Why this answer
The 'Devices' section in the Admin console provides a centralized view of all mobile and desktop devices.
Which TWO of the following can be restricted in Google Drive sharing settings?
External sharing controls in Google Drive let admins block or permit sharing with recipients lacking Google accounts, directly satisfying the stem's constraint that only two listed items are restrictable. This setting governs whether files can be sent to non-Google email addresses, so disabling it prevents external recipients from accessing content entirely.
Why this answer
Option B is correct because Google Drive's sharing settings include an admin control that limits whether files can be shared with people who don't have a Google account, typically by restricting sharing to only users within the domain or requiring recipients to sign in with a Google account. Option D is correct because Google Workspace admins can configure sharing settings to control whether files can be shared outside the organization, including options like turning off external sharing entirely or limiting it to allowlisted domains. Option A is incorrect because file size limits are governed by storage quotas and upload limits, not by Drive sharing settings.
Option C is incorrect because who can use the Drive app is controlled through user licensing and app access settings, not sharing settings. Option E is incorrect because there is no per-day file sharing limit configurable in Drive sharing settings.
Exam trap
GWS-ADMIN often tests the difference between sharing settings and other admin controls, such as licensing or app access, causing candidates to pick options that are not part of sharing settings.
Which setting allows you to see what files are being shared externally across your entire domain?
The Security Investigation Tool runs domain-wide queries over Drive logs, letting admins search sharing events and external visibility across all users. This satisfies the requirement to see files shared externally across the entire domain, unlike per-file or per-user sharing reports.
Why this answer
The Security Investigation Tool is the correct setting because it allows admins to search across all Drive files in the domain and filter by sharing visibility, including externally shared files. It provides a domain-wide view of file sharing activity and is the only surface that supports querying external sharing at scale. This is the tool designed for security investigations and reporting on sharing exposure.
Exam trap
GWS-ADMIN often tests the difference between audit logs (event-level) and the Security Investigation Tool (queryable, domain-wide view), so candidates pick the Drive Audit Log because it sounds like the place to see sharing activity.
How to eliminate wrong answers
Option A is wrong because the Drive Audit Log records individual file events (view, edit, share) but does not provide an aggregated domain-wide view of externally shared files. Option B is wrong because Apps > Google Workspace > Drive > Sharing audit is not a real Admin console path; sharing settings live under Apps > Drive, but there is no 'Sharing audit' subsection. Option C is wrong because Report > User Reports > Drive shows per-user usage and activity metrics, not a domain-wide external sharing inventory.
Your organization allows employees to use personal iOS devices for work. You need to ensure that when a user adds their corporate Google Workspace account to the native iOS Mail app, the device is automatically enrolled in advanced mobile management and a passcode is enforced. What should you do?
Enabling advanced mobile management for iOS triggers automatic enrollment when a user adds a managed Google Workspace account to the native iOS Mail app. This applies passcode and encryption policies without requiring a separate agent. It is the correct step to enforce security on personal iOS devices accessing corporate email.
Why this answer
Advanced mobile management for iOS, when enabled for an organizational unit, automatically enrolls personal iOS devices when the user adds a managed Google Workspace account to the native iOS Mail app. This enrollment enforces passcode and encryption policies without requiring the user to install a separate app. It is the designated method for securing BYOD iOS devices in Google Workspace.
Exam trap
The trap here is assuming that the Google Device Policy app is required for advanced iOS management, when in fact native iOS Mail enrollment handles it automatically.
Which THREE settings can be enforced on Android devices using Advanced mobile management?
Managed application deployment is enforced through managed Google Play, letting admins push and configure apps silently on Android devices. This satisfies the stem's Advanced mobile management requirement, which extends beyond basic device restrictions to application-level control, including per-app VPN and managed configurations unavailable under basic management.
Why this answer
Advanced management allows for mandatory passcodes, managed applications, and remote wipe capabilities.
Your organization uses Google Workspace and you have been asked to ensure that all email sent from your domain passes SPF, DKIM, and DMARC checks. You have already published SPF and DKIM records. Which action should you take to complete the DMARC configuration?
DMARC is configured by publishing a TXT record at the _dmarc subdomain of your domain. The policy instructs receiving servers how to handle messages that fail SPF and DKIM alignment. This is the standard and required step to complete DMARC setup.
Why this answer
DMARC is implemented by publishing a TXT record at _dmarc.yourdomain.com with a policy such as quarantine or reject. This tells receiving servers how to treat messages that fail SPF and DKIM alignment. Admin console settings and MX records do not configure DMARC, so the DNS TXT record is the required action.
Exam trap
The trap here is thinking DMARC is enabled in the Admin console, when it is actually a DNS TXT record.
A user claims they cannot share a file with an external partner. What is the most likely cause within the Admin console?
Drive sharing settings inherited from the user's organisational unit override broader domain policies, so an OU-level restriction on external sharing blocks the share even when the partner's address is valid. This directly satisfies the stem's constraint that the cause sits within the Admin console rather than the recipient's configuration.
Why this answer
Sharing settings in Drive and Docs are controlled at the Organizational Unit (OU) level, which can restrict external sharing.
Your organization uses Context-Aware Access to restrict access to Google Workspace based on IP address ranges. A remote employee traveling for business is unable to access Gmail from a trusted hotel Wi-Fi. How should the administrator temporarily grant access without compromising long-term security?
Context-Aware Access rules bind to organizational units and access levels, so moving the user to an OU without the rule, or granting a temporary exception access level, restores Gmail access. This satisfies the stem's requirement to grant access temporarily without weakening long-term security.
Why this answer
Temporarily moving the user to an OU without the Context-Aware Access rule or assigning a temporary exception access level grants access without weakening the overall security posture. This approach is reversible and does not require permanent changes to access levels or disabling security features.
Exam trap
GWS-ADMIN often tests the temptation to permanently modify access levels or disable security features, but the exam expects recognition of temporary, scoped exceptions as the best practice.
How to eliminate wrong answers
Option A is wrong because permanently adding the hotel IP subnet to the global access level would create a security hole for all users and is not temporary. Option B is wrong because disabling 2-Step Verification weakens account security and does not address the Context-Aware Access restriction. Option C is wrong because resetting OAuth tokens would disrupt the user's sessions but not bypass the IP-based restriction.
Which THREE settings can be configured within the Gmail Compliance section?
Content compliance is one of the configurable Gmail Compliance settings, letting admins scan message bodies and attachments against expressions and take actions such as quarantine or reject. This satisfies the stem's requirement to name three settings found in that section.
Why this answer
In the Google Admin console, the Gmail Compliance section (Apps > Google Workspace > Gmail > Compliance) provides rules for inspecting and acting on messages, and it includes Content compliance (A), which lets admins define rules that match message content, headers, or attachments and then route, quarantine, or reject them. It also includes Attachment compliance (D), which applies policies specifically to attachments based on file type, name, or size, such as blocking or quarantining messages with certain files. Profanity check (B) is likewise a configurable compliance rule that scans message content against a predefined or custom word list and can block, quarantine, or route offending messages.
SPF record generation (C) is not part of Gmail compliance; SPF is a DNS TXT record configured in domain DNS settings, not in the Gmail Compliance UI. Default signature settings (E) are configured under Gmail > General settings (or per-user signatures), not within the Compliance section.
Exam trap
GWS-ADMIN often tests the boundary between Gmail Compliance settings and other Gmail admin sections — candidates confuse SPF/DKIM/DMARC authentication and signature settings with compliance rules, but those live in different parts of the Admin console.
Your legal team requires that all emails from a specific user be preserved for an upcoming audit. Which tool should you use to ensure these messages are not deleted?
Google Vault applies a retention rule or legal hold directly to the specified user's mailbox, preserving every message regardless of deletion by the user. This satisfies the legal team's audit requirement, since held content remains searchable and exportable until the matter is closed or the hold is removed.
Why this answer
Google Vault is the eDiscovery and retention tool designed for legal and compliance use cases. It lets admins place holds on specific users' Gmail messages, ensuring they cannot be deleted even by the user, and supports search/export for audits. This directly satisfies the legal team's requirement to preserve a specific user's emails.
Exam trap
The trap is confusing DLP (content protection) with Vault (retention/eDiscovery) — candidates see 'preserve emails' and pick DLP because it sounds security-related, but DLP does not preserve data.
How to eliminate wrong answers
Option A is wrong because DLP rules are for detecting and preventing sharing of sensitive content (e.g., blocking credit card numbers in email), not for preserving messages for legal hold. Option B is wrong because Google Workspace Migration for Microsoft Outlook is a data migration tool for moving Outlook data into Workspace, unrelated to retention. Option C is wrong because Admin Console Reporting provides usage and audit logs, not message preservation or legal hold capability.
You are a Workspace administrator. Your organization has a policy that all iOS devices accessing Gmail must have a passcode and be encrypted. You have enabled advanced mobile management for iOS. However, some users report that they can still access Gmail on their iOS devices without setting a passcode. What is the most likely reason for this?
Advanced mobile management for iOS enforces passcode and encryption requirements when accessing Google apps like Gmail through the Gmail app. However, if users access Gmail via a mobile web browser (e.g., Safari or Chrome), these device-level policies are not enforced because the browser is not a managed app. This allows users to bypass the passcode requirement. To prevent this, administrators can disable mobile web access or enforce policies through other means.
Why this answer
The most likely reason is that users are accessing Gmail through a mobile web browser rather than the Gmail app. Advanced mobile management for iOS enforces device policies only within managed Google apps. Mobile web access bypasses these app-level controls, allowing users to avoid passcode and encryption requirements.
To close this gap, administrators should consider disabling mobile web access for Gmail or using Context-Aware Access to block unmanaged browsers.
Exam trap
The trap here is assuming that enabling advanced mobile management automatically covers all access methods, including mobile web, when it only applies to managed apps.
Where do you manage the shared contacts for your organization?
Shared contacts are governed by the organisation's external sharing policies, so the control lives under Directory > Directory settings > Sharing settings, where you toggle contact sharing across the domain rather than editing individual contact records.
Why this answer
Shared contacts are managed in the Directory settings of the Admin console.
You are a Workspace admin. Your company issues Android devices to field technicians. You need to ensure that if a device is lost or stolen, you can remotely wipe only corporate data (Gmail, Drive, Calendar) without erasing personal photos and apps. The devices are enrolled in advanced mobile management. Which action should you take?
In advanced mobile management, the 'Wipe corporate data' action removes only the managed Google Workspace data and accounts from the device, leaving personal apps and data intact. This is exactly what is needed to secure corporate information without affecting the user's personal content. It is available for Android devices enrolled in advanced management.
Why this answer
For Android devices in advanced mobile management, the 'Wipe corporate data' option selectively removes only the managed Google Workspace accounts and data. This secures corporate information while preserving personal apps and files. A full remote wipe would erase everything, which is unnecessary and harmful to the user.
Suspending the account or changing the password does not remove data already on the device, so they do not satisfy the requirement.
Exam trap
The trap here is confusing a full remote wipe with a corporate data wipe; many admins default to remote wipe, which erases personal data and is not the correct action when only corporate data needs removal.
You are implementing context-aware access and need to ensure that only devices with a disk-encrypted state are allowed to access Google Drive. Which feature enables this check?
Access Levels in Context-Aware Access evaluate device signals, including disk encryption state, before granting access. Binding an access level requiring encrypted devices to the Google Drive application ensures only compliant endpoints reach it, satisfying the disk-encryption constraint.
Why this answer
Access Levels in Context-Aware Access allow admins to define conditions like 'disk encryption enabled' for device access to Google Workspace apps. This is configured in Admin console > Security > Context-Aware Access, where you create access levels based on device state, IP, user identity, etc.
Exam trap
The trap is confusing device management features (like device policy profiles or Chrome Enterprise) with the specific Context-Aware Access feature that evaluates device state for app access.
How to eliminate wrong answers
Option A is wrong because Alert Center is for monitoring and alerts, not access control. Option B is wrong because device policy profiles are for mobile device management settings, not context-aware access conditions. Option D is wrong because Chrome Enterprise Upgrade is a licensing tier for Chrome browser management, not the feature that enforces disk encryption checks for Drive access.
A financial services company uses Google Workspace. The security team wants to ensure that when an employee's device is compromised, their active Google Workspace sessions are terminated immediately and they are required to re-authenticate with 2-Step Verification. Which action should the administrator take?
The 'Sign out of all sessions' button in the user's Security settings immediately revokes all active sessions for that user across all devices. Upon next access, the user must sign in again, and if 2-Step Verification is enforced, they will be prompted for it. This directly meets the requirement to terminate sessions immediately and require re-authentication with 2-Step Verification.
Why this answer
The 'Sign out of all sessions' action in the user's Security settings is the correct way to immediately terminate all active sessions for a user. It forces the user to re-authenticate on all devices, and if 2-Step Verification is enforced, they must complete that step again. Resetting the password, suspending the account, or enabling Context-Aware Access do not achieve immediate session termination and re-authentication with 2-Step Verification.
Exam trap
The trap here is thinking that resetting a password or suspending an account instantly kills active sessions, when in fact sessions can persist until they expire.
Which TWO of the following can be modified in the Admin console's 'Company Profile' section?
The support contact phone number is editable under Company Profile, satisfying the stem's requirement for modifiable settings. This field controls the number displayed to users on the support page, and administrators can update it directly without contacting support, distinguishing it from read-only directory attributes such as primary domain name.
Why this answer
In the Admin console's Company Profile section, administrators can edit the organization's identity and contact details, which includes the Organization name (E) and the Support contact phone number (C). These fields are part of the company profile information used to identify the organization and provide contact details for support. Individual user password requirements (A) are configured under security or password policies, not the Company Profile.
Domain verification records (B) are managed in the Domains section, and user licenses (D) are handled in the Billing or Subscriptions area, so neither belongs to the Company Profile.
You need to ensure that all corporate-owned Android devices require a screen lock. Where should you configure this setting?
Password settings under Android within Mobile & endpoints define screen lock requirements, including lock type and timeout, applied to enrolled corporate-owned devices. This satisfies the requirement that all corporate-owned Android devices enforce a screen lock.
Why this answer
Android screen lock enforcement for corporate-owned devices is configured under Devices > Mobile & endpoints > Settings > Android > Password settings, where admins set password strength, length, and lock requirements that apply to managed Android devices. This is the mobile device management (MDM) policy path, distinct from user account password policy.
Exam trap
GWS-ADMIN often tests the confusion between user account password policy (Security > Authentication) and device screen lock policy (Devices > Mobile & endpoints), which live in completely different console sections.
How to eliminate wrong answers
Option A is wrong because 'Apps > Google Workspace > Android settings' is not a real Admin console path for device password enforcement — Android app settings govern app-level behavior, not device lock policy. Option C is wrong because Security > Authentication > Password policy governs Google Account password complexity for users signing into Workspace, not the device screen lock on Android hardware. Option D is wrong because Directory > Users > Security settings covers user-level account security (2SV, recovery), not mobile device password enforcement.
Your organization wants to block access to Google Workspace from all Android devices that are not running the latest security patch. You have configured a Context-Aware Access access level that requires the device to have a security patch level within the last 90 days. However, you notice that some devices with outdated patches are still able to access Gmail. What is the most likely reason?
The security patch level attribute is only available for Android devices enrolled in Advanced mobile management. If devices are in Basic mobile management, this attribute is not collected, so the access level cannot evaluate it. In that case, the access level may treat the attribute as missing and allow access, depending on configuration. Thus, devices with outdated patches might still access if not in Advanced management.
Why this answer
The security patch level attribute is only collected for Android devices in Advanced mobile management. If some devices are in Basic management, the attribute is missing, and the access level may not block them. Ensuring all Android devices are in Advanced mobile management is necessary for this attribute to be enforced.
Exam trap
The trap here is assuming all Android devices report security patch level regardless of management level.
Which TWO of the following can be configured in the Google Workspace Admin Console to restrict user access to Google Drive?
Restricting external sharing in the Admin console sets the default sharing visibility for external domains, blocking users from publishing Drive files outside the organisation. This directly enforces the access restriction the question requires at the domain-sharing policy level.
Why this answer
Option A is correct because the Admin console's Drive and Docs sharing settings let you restrict how users can share files outside your domain, such as turning off external sharing or limiting it to whitelisted domains, which directly restricts user access to Drive content. Option E is correct because Drive can be turned ON or OFF per Organizational Unit (or group), so disabling Drive for a specific OU prevents those users from accessing Drive entirely. Option B is not a Drive access control; file creation counts are governed by storage quotas, not a per-user file-count limit in the Admin console.
Option C is not configurable as a Drive access restriction; Drive does not offer an Admin console setting to block access by file type. Option D is not a Drive access restriction either; upload size limits are not an Admin console Drive access control (Drive enforces a 5 TB per-file maximum, not a configurable Admin setting).
Exam trap
GWS-ADMIN often tests the difference between actual configurable settings and non-existent ones, and candidates may choose file type restrictions thinking it's possible, but it's not a native Drive setting.
A user claims they cannot reset their password using the 'Forgot Password' link. What is the most likely cause?
Self-service password reset only appears when the admin has enabled it in Security settings. If that toggle is off, the Forgot Password link cannot authenticate the user or send a reset code, which precisely matches the reported failure.
Why this answer
If 'Allow users to reset their passwords' is disabled in the Security settings, they cannot use the self-service flow.
A university uses Google Workspace for Education. The IT team wants to ensure that all new Google Drive files created by students are automatically scanned for sensitive data such as credit card numbers, and that any matches are logged for review. They do not want to block file creation. What should they configure?
Drive DLP rules can detect sensitive content like credit card numbers using predefined detectors. Setting the action to 'Alert and log' will trigger an alert and log the event without blocking the file creation or sharing. This meets the requirement to scan and log without impeding users.
Why this answer
Drive DLP rules are designed to scan Drive content for sensitive information using detectors like credit card numbers. By setting the action to 'Alert and log', the system will record matches without blocking file creation, allowing the IT team to review incidents later. This satisfies both the scanning and non-blocking requirements.
Exam trap
The trap here is confusing DLP with audit logs or applying DLP to the wrong service like Gmail.
Which of the following is true regarding 'Advanced' mobile management for iOS?
Advanced mobile management pushes configuration profiles to iOS devices, including Wi-Fi settings and certificates. This exceeds basic management, which only enforces screen lock and wipe, satisfying the requirement to distribute network credentials and identity certificates.
Why this answer
Advanced management provides more control, such as certificate management and enterprise Wi-Fi configuration, compared to Basic management.
A user is unable to access Google Drive. Which TWO of the following should you check first?
A suspended account is denied all Google services, so Drive access fails regardless of sharing or licence settings. Confirming the account status first rules out the most common administrative cause before investigating Drive-specific sharing or OU policy issues.
Why this answer
Option B (User account status Suspended/Active) is correct because if the user's Google Workspace account has been suspended or disabled by an administrator, the user will be unable to sign in to Google Drive regardless of network or device conditions, making account status a primary troubleshooting check. Option D (Google Workspace Status Dashboard) is correct because it reports current service health and outages for Google Workspace apps including Drive; if Drive is experiencing a widespread outage, the issue is on Google's side and no client-side fix will help. Option A (browser history) is not relevant because cached browsing history does not cause or explain access failures to Drive.
Option C (computer model) is irrelevant since Google Drive access depends on the browser and account, not the hardware model. Option E (printer configuration) is unrelated because printing has no bearing on the ability to access Google Drive.
You need to ensure that credit card numbers are not sent via Gmail by your employees. Which tool should you configure?
DLP rules inspect outbound email content for sensitive data patterns, such as credit card numbers, and block or quarantine messages that match. Configuring them in Google Workspace directly satisfies the requirement to prevent employees sending card numbers through Gmail, enforcing protection at the message level before delivery occurs.
Why this answer
Data Loss Prevention (DLP) rules in Google Workspace can scan Gmail content for predefined detectors like credit card numbers (using regex and checksum validation) and take actions such as block, quarantine, or warn. This is the purpose-built tool for preventing sensitive data like PANs from being emailed. Other tools handle access, retention, or investigation, not content-based blocking.
Exam trap
GWS-ADMIN often tests the confusion between DLP and Vault — the trap is picking Vault retention rules thinking they block sensitive content, when Vault only retains and searches data.
How to eliminate wrong answers
Option A is wrong because Context-aware access controls who can access Workspace apps based on identity and device posture, not what content users can send. Option C is wrong because Vault retention rules govern how long messages are retained for legal/eDiscovery purposes — they do not inspect or block message content. Option D is wrong because the Security center investigation tool is for post-incident analysis and threat hunting, not real-time content blocking of outbound email.
Which TWO practices are recommended when configuring organizational units (OUs) for security policy enforcement in Google Workspace? (Choose two.)
Periodic audits confirm that OU placement and inherited policies still grant each user the intended security controls, catching drift after role or team changes. This satisfies the requirement for recommended OU configuration practices alongside applying policies at the correct hierarchy level.
Why this answer
Option C is correct because Google Workspace policies are inherited down the OU tree, so regularly auditing OU membership and inheritance ensures users actually receive the intended security controls and that no one is misplaced in an OU with weaker settings. Option E is correct because structuring OUs hierarchically to mirror departments or differing security requirements lets child OUs inherit parent policies while allowing targeted overrides only where needed, which is the recommended design for policy enforcement. Option A is not recommended because Super Administrator privileges should be tightly limited, not granted to each OU head, since that role has broad control over all services and settings.
Option B is unnecessary and error-prone because child OUs already inherit parent policies, so overriding identical policies at every level adds administrative overhead and risk of inconsistency. Option D is wrong because placing all users in the root OU prevents granular, differentiated policy application by department or security requirement.
Exam trap
GWS-ADMIN often tests the misconception that more overrides or flatter structures improve security, when in fact inheritance with minimal overrides and regular audits is the recommended approach.
You need to add a secondary domain to your Google Workspace account. What must you perform after adding the domain in the Admin console?
Verifying domain ownership is mandatory because Google must confirm you control the DNS before it will provision the secondary domain. Adding the domain in the Admin console only creates a pending entry; verification via a TXT or CNAME record activates it, satisfying the requirement that ownership be proven before the domain becomes usable.
Why this answer
Verification is mandatory to prove domain ownership via DNS records.
An enterprise organization is planning its 2-Step Verification (2SV) rollout. Which THREE methods or tokens are natively supported by Google Workspace for 2SV authentication? (Choose three.)
TOTP authenticator apps generate rotating six-digit codes from a shared secret, requiring no network or hardware token. Google Workspace natively enrols them during 2SV setup, satisfying the stem's demand for a supported second factor alongside prompts and security keys.
Why this answer
Google Workspace natively supports several 2SV methods, and the three correct options here are A, D, and E. Option A is correct because Time-based One-Time Password (TOTP) authenticator apps such as Google Authenticator generate 6-digit codes from a shared secret and are a standard 2SV method in Google Workspace. Option D is correct because Google Prompts push a sign-in approval notification to a trusted mobile device signed into the same account, allowing the user to tap Yes/No without typing a code.
Option E is correct because FIDO2/U2F security keys like Titan keys are supported as phishing-resistant hardware tokens for 2SV. Option B is not correct because Google Workspace 2SV does not rely on local BIOS firmware biometric retina scanning; biometrics may unlock a device but are not a Workspace 2SV token. Option C is not correct because automatic voice call verification via landline pulse dialing tones is not a supported Google Workspace 2SV method.
How can you prevent users from changing their profile photo?
Directory profile editing settings control whether users may change their own profile data, including photos. Disabling photo editing there removes the user-facing option, satisfying the requirement to prevent users from changing their profile photo without affecting other services.
Why this answer
Directory profile settings allow admins to restrict which profile details users can modify.
You are seeing a 'Domain already in use' error when adding a domain. What is the most likely cause?
A domain can only be verified in one Google Workspace account at a time. The 'Domain already in use' error therefore indicates the domain is verified elsewhere, which is exactly the cause the stem asks for.
Why this answer
The 'Domain already in use' error in Google Workspace means the domain is already verified and claimed by another Google Workspace account (or a consumer Google account). Google enforces one owner per domain, so you must either remove the domain from the other account or use a different domain. This is a verification/ownership conflict, not a DNS or quota issue.
Exam trap
The trap is blaming DNS or quotas — the 'already in use' message specifically points to ownership by another Google account, which is the most common real-world cause.
How to eliminate wrong answers
Option B is wrong because sub-domains are allowed and do not trigger this error unless they are independently verified elsewhere. Option C is wrong because DNS propagation issues produce verification failures, not 'already in use' errors. Option D is wrong because the domain limit error has a different message and only applies after you have already added the maximum number of domains.
Which TWO of the following are true regarding the Directory API?
The Directory API requires OAuth 2.0 bearer tokens for authorisation; service accounts with domain-wide delegation or user consent flows issue these tokens. API keys and basic authentication are not supported, satisfying the authentication requirement stated in the option.
Why this answer
Option A is correct because the Directory API is a Google Workspace (formerly G Suite) Admin SDK API that requires OAuth 2.0 authorization with appropriate scopes (such as https://www.googleapis.com/auth/admin.directory.user or .group) to authenticate and authorize requests. Option D is correct because the Directory API provides resources for managing groups, including creating, updating, deleting, and listing groups and their members via endpoints like /admin/directory/v1/groups and /admin/directory/v1/groups/{groupKey}/members. Option B is incorrect because the Directory API does support bulk operations, such as batch requests and the members.insert/delete endpoints for managing multiple memberships.
Option C is incorrect because access to the Directory API depends on the Google Workspace edition and admin privileges, not being universally free with all licenses. Option E is incorrect because access is governed by delegated admin roles and OAuth scopes, not restricted solely to Super Admins.
Your organization uses Google Workspace and has a fleet of Windows 10 laptops managed by a third-party UEM tool. You need to enforce Context-Aware Access so that users can access Workspace apps only from devices that meet your security policies. What should you deploy on each Windows device to enable device-based access levels?
Endpoint Verification is the component that collects device attributes such as OS version, disk encryption, and screen lock status, and reports them to Google Workspace. These attributes are then used by Context-Aware Access to evaluate device-based access levels. Without it, the admin console cannot assess device security posture for Windows devices.
Why this answer
Context-Aware Access relies on device attributes to make access decisions. For Windows, macOS, and Linux, the Endpoint Verification extension is required to gather those attributes. It reports on disk encryption, OS version, and other security settings, which are then used in access levels.
Without it, device-based access levels cannot be enforced.
Exam trap
The trap here is confusing authentication tools like GCPW with device posture collection tools like Endpoint Verification.
Your company uses Google Workspace and has a Google Cloud Directory Sync (GCDS) deployment to synchronize users from an on-premises Active Directory. A new HR policy requires that when an employee is terminated, their account must be suspended immediately and not deleted, but their mailbox data must be preserved for eDiscovery. You need to configure GCDS so that terminated employees are suspended rather than deleted. What should you do?
GCDS allows you to specify what happens to users removed from the LDAP source: you can suspend them instead of deleting. By enabling suspension and disabling deletion, terminated employees are suspended, preserving their data for eDiscovery. This matches the HR policy and avoids irreversible deletion.
Why this answer
GCDS provides explicit options for handling users removed from the LDAP source: you can choose to suspend or delete them. To meet the policy, configure GCDS to suspend removed users and ensure deletion is not enabled. This preserves mailbox data and allows for eDiscovery while immediately disabling access.
Exam trap
The trap here is assuming Google Vault or a domain-wide policy controls suspension during directory sync, when the behavior is set within GCDS itself.
Your organization uses Google Workspace and has a fleet of company-owned Windows 10 laptops. You want to ensure that only devices that are company-owned and meet specific security requirements (like disk encryption and screen lock) can access Gmail and Drive. You have already enrolled devices in Windows device management. Which additional step is required to enforce these device-based access policies?
Endpoint Verification collects device attributes such as ownership, disk encryption status, and screen lock, and reports them to Google Workspace. These attributes are then used in Context-Aware Access policies to allow or deny access based on device state. Without Endpoint Verification, the admin console cannot evaluate device security posture for access decisions, even if devices are enrolled in Windows management.
Why this answer
To enforce access based on device security attributes, you must deploy Endpoint Verification. It collects signals such as disk encryption, screen lock, and ownership from Windows, macOS, and Linux devices. These signals are then used by Context-Aware Access to allow or block access to Google Workspace apps.
Enabling Context-Aware Access without Endpoint Verification leaves no device data to evaluate, so policies cannot function as intended.
Exam trap
The trap here is assuming that enrolling devices in Windows management automatically provides device posture to Context-Aware Access, when in fact Endpoint Verification is required to collect and report those attributes.
You need to enforce 2-Step Verification for a specific department while allowing others to opt-in voluntarily. Which configuration path should you use?
Enforce applies 2-Step Verification to every user in the selected organisational unit, satisfying the mandatory requirement for that department. Users outside the OU remain unaffected and can still enrol voluntarily through their individual settings, giving the split behaviour the scenario demands.
Why this answer
To enforce 2SV for specific users, you must use Organizational Units (OUs) or Groups and manage the enforcement settings under Security > Authentication > 2-step verification.
Your organization uses Google Workspace and has a mix of full-time employees and temporary contractors. You need to ensure that contractors cannot access Google Drive from unmanaged mobile devices, while employees can. Which TWO configurations should you implement? (Choose two.)
By placing contractors in a distinct organizational unit, you can apply a specific device policy that mandates managed devices for mobile access. This policy can block access from unmanaged devices, ensuring contractors cannot use personal phones to access Drive. Employees in other OUs remain unaffected, achieving the desired granular control. This is the correct approach for segmenting access based on user type.
Why this answer
To prevent contractors from accessing Google Drive on unmanaged mobile devices while allowing employees, you should create a separate organizational unit for contractors and apply a device policy requiring managed devices. Additionally, enabling Context-Aware Access with a policy that requires company-owned or managed devices adds an extra layer of enforcement. Together, these configurations ensure that only compliant devices can access Drive for the contractor OU.
Exam trap
The trap here is assuming that 2-Step Verification or sharing restrictions alone can block unmanaged device access, when device management policies and Context-Aware Access are required.
What is the difference between a primary domain and a secondary domain?
The primary domain is the identity foundation: it forms the user's primary email address and underpins the account itself. Secondary domains are additional domains hosted in the same tenant, used for alternate addresses or aliases rather than defining the account's core identity.
Why this answer
The primary domain is the identity foundation of the Workspace account, used for initial setup and service naming.
Your organization has a policy that employees must not be able to download Google Drive files on unmanaged devices. You have already set up Context-Aware Access with an access level that requires managed devices. However, users report they can still download files from Drive on personal devices. What is the most likely reason?
Context-Aware Access can block access to Drive entirely based on device context, but it does not control the ability to download files once a user has access. If the access level allows access from unmanaged devices (e.g., only requires screen lock), users can still download files. To prevent downloads, you need to use Drive sharing settings to disable download, print, and copy for unmanaged devices, in addition to Context-Aware Access.
Why this answer
Context-Aware Access controls whether a user can access a service like Google Drive based on device context, but it does not manage what actions a user can perform once access is granted. To prevent downloads on unmanaged devices, administrators must also configure Drive sharing settings to disable download, print, and copy for users accessing from unmanaged devices. The most likely reason users can still download is that the access level permits access, and download restrictions are not separately enforced.
Exam trap
The trap here is assuming Context-Aware Access also restricts downloading, when it only gates access; download restrictions require separate Drive sharing settings.
Which THREE features or tools in Google Workspace can be used to monitor and investigate suspicious sign-in activity or security anomalies? (Choose three.)
The Investigation Tool in Security Center runs targeted queries across Gmail, Drive and user logs, letting admins trace sign-in anomalies and take remediation actions such as deleting mail or suspending accounts. It satisfies the requirement to investigate suspicious activity rather than merely view alerts.
Why this answer
Option B (Security Center > Investigation Tool) is correct because it lets admins run targeted queries across Workspace logs (e.g., login, Drive, Gmail) to investigate suspicious sign-in activity and security anomalies, and take remediation actions like deleting emails or suspending users. Option C (Alert Center) is correct because it surfaces security alerts such as suspicious login attempts, leaked passwords, and government-backed attacks, giving admins a centralized place to triage and respond to anomalies. Option E (Reporting > Audit > Log events, e.g., Login, Admin, SAML) is correct because the audit log lets admins review detailed authentication and admin events, including SAML and login activity, to trace suspicious sign-in behavior.
Option A (Drive sharing settings) is incorrect because it only controls external sharing and link visibility, not sign-in monitoring. Option D (Directory > Users > Bulk update via CSV) is incorrect because it is a user-provisioning/management feature, not a security monitoring or investigation tool.
Exam trap
GWS-ADMIN often tests whether candidates confuse configuration surfaces (Drive sharing, bulk user updates) with the three actual monitoring/investigation pillars — Alert Center, Investigation Tool, and audit logs.
A Google Workspace administrator receives reports that users in the sales department cannot access a shared drive named 'Sales Proposals'. The shared drive still appears in their Google Drive interface, but when they try to open it, they get a 'You need permission' error. The admin confirms the shared drive exists and that the sales team is a member of a Google Group that was previously added as a member of the shared drive. What is the most likely cause?
Shared drives use access levels assigned to users and groups. If the Google Group was removed from the shared drive's membership or its access level was downgraded, members of that group would lose access even though the drive still appears. The error 'You need permission' indicates the user's account no longer has an access level on the shared drive. The admin should verify the shared drive's membership in the Admin console or Drive and re-add the group with appropriate access.
Why this answer
Shared drive access is controlled by membership and access levels. When a Google Group that was a member loses its access or is removed, all group members lose access, producing a permission error. The admin should check the shared drive's membership list and restore the group's access level.
Exam trap
The trap here is assuming that a visible shared drive automatically means the user has access, when visibility can persist even after membership changes.
Which THREE of the following are valid ways to manage Google Calendar resource availability?
Auto-accept invitations let a resource calendar accept booking requests automatically, satisfying the requirement to manage availability without manual approval. The resource's access permissions determine who may book it, and acceptance occurs immediately upon invitation, keeping the calendar's free/busy data current for scheduling.
Why this answer
Resources are managed via building assignment, auto-accept rules, and visibility settings.
You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?
Account settings under the top-level Account section let an administrator set default language and region for new users, applied per organizational unit. This satisfies the stem's requirement to change defaults for all new users within a specific OU.
Why this answer
Account settings, including time zone and language, are configured per OU under Account > Account settings.
You need to distribute a specific internal Android app to a subset of users. What is the most efficient way to achieve this using Google Workspace?
Managed Google Play distributes private Android apps through the Admin console, and assigning the app to a specific organisational unit scopes availability to only those users. This avoids manual sideloading and satisfies the subset-targeting requirement efficiently.
Why this answer
Adding the app to the managed Google Play store and assigning it to specific organizational units (OUs) allows for controlled distribution.
Which THREE of the following attributes can be used in Context-Aware Access policies?
OS version is a device attribute evaluated by Context-Aware Access, letting policies grant or deny access based on the endpoint's platform version. This satisfies the stem's requirement for usable policy attributes, since device posture signals such as OS version feed directly into access-level conditions alongside other device and user context signals.
Why this answer
Context-Aware Access policies in Google Workspace evaluate device and user context signals, and OS version (A) is a supported attribute used to allow or block access based on the operating system and its version (e.g., requiring a minimum macOS or Windows build). Device encryption status (B) is also a valid attribute, letting admins require that a device's storage be encrypted before granting access to Workspace apps. Device management status (E) is supported as well, distinguishing Basic, Advanced, and Managed device states so policies can restrict access to managed devices only.
The user's favorite browser (C) is not a security-relevant context attribute and is not configurable in Context-Aware Access, and the user's physical GPS location (D) is not an available attribute — geographic restrictions rely on IP address ranges rather than GPS coordinates.
Which TWO actions can you perform in Google Vault?
Vault lets administrators search across Gmail, Drive, Meet and other services by user, date and term, then export the matching data for legal or investigative purposes. Search and export is a core Vault function the question asks for.
Why this answer
Option C (Search and export user data) is correct because Google Vault is specifically designed for eDiscovery and compliance, allowing administrators to search across Gmail, Drive, and other Google Workspace services and export the results for legal or investigative purposes. Option E (Place a hold on user data) is also correct because Vault lets you create holds on specific users or organizational units to preserve data indefinitely, even if users delete it, which is essential for litigation and compliance. Option A (Configure DLP policies) is incorrect because data loss prevention is configured in the Google Admin console (Security > Data Loss Prevention), not in Vault.
Option B (Set up 2-Step Verification) is incorrect because two-step verification is an authentication setting managed in the Admin console under Security > Authentication. Option D (Manage user passwords) is incorrect because password management is performed in the Admin console under Directory > Users, not in Vault.
Exam trap
GWS-ADMIN often tests the boundary between Vault and the rest of the Admin Console — the trap is selecting DLP, 2SV, or password management as Vault actions when those live in other admin sections.
You are a Workspace administrator for a healthcare organization. You need to ensure that nurses using company-owned iPads can only access patient records through a specific internal app, and that they cannot copy patient data into personal apps like Mail or Messages. Which Google Workspace endpoint management feature should you configure?
Advanced mobile management for iOS allows you to distribute managed apps and apply app-level policies, including restrictions on data sharing between managed and unmanaged apps. By configuring the internal app as managed and restricting data sharing, you prevent copying patient data into personal apps. This directly addresses the requirement to limit access to the specific app and block data leakage.
Why this answer
Advanced mobile management for iOS supports managed apps and per-app policies that can restrict data sharing, such as blocking copy-paste from managed to unmanaged apps. This allows the internal patient records app to be the only way to access data, while preventing leakage to personal apps. The other options are either desktop-only or Android-specific and cannot achieve this on iPads.
Exam trap
The trap here is assuming that Chrome policies or Endpoint Verification can control native iOS app behavior, when only advanced mobile management with managed app configurations can enforce those restrictions.
Your organization uses Chrome browser policies to manage extensions. You want to allow only a specific set of extensions and block all others for all users. You have created a JSON policy file and applied it to the organizational unit. However, users report that they can still install other extensions from the Chrome Web Store. What is the most likely reason?
To allow only specific extensions and block all others, you must set the ExtensionInstallBlocklist to '*' (block all) and list the allowed extensions in ExtensionInstallAllowlist. If the blocklist is not set to wildcard, users can install any extension not explicitly blocked. This is the correct configuration to enforce a strict allowlist.
Why this answer
To enforce an allowlist of extensions, you must block all extensions by setting ExtensionInstallBlocklist to '*' and then specify the allowed ones in ExtensionInstallAllowlist. This combination ensures that only listed extensions can be installed. Other policies like ExtensionAllowedTypes or ExtensionInstallForcelist do not provide a comprehensive block on unapproved extensions.
Exam trap
The trap here is assuming that force-installing allowed extensions or setting type restrictions will implicitly block others, when an explicit wildcard block is required.
Page 1 of 4
Page 2Practice GWS-ADMIN by domain
Target a specific domain to shore up weak areas.