Google Cloud Associate Google Workspace Administrator (GWS-ADMIN) (GWS-ADMIN) — Questions 151–225

GCDS syncs only directory objects matching its configured LDAP query, so a malformed or over-narrow filter excludes users from the sync scope entirely. Correcting the query restores the expected object set, directly resolving the sync failure described.

Google Workspace requires an OU to contain no users or child OUs before deletion, preventing orphaned accounts. You must first move or delete all contained objects, so the delete operation is blocked until the OU is genuinely empty.

Gmail Audit logs record transport rule evaluation and message routing decisions, revealing whether the rule matched, was bypassed, or errored. Checking them first confirms the rule's actual behaviour against live mail flow, isolating configuration faults before altering the rule itself.

SMTP code 550 5.1.1 signals a permanent failure because the recipient address does not exist on the destination server. This directly satisfies the scenario: the mailing list address is invalid, so Google's outbound server rejects delivery rather than retrying.

The Admin console's Restore User tool recovers accounts deleted within the 20-day retention window, satisfying the 10-day constraint. Restoration reinstates the account with its prior data and group memberships, unlike recreating it manually. This is the native Google Workspace recovery path for recently deleted users.

DKIM adds a digital signature to outgoing messages, allowing receiving servers to verify the message was sent by your domain and not altered in transit. Enabling DKIM in the Admin console and publishing the public key in DNS is the correct way to digitally sign all external email for your domain, satisfying the compliance requirement for verifiable authenticity.

The mobile management audit log records each wipe command and its outcome, showing whether the device acknowledged and completed the wipe or the command failed. Reviewing it verifies what actually happened after the wipe was issued.

Auto-update settings sit under Device settings, letting administrators control ChromeOS version rollout and pin devices to a specific release. This satisfies the stem's requirement for a configurable option in that section, distinct from user-level or network-level policies found elsewhere in the Admin console.

Security > Authentication > SSO with third-party IdP is where SAML federation settings for an external IdP are configured and verified. It holds the entity ID, ACS URL, certificate and attribute mappings that Microsoft Entra ID exchanges with the third-party IdP, so a broken sign-in is diagnosed there.

The Drive audit log in the Admin Console records events such as sharing changes and downloads, including the actor and target file. Filtering by user and event type provides a chronological record of external sharing and download activity, which is direct evidence for the investigation.

Google Vault is the tool for legal holds. Creating a matter and placing holds on the user's Gmail and Drive ensures their data is preserved indefinitely until the hold is removed. This is the standard procedure for legal holds.

The security centre investigation tool surfaces per-file Drive audit events, including the specific user, timestamp, file ID and download action, satisfying the need for granular download-level detail. Unlike aggregated usage reports or alert-only dashboards, it exposes individual access records, letting you trace exactly which sensitive files the user downloaded.

A 'Blocked' status means the device was denied access under mobile management rules. Approving it in the device list restores the trust state, allowing the device to sync work email and satisfy the user's access requirement.

The Admin console's bulk upload feature allows you to update user profiles, including standard fields like Department and Manager, using a CSV file. It is designed for bulk operations and minimizes manual effort. You can download a template, populate it with the HR data, and upload it to apply changes across all users.

The Admin SDK Directory API allows programmatic access to user data, including the 'recoveryEmail' field. By writing a script to list all users and check for the absence of a recovery email, administrators can efficiently generate a compliance report. This method is scalable and can be automated, making it the most efficient way to monitor the policy.

Resetting the password and revoking sessions immediately halts the attacker's access, since a compromised account sending spam requires the intruder to be evicted first. Signing out all sessions invalidates existing refresh tokens in Microsoft Entra ID, preventing the attacker from re-establishing access with the old credentials.

The bulk user management tool accepts a CSV upload and applies the chosen action across all listed accounts, including suspending them. Suspension is one of the supported operations, satisfying the stem's requirement for a valid bulk action.

The Security Investigation Tool queries message metadata across Gmail, letting you trace delivery, search for the missing message by sender, recipient or subject, and confirm whether it was quarantined, blocked or routed elsewhere. This directly satisfies the stem's requirement to track a reported missing email through its full delivery path.

Context-Aware Access access levels can require device trust, screen lock, or OS version compliance. If the sales OU has an access level that the new Android devices do not satisfy, sign-in is denied even with correct credentials. Reviewing the assigned access level and the device compliance signals for those devices is a direct way to find why laptop sign-in works but mobile sign-in fails.

Vault matter search satisfies the retrospective investigation requirement by querying indexed Gmail messages and Drive files across the employee's entire mailbox and drive history, including deleted items still within retention. Unlike eDiscovery holds or audit logs, it searches content directly, letting you locate specific terms without altering the user's data.

Custom roles let you grant a narrow privilege set and bind it to a specific organisational unit, which is precisely the least-privilege model required. Assigning the role at the department OU limits each team lead to resetting passwords only for users inside that OU, without exposing any other administrative capability.

Cloud Identity Premium's automated lifecycle management, or the Admin SDK API, enforces time-bound access by suspending the contractor account on a scheduled date, satisfying the 30-day automatic deactivation constraint without manual intervention. This removes standing access risk while retaining auditability, unlike manual reminders or shared credentials.

Google Calendar keeps deleted events in a trash for each calendar, and users can restore them from the calendar settings under the specific calendar's trash. Since the event was on a secondary calendar the user owns, they can open that calendar's settings and restore the event from its trash. This is the correct recovery path for deleted Calendar events.

Custom attributes are defined under Directory > Users > Manage custom attributes in the Admin console, where schemas and fields are created. This satisfies the stem's requirement to add a custom attribute to user profiles.

Custom roles with privileges like 'Users: Reset password' can be assigned at the organizational unit level. By assigning the role to the helpdesk admin only for the Sales organizational unit, the admin can reset passwords for users in Sales but not for users in Finance or other OUs. This is the correct way to scope administrative privileges to a subset of users.

The Admin console provides a straightforward workflow to add a user manually, including specifying the OU and assigning a license during creation. This ensures the user is placed correctly and has the necessary services from the beginning, matching the requirement.

Selective assignment lets the SAML SSO profile apply only to chosen organisational units or access groups, so contractors remain on Deactivated SSO and authenticate against Google's native login with their password and 2SV, satisfying the mixed-environment requirement.

Forced re-enrollment binds a wiped device back to your domain by checking its identifier against the enrollment record during initial setup, so a factory reset cannot shed management. This directly satisfies the stem's requirement that the restriction be enforceable through ChromeOS device settings, without relying on user compliance.

The IdP's Entity ID, also called the Issuer, identifies the identity provider in SAML assertions and must be entered in the Google Admin console so Google can validate the issuer field. Without it, Google cannot confirm which IdP signed the response.

Google Workspace allows creating custom roles with specific privileges and scoping them to an organizational unit. Assigning the Users > Reset Password privilege scoped to Support grants exactly the needed capability without broader access. This follows least privilege and meets the requirement precisely, making it the correct choice for this scenario.

Data regions are applied at the organizational unit level. By placing German users in a dedicated OU and assigning the EU data region, you ensure their covered data is stored in the EU. This is the primary method to enforce data residency.

Context-Aware Access evaluates conditions such as geographical location before granting access, so an access level can deny sign-ins originating outside the home country. This directly satisfies the requirement to block authentication attempts from foreign locations.

Email Log Search provides detailed delivery status, including rejection reasons. Since the emails are not in spam, they might be rejected by Google's servers due to DMARC failures or other policies. Checking the logs will reveal if the messages are being blocked and why. This is the most direct way to diagnose why the emails are not being delivered.

The data region setting lives under Account > Account settings > Data regions, showing which geographic region stores your organisation's covered data. Navigating there is how an administrator verifies the current data region, matching the question's location requirement.

Organizational units exist as directory objects the moment you save them in the Admin console, independent of membership. Because the OU path is persisted immediately, dynamic group rules, device policies, and access policies can reference it before anyone is moved in, and users who are later moved in automatically inherit the applied settings.

Android work profiles are fully managed by the Admin console, so an administrator can wipe just the work profile and its corporate data without touching the user's personal apps or files — satisfying the requirement to act remotely on a personally owned, BYOD-enrolled device.

Users whose primary email address is in a secondary domain appear in the Global Directory under that secondary domain. Because example.net remains a secondary domain in the same account, setting primary addresses there produces the desired listing without changing the account's primary domain or disrupting users whose addresses remain in example.com.

In SAML SSO, the IdP is responsible for authenticating users. To redirect users to the correct login page based on their email domain, the IdP can use the 'domain_hint' parameter or a discovery service like the SAML Discovery Service. This is configured on the IdP side, not in Google Workspace. The administrator should work with the IdP to set this up, ensuring users are routed to the correct authentication endpoint.

Assigning a user to a group is available directly within the Users section, satisfying the stem's requirement for tasks performed there. Group membership changes are made from the user's detail page, which lists the groups the account belongs to and allows additions or removals without navigating to the separate Groups section.

Messages delivered to the mailbox but not visible in the inbox are often filtered by user-created Gmail filters or blocked senders. The admin should impersonate or ask the user to check Settings > Filters and Blocked Addresses for rules that archive, delete, or mark as spam messages from notifications@crmvendor.com. This aligns with the message trace showing successful delivery to the mailbox, indicating the issue is post-delivery.

QR code scanning enrols Android devices by provisioning a work profile or device owner configuration without factory reset, satisfying the stem's enrolment requirement. During setup, the device scans the code to download management credentials and register with Microsoft Entra ID, enabling bulk, touchless onboarding of corporate-owned or personally-owned Android hardware.

Configuring the Gmail routing setting under Apps > Google Workspace > Gmail > Routing lets you add a third-party gateway as an outbound relay, satisfying the requirement that all outgoing mail be scanned. The Default routing rule directs messages to the specified host, so every sent message passes through the gateway before delivery.

Domain-wide delegation authorises a service account to impersonate users and call Gmail APIs, and its OAuth scopes are configured in the Admin console under Security > Access and data control > API controls. This satisfies the requirement for where scopes must be provided.

The first step is to investigate the source of the failed attempts. By checking the login audit logs, the administrator can identify the IP addresses and determine if they are malicious. This information can then be used to block those IPs or take other mitigation steps. Understanding the attack is crucial before applying a fix. This is the most direct and informative first action.

Creating the user in the Admin console and assigning a Google Workspace licence provisions the account and grants access to services. This single action satisfies the minimum requirement, since an unlicensed user cannot access Workspace core services.

Endpoint Verification requires the extension to be installed and enabled in Chrome. If it is missing or disabled, the device will not report its status to the Admin console, so it won't appear in the device list. This is the most common cause when the user is already signed in to Chrome with their managed account but the device is not showing up.

Setting the extension to 'Force installed' ensures it is automatically installed and cannot be disabled or removed by users. This enforces the presence of Endpoint Verification for Context-Aware Access. It is the correct policy to prevent tampering.

A Gmail DLP rule can detect predefined or custom patterns such as patient identifiers in message bodies. Setting the action to quarantine holds the message for review by an admin or designated reviewer, which matches the requirement without building complex routing logic.

External sharing in Google Drive is governed at the organisational unit level, so a policy disabling outside sharing for that user's OU would block the attempt regardless of file ownership. Reviewing Drive sharing policies in the Admin console directly tests the constraint causing the reported failure.

The Device Management dashboard in Microsoft Entra ID surfaces per-device policy compliance state, letting you confirm whether the mobile app's access is blocked by a failed or unapplied device policy. This directly satisfies the stem's requirement to check device policy status for the managed device.

Google Cloud Directory Sync connects directly to on-premises Active Directory via LDAP and provisions users into Google Workspace, satisfying the requirement to sync local AD accounts. It maps AD attributes to Workspace fields and runs scheduled synchronisations, unlike Microsoft Entra ID, which targets Microsoft 365 rather than Google's directory.

A work profile creates a separate, managed container on the device, isolating work apps and data from the personal side. This satisfies the scenario's aim by letting IT control work resources without accessing or wiping personal content on the same device.

Context-Aware Access access levels can include device conditions such as 'Verified' which checks that the Endpoint Verification extension is installed, the device is synced, and meets other criteria. Applying this access level to Google Drive enforces the requirement. This is the correct way to restrict access based on device posture.

Suspending the account blocks sign-in immediately while retaining the mailbox, Drive files and other data, and it can be reversed. This matches the stem's constraint of stopping access without deleting data, unlike deletion or archiving.

The Security dashboard aggregates security alerts and highlights suspicious sign-in activity, surfacing potentially compromised accounts through anomaly detection. It satisfies the stem's requirement to identify compromised accounts by correlating risk signals such as unusual login locations and failed authentication patterns, presenting them for administrator review within the Admin Console.

Context-Aware Access evaluates access levels built from device policy compliance and operating system conditions, so an access level restricted to compliant desktop operating systems blocks mobile devices entirely while permitting enrolled Chromebooks and Windows machines. This satisfies both the managed-device and no-mobile constraints in one policy.

Google Vault is designed for eDiscovery and archiving. You can create a Vault retention rule that applies to messages sent to or received from a specific external domain, ensuring they are retained even if users delete them. Additionally, you can place a hold on specific users or organizational units to preserve messages indefinitely. This meets the legal department's requirement.

Access levels define the conditions (e.g., device owned by company, encrypted) that must be met for access. You must create an access level and assign it to Gmail in the Admin console to enforce the policy. This is the core of Context-Aware Access.

Endpoint Verification reports disk encryption status, and Context-Aware Access can evaluate it. Creating an access level that requires the device to be encrypted will block access from unencrypted devices. This is the correct condition to meet the requirement.

Calendar sharing permissions directly govern whether a shared calendar appears for the user, so verifying the grant on the calendar's sharing settings resolves the visibility failure. This satisfies the stem's constraint: the user cannot see the calendar, which sharing permissions control. Confirm the user holds at least Reviewer or higher, since insufficient rights hide it.

The 2-Step Verification adoption report under Reporting > Reports > Security lists enrolment status per user, directly identifying accounts without 2SV enabled. This satisfies the requirement to audit organisation-wide adoption without inspecting each user individually.

The 5.7.1 SMTP code signals a message rejected due to a policy, permission, or security decision rather than a missing address or full mailbox. In Gmail, content compliance rules, attachment compliance rules, blocked sender lists, or DLP policies that reject matching mail all surface as 5.7.1 in Email Log Search, which matches this scenario exactly.

The Authenticate email setting under Gmail in the Admin console is where you generate and manage the DKIM key for your domain. DKIM signing is a core part of email authentication and helps external recipients verify that messages are legitimate. This is the correct location to review and manage DKIM, which is a key component of the domain's authentication configuration.

The 'Wipe device' action performs a full factory reset, erasing all data including personal data. This is the correct action for a lost company-owned device where data security is paramount. It ensures that no corporate or personal data remains on the device.

Incorrect MX records directly break inbound routing: sending servers query DNS for the domain's MX and deliver to whatever host is published. If those records are missing, malformed, or point to the wrong server, external mail never reaches the Gmail mailbox, satisfying the stem's "not receiving external mail" constraint.

Suspending the account immediately blocks sign-in and stops new mail delivery, but the mailbox, Drive files, and calendar data remain intact and can be restored or migrated later. This matches the retention requirement exactly, and the user still counts against your licence until you delete it or assign a Cloud Identity Free licence.

A 550 5.7.1 rejection typically indicates the receiving server refused the message due to authentication failure. If the sending domain's SPF, DKIM, or DMARC alignment fails, the recipient's policy rejects it, satisfying the scenario of bounces to one external domain.

Endpoint Verification collects many attributes, but the company-owned attribute is only available for devices managed by Windows device management (e.g., via GCPW or third-party UEM integration). If the Windows devices are not enrolled in a management system that reports ownership, the attribute is absent, and Context-Aware Access may fail open or treat the device as not company-owned, depending on the access level configuration. This explains why personal Windows devices can still access.

Resetting a password for one user requires the per-user credential control found under Directory > Users. Selecting the individual account exposes Reset password, which invalidates the existing credential and forces a change at next sign-in, satisfying the single-user constraint rather than a bulk organisational reset.

The sharing settings for an organizational unit include options to restrict external sharing, such as turning off sharing outside the organization. This directly addresses the need to control how files are shared beyond the company. It is a core Drive sharing control that administrators can apply per organizational unit to reduce data leakage risk.

Suspension status is a writable boolean on the Directory API user resource, letting administrators suspend and restore accounts programmatically. This satisfies the stem's requirement for a genuine user-resource aspect, since the field is exposed directly through the resource's schema rather than through a separate endpoint or Microsoft Entra ID sign-in policy.

Data region policies apply through OU membership mapped to a region. If the user's OU lacks that mapping, the account defaults to the global region, explaining why data still appears there despite the policy existing.

Similar to Gmail, Vault retention rules for Drive prevent users from permanently deleting files by retaining them in Vault. This ensures that files are preserved for the required period, satisfying the compliance need to prevent data loss.

Context-Aware Access can evaluate device ownership and OS. By creating an access level that requires company-owned Windows devices and assigning it to the apps, you block non-corporate Windows sign-ins while leaving other platforms unaffected. This is the intended way to enforce device trust for Windows endpoints in Google Workspace.

The User Management Admin role allows managing users, including creating, editing, and deleting users, as well as resetting passwords. It does not grant access to Gmail content or security settings. This role is designed for helpdesk staff who need to handle user account tasks without broader privileges.