Google Cloud Associate Google Workspace Administrator (GWS-ADMIN) (GWS-ADMIN) — Questions 226–260

The 'Add user' dialog includes a domain dropdown listing every verified domain in the account, so selecting the target sub-domain creates the user there directly. This satisfies provisioning into a specific sub-domain without separate admin accounts.

Disabling download, print and copy for viewers stops recipients exfiltrating file content, even when they legitimately retain view access. This satisfies the data-leakage prevention requirement by restricting what viewers can do with shared files rather than who may open them.

PATCH applies partial updates, modifying only the phone number field while leaving other user attributes untouched. This satisfies the requirement to update phone numbers without overwriting unrelated profile data, unlike PUT, which replaces the entire resource.

After adding and verifying a secondary domain, you can create users whose primary email address uses that domain. This allows alice@subsidiary.com to sign in and receive mail under the same subscription. The secondary domain is not automatically assigned to existing users, so you must specify the subsidiary.com domain when creating each account.

Security > Authentication > 2-step verification is the console path holding enforcement settings, where you select the Sales OU and set enforcement to on. This satisfies the stem's requirement to apply 2-Step Verification to a specific organisational unit.

Security Center's investigation tool allows administrators to create activity rules based on specific events, such as Drive download counts. You can set thresholds to alert on mass downloads, which helps detect insider threats. This is a core feature for monitoring suspicious behavior and is essential for the requirement.

Suspending the account prevents sign-in while keeping the data intact, and placing a Vault hold on the user ensures the data is retained and searchable by the legal team. This combination satisfies both the access restriction and the legal preservation requirement.

DLP for Drive includes predefined detectors for credit card numbers and other sensitive data types. You can create a rule that scans files, triggers on matches, and sends an alert to the file owner. This meets the requirement for automatic detection with minimal administrative effort, as no custom classifiers or manual labeling are needed.

Data classification labels in Google Workspace allow you to apply granular sharing restrictions based on sensitivity. Setting a 'Confidential' label and configuring 'No external sharing' ensures that files with that label cannot be shared outside the organization, even via public links. This precisely meets the compliance requirement for patient data.

Checking Drive for Desktop's status and error logs first isolates whether the fault lies in the client itself — authentication, cache corruption, or a stalled sync process — before touching network or account settings. This satisfies the stem's requirement for the initial diagnostic step, since the application's own telemetry pinpoints the failing component directly.

In Google Workspace, when a mobile device attempts to access work data, it can appear as 'Pending' until an administrator approves it. Until approval, the device cannot sync work email or other data. This matches the user's symptom and the Admin console status, so the most likely reason is that the device is awaiting admin approval.

Force-installed extensions are pushed through the Chrome Enterprise policy *ExtensionInstallForcelist*, applied via a cloud-managed policy or a Windows registry/GPO setting, so they deploy to every signed-in user without user consent. This satisfies the stem's requirement for a browser setting controllable across all users.

Google Meet recordings default to the organiser's Drive, and the Admin Console offers no setting to redirect them to a shared folder. Automation therefore requires Drive API scripting or Workspace Studio workflows that move files post-recording, satisfying the requirement indirectly rather than through native configuration.

The 'https://www.googleapis.com/auth/drive.file' scope grants per-file access to files that the app creates or that the user explicitly shares with the app. This aligns with the requirement to restrict access to only files users share with the app. It does not allow access to other files in the user's Drive. This scope is designed for apps that need to work with specific files, providing a balance between functionality and security.

Profile editing under Account settings controls which user attributes, including the profile photo, users may modify themselves. Disabling it prevents self-service photo changes while administrators retain control through the Microsoft Entra ID admin centre, satisfying the requirement that users cannot change their profile photo.

A Vault hold preserves the user's data indefinitely, satisfying the seven-year retention requirement without relying on the account itself. Unlike litigation hold on a mailbox, a Vault hold applies across Gmail, Drive and Meet recordings, and survives licence removal, so data remains accessible after the account is deleted.

Suspension preserves all mailbox content, Drive files and account data while blocking authentication, satisfying the scenario's requirement that access stops without deletion. Unlike deletion, which removes data after a retention window, suspension is reversible: the account and its data remain intact, and access can be restored by reactivating the user.

Chrome Endpoint Verification checks device posture, such as encryption and screen lock, and reports it to Workspace, letting access policies require managed devices. This satisfies the stem's requirement to verify security posture before granting access to Workspace data.

Context-aware access evaluates access levels built from IP subnet conditions, so only sessions originating from the corporate office range reach the Admin Console. This satisfies the requirement to restrict administrative access by source IP address.

Data Region policies apply to data created after the policy is set; existing data is not automatically migrated. If the employee's files were created before the EU policy was applied, or if the policy does not cover the organizational unit they belong to, their data can still reside in the US region.

Geographic location is a supported access-level criterion, evaluated through IP-based country/region detection within Context-Aware Access expressions. This satisfies the stem's requirement for a valid criterion, letting administrators restrict corporate data access to approved countries, complementing device and user attributes in the same expression.

Group posting permissions default to allowing only members or owners to send messages. If the sender falls outside the group's 'Who can post' configuration, delivery is rejected. Adjusting this setting to include the user or a broader audience resolves the restriction directly.

The Admin console provides a centralized setting under Security > Authentication > 2-Step Verification where administrators can enforce 2SV for all users in an organizational unit or the entire domain. Setting enforcement to 'On' requires users to enroll in 2SV and use it for sign-in. This is the correct location to apply a domain-wide enforcement policy, ensuring all users comply with the requirement.

The security centre dashboard aggregates alerts from DLP rules, anomaly detection and device trust policies into one view, directly satisfying the stem's requirement for a summary of security incidents and potential policy violations. Unlike audit logs, which list raw events, it surfaces prioritised incidents and policy breaches for administrator triage.

Login audit log events record every authentication attempt with its outcome, including Context-Aware Access denials, so they satisfy the stem's need to verify blocked connections. Each entry shows the user, device, and access-level evaluation result, letting the administrator confirm unauthorised attempts were rejected rather than merely logged elsewhere.

Vault retention rules allow you to set a custom retention period and specify that messages are permanently deleted when the period expires. This enforces the seven-year retention and automatic deletion without user involvement, meeting the regulatory requirement precisely.

The Drive audit log records all sharing events, including external sharing, with timestamps and actor details. It shows exactly when a file was shared outside the domain and by whom. This is the correct tool because it provides the granular event data needed to pinpoint the user action and time.

Hardware security keys bind authentication to a phishing-resistant FIDO credential, so stolen passwords or relayed OTP prompts cannot complete sign-in. Restricting administrators to this method satisfies the stem's requirement to secure administrative accounts against credential theft and unauthorised access.

Context-Aware Access evaluates device attributes such as whether the device is company-owned and encrypted, so an access level scoped to managed devices will allow corporate Chromebooks and Windows endpoints while denying unmanaged personal devices. Applying it at the org unit level for Gmail and Drive enforces the restriction across the targeted apps.

App Access Control allows administrators to set global settings for third-party apps, including restricting access to Gmail. By configuring the Gmail service to 'Restricted' and specifying trusted apps, administrators can block unapproved apps from accessing Gmail data. This directly addresses the requirement to prevent students from installing apps that request Gmail access.

App access control lets admins restrict which third-party OAuth apps can access Drive data, directly satisfying the requirement to monitor potentially malicious apps. Unlike trust rules or allowlisting, it evaluates each app's requested scopes and can block risky access, giving the visibility and control needed over third-party Drive access.

The Wipe device command remotely erases all data from the managed Android device, protecting company information even though the hardware is unrecoverable. It satisfies the stem's security requirement more effectively than blocking sign-in, which leaves locally cached data exposed.

Migrating the user to the primary domain changes their primary address, so the former secondary-domain address is retained as an alias. Mail sent to the old address still reaches the same mailbox, preserving continuity and preventing lost messages during the transition.

The error 'Your account is not allowed to sign in from this device' typically appears when a device policy in the Admin console restricts sign-in to managed devices or specific platforms. The admin should check the organizational unit's device settings under Security > Access and data control > Device management, or Context-Aware Access policies. These policies can block unmanaged devices or require device approval. Adjusting the policy or enrolling the device would resolve the issue.

Publishing a TXT or CNAME record in the domain's DNS zone proves control because only the domain owner can edit that zone. Google Workspace queries the record directly, satisfying verification without website or server access, and it supports domains with no web presence.