CCNA Core Workspace Services Questions

Sharing settings under Apps > Google Workspace > Drive and Docs control external sharing at the organisational unit level, letting you restrict files from being shared outside the domain. This directly satisfies the requirement to block external sharing.

External sharing controls in Google Drive let admins block or permit sharing with recipients lacking Google accounts, directly satisfying the stem's constraint that only two listed items are restrictable. This setting governs whether files can be sent to non-Google email addresses, so disabling it prevents external recipients from accessing content entirely.

The Security Investigation Tool runs domain-wide queries over Drive logs, letting admins search sharing events and external visibility across all users. This satisfies the requirement to see files shared externally across the entire domain, unlike per-file or per-user sharing reports.

DMARC is configured by publishing a TXT record at the _dmarc subdomain of your domain. The policy instructs receiving servers how to handle messages that fail SPF and DKIM alignment. This is the standard and required step to complete DMARC setup.

Content compliance is one of the configurable Gmail Compliance settings, letting admins scan message bodies and attachments against expressions and take actions such as quarantine or reject. This satisfies the stem's requirement to name three settings found in that section.

Restricting external sharing in the Admin console sets the default sharing visibility for external domains, blocking users from publishing Drive files outside the organisation. This directly enforces the access restriction the question requires at the domain-sharing policy level.

By placing contractors in a distinct organizational unit, you can apply a specific device policy that mandates managed devices for mobile access. This policy can block access from unmanaged devices, ensuring contractors cannot use personal phones to access Drive. Employees in other OUs remain unaffected, achieving the desired granular control. This is the correct approach for segmenting access based on user type.

Context-Aware Access can block access to Drive entirely based on device context, but it does not control the ability to download files once a user has access. If the access level allows access from unmanaged devices (e.g., only requires screen lock), users can still download files. To prevent downloads, you need to use Drive sharing settings to disable download, print, and copy for unmanaged devices, in addition to Context-Aware Access.

Auto-accept invitations let a resource calendar accept booking requests automatically, satisfying the requirement to manage availability without manual approval. The resource's access permissions determine who may book it, and acceptance occurs immediately upon invitation, keeping the calendar's free/busy data current for scheduling.

Account settings under the top-level Account section let an administrator set default language and region for new users, applied per organizational unit. This satisfies the stem's requirement to change defaults for all new users within a specific OU.

Directory settings govern what profile fields users may edit themselves, such as name, photo, and phone number. This is configured per OU or group, directly satisfying the stem's requirement for items manageable through the Directory section.

The Admin console exposes each user's 2-Step Verification status under Directory > Users > [User] > Security, where enrolment state and enforcement details are shown. This path satisfies the stem's requirement to view enrolment status directly, without relying on reports or audit logs.

The Security Investigation Tool queries the same Drive log events but supports custom filters, nested conditions and bulk actions such as deleting or restricting sharing, letting an admin audit access and remediate in one place rather than only viewing raw entries.

The Data Migration Service is designed to migrate email, calendar, and contacts from various sources, including Microsoft Exchange, into Google Workspace. It supports calendar migration, preserving recurring events and resource bookings, and runs server-side, minimizing user intervention. This aligns perfectly with the scenario's requirements.

The User accounts report lists each account's last login timestamp, letting you filter or sort for anyone inactive beyond 30 days. It directly satisfies the stem's requirement to identify dormant users from the Admin console's reporting section.

Context-Aware Access lets you define access levels based on device attributes, such as whether the device is encrypted, has a screen lock, or is managed. If a user can access Drive from a laptop but not from a mobile device, a context-aware access level applied to Drive that requires certain device conditions is the likely cause. Checking this section is the correct first step.

Shared drives are owned by the organization, not by individual users. By enforcing that files are created in a shared drive, you ensure organizational ownership. You can configure policies to restrict file creation to shared drives only. This meets the requirement that files remain owned by the organization even if the user leaves. This is the correct approach.

Chrome user policies allow administrators to enforce browser settings for users signed in to Chrome with their managed Google Account. You can set policies to block third-party cookies and prevent users from changing the setting. This is the correct location to enforce such a policy across the organization.

The Admin console provides a user accounts report that includes last login information. An administrator can filter by organizational unit and sort or filter by last login date to identify users who have not signed in within 30 days. This directly answers the manager's question and is the appropriate administrative action.

DKIM adds a digital signature to outgoing messages, allowing receiving servers to verify the message was sent by your domain and not altered in transit. Enabling DKIM in the Admin console and publishing the public key in DNS is the correct way to digitally sign all external email for your domain, satisfying the compliance requirement for verifiable authenticity.

Google Calendar keeps deleted events in a trash for each calendar, and users can restore them from the calendar settings under the specific calendar's trash. Since the event was on a secondary calendar the user owns, they can open that calendar's settings and restore the event from its trash. This is the correct recovery path for deleted Calendar events.

Configuring the Gmail routing setting under Apps > Google Workspace > Gmail > Routing lets you add a third-party gateway as an outbound relay, satisfying the requirement that all outgoing mail be scanned. The Default routing rule directs messages to the specified host, so every sent message passes through the gateway before delivery.

Domain-wide delegation authorises a service account to impersonate users and call Gmail APIs, and its OAuth scopes are configured in the Admin console under Security > Access and data control > API controls. This satisfies the requirement for where scopes must be provided.

Google Vault is designed for eDiscovery and archiving. You can create a Vault retention rule that applies to messages sent to or received from a specific external domain, ensuring they are retained even if users delete them. Additionally, you can place a hold on specific users or organizational units to preserve messages indefinitely. This meets the legal department's requirement.

The Authenticate email setting under Gmail in the Admin console is where you generate and manage the DKIM key for your domain. DKIM signing is a core part of email authentication and helps external recipients verify that messages are legitimate. This is the correct location to review and manage DKIM, which is a key component of the domain's authentication configuration.

The sharing settings for an organizational unit include options to restrict external sharing, such as turning off sharing outside the organization. This directly addresses the need to control how files are shared beyond the company. It is a core Drive sharing control that administrators can apply per organizational unit to reduce data leakage risk.

Google Meet recordings default to the organiser's Drive, and the Admin Console offers no setting to redirect them to a shared folder. Automation therefore requires Drive API scripting or Workspace Studio workflows that move files post-recording, satisfying the requirement indirectly rather than through native configuration.

Profile editing under Account settings controls which user attributes, including the profile photo, users may modify themselves. Disabling it prevents self-service photo changes while administrators retain control through the Microsoft Entra ID admin centre, satisfying the requirement that users cannot change their profile photo.