Security Policies And Access Controls

Which TWO mechanisms can an administrator use to recover access if a Super Administrator loses their 2-Step Verification device and is locked out? (Choose two.)

A financial services company needs to enforce that all employees use a hardware security key for 2-Step Verification (2SV) and cannot use less secure methods like SMS or phone calls. Which setting in the Admin console should the administrator configure?

The security team at Acme Corp wants to block all OAuth scopes that are classified as High Risk and unverified for users under the Sales org unit. Where should the administrator configure this restriction?

An administrator is configuring a Context-Aware Access access level to protect Google Drive for a remote workforce. Which TWO conditions can be used in the access level to evaluate device trust and network origin? (Choose two.)

Your organization uses Context-Aware Access to restrict access to Google Workspace based on IP address ranges. A remote employee traveling for business is unable to access Gmail from a trusted hotel Wi-Fi. How should the administrator temporarily grant access without compromising long-term security?

A financial services company uses Google Workspace. The security team wants to ensure that when an employee's device is compromised, their active Google Workspace sessions are terminated immediately and they are required to re-authenticate with 2-Step Verification. Which action should the administrator take?

Which TWO practices are recommended when configuring organizational units (OUs) for security policy enforcement in Google Workspace? (Choose two.)

An enterprise organization is planning its 2-Step Verification (2SV) rollout. Which THREE methods or tokens are natively supported by Google Workspace for 2SV authentication? (Choose three.)

You need to enforce 2-Step Verification for a specific department while allowing others to opt-in voluntarily. Which configuration path should you use?

Which THREE features or tools in Google Workspace can be used to monitor and investigate suspicious sign-in activity or security anomalies? (Choose three.)

Your organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?

A financial services company uses Google Workspace. The security team wants to block all access to Gmail from outside the corporate network, but allow access from the office IP range 203.0.113.0/24. They also want to require a managed device for access. Which Google Workspace feature should the administrator configure to enforce these conditions?

Your company has integrated Google Workspace with a third-party IdP using SAML. You want to make sure that when users sign out of Google Workspace, they are also signed out of their IdP session. What feature should you configure?

Your company has deployed a custom internal web application that integrates with Google Workspace via SAML. During testing, users receive a '403. That’s an error. Error: app_not_configured_for_user' message. What is the most likely cause of this error?

You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?

An administrator needs to delegate the role of creating and managing Google Groups across the entire domain without giving full admin rights. Which built-in role should be assigned?

You need to create a custom administrator role that allows specific users to manage Google Meet hardware devices and review their health status, but nothing else. Which privilege category should you select when building this custom role?

An administrator wants to configure security policies to protect corporate data on mobile devices. Which THREE actions can be enforced through Google Workspace Endpoint Management? (Choose three.)

A security team wants to enforce a policy that only company-managed devices can access Gmail and Drive, while personal devices are denied. Which TWO configurations are required in Google Workspace to implement this using Context-Aware Access? (Choose two.)

Which THREE actions should you take to secure your Google Workspace environment against unauthorized admin access? (Choose three)

You need to create a custom administrator role that allows a security analyst to use the Security Center Investigation Tool, view audit logs, and manage alerts, but prevents them from modifying user passwords or organizational unit structures. Which exact set of privileges should you assign?

A company wants to prevent data exfiltration by ensuring that users can only access Google Drive from managed devices, but must allow contractors using personal devices to access Gmail. Which approach should the administrator take?

An administrator needs to review recent security alerts and proactive recommendations for improving domain security. Where should they look first in the Google Admin console?

An administrator must allow a partner organization to access a shared Drive folder, but only when the partner users sign in from their own managed devices. The partner has its own Google Workspace domain. Which configuration should the administrator use to enforce this requirement?

Your organization uses a third-party Identity Provider (IdP) for SSO. Users are reporting that they cannot sign in. Where do you verify the SAML configuration?

Your company has an external contractor who needs temporary access to Google Workspace. You want to ensure their account automatically deactivates after 30 days without manual administrative intervention. How can you achieve this securely?

A helpdesk administrator needs to reset passwords for users in the Sales organizational unit but must not be able to reset passwords for users in the Finance organizational unit. The helpdesk admin already has a custom role with the 'Users: Reset password' privilege. What should you do to restrict the role's scope to only the Sales organizational unit?

An organization wants to integrate Google Workspace with an external SAML IdP. However, some users (such as external contractors) should continue authenticating directly against Google's native login page using their Google password and 2SV. How should the administrator configure SSO to support this mixed environment?

When setting up SAML SSO with a third-party Identity Provider (IdP), which THREE pieces of information must typically be exchanged or configured in the Google Admin console? (Choose three.)

An organization wants to prevent users from signing in to their Google Workspace accounts from outside their home country. Which feature should the administrator configure?

An administrator needs to restrict access to Google Workspace apps so that users can only log in from corporate-managed Chromebooks and Windows devices enrolled in Endpoint Management, while blocking all mobile devices entirely. How should this be implemented?

An administrator needs to view a report showing which users in the organization have not enabled 2-Step Verification. Where should the administrator look in the Google Admin console?

A Google Workspace administrator needs to delegate the ability to manage user accounts and reset passwords to a helpdesk team, but must ensure they cannot access Gmail content or modify security settings. Which role should be assigned to the helpdesk team?

An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?

A healthcare organization must comply with HIPAA and wants to ensure that Google Workspace data is protected against insider threats. The security team needs to monitor and alert on suspicious user behavior, such as mass downloads of Drive files and unusual login locations. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

A Google Workspace administrator needs to allow a third-party application to access specific Google Drive files on behalf of users. The administrator wants to restrict the application so it can only access files that users explicitly share with it, and cannot access all files in the domain. Which OAuth scopes configuration should be used?

An administrator is configuring Context-Aware Access to secure corporate data. Which TWO criteria can be evaluated within a Context-Aware Access access level expression? (Choose two.)

A Google Workspace administrator wants to ensure that all users in the organization are required to use 2-Step Verification (2SV) when signing in. Where should the administrator enforce this requirement?

Which TWO reports or logs should an administrator check to verify whether Context-Aware Access rules are successfully blocking unauthorized connection attempts? (Choose two.)

Which TWO actions should an administrator take to secure administrative accounts against credential theft and unauthorized access? (Choose two.)

A Workspace administrator wants to ensure that users in the Sales org unit can only sign in from corporate-managed Chromebooks and Windows devices, and block personal devices from accessing Gmail and Drive. Which enforcement mechanism should the administrator configure?

A school district wants to prevent students from installing any third-party apps that request access to Gmail data. Administrators need to ensure that only pre-approved apps can access Gmail. Which Google Workspace setting should they configure?

Which TWO of the following are valid methods to verify domain ownership in Google Workspace? (Choose two)