Select Two (Multi-Select) Questions

Apply a data classification label to all files to prevent deletion.

Why it fails: Data classification labels can enforce sharing restrictions and DLP actions, but they do not prevent users from deleting files. Labels can be used for retention if combined with Vault, but the label itself does not block deletion. This option misrepresents the capabilities of labels.

Set up a Google Workspace Admin Console setting to disable the 'Delete' button for all users.

Why it fails: The Admin Console does not provide a setting to disable the delete button in Gmail or Drive. Users can always delete their own messages and files, but retention rules can preserve copies. This option describes a non-existent feature, so it cannot meet the requirement.

Enable 'Data Regions' for all users to store data in a specific geographic location.

Why it fails: Data Regions control where data is stored geographically, not whether users can delete it. Enabling Data Regions does not prevent deletion; it only affects data residency. The audit requirement is about retention, not location, so this setting is irrelevant.

Enabling SSO via a SAML metadata file.

Why it fails: SAML metadata enables federated single sign-on for users after the domain is verified; it does not prove control of the domain to Google. It is tempting because SAML also involves uploading a file containing domain references, but SSO configuration is an authentication feature, whereas verification requires a DNS TXT record, HTML file, or meta tag.

Sending an email to the registrar's abuse alias.

Why it fails: Emailing the registrar's abuse alias notifies a third party about misconduct; it places nothing on the domain and returns no token Google can check. It is tempting because registrars do hold authoritative WHOIS contact data, yet abuse reporting addresses complaints, not ownership verification, which needs a DNS TXT record, HTML file, or meta tag.

Creating a new admin account with the '@gmail.com' suffix.

Why it fails: A @gmail.com address cannot demonstrate control of a customer-owned domain, because Google's verification requires placing a record or file on the domain itself or using a domain-linked account. It is tempting because Google accounts are free and instant, but consumer Gmail addresses are for personal use, not domain ownership proof.

The user's computer operating system

Why it fails: The client operating system does not participate in SAML assertion exchange, so it cannot cause the signature, audience, or attribute errors that break sign-in. Troubleshooting checks the IdP configuration, certificate, and attribute mapping. It is tempting because OS-specific browser behaviour occasionally affects sessions, but that concerns local authentication, not SAML.

The user's physical location

Why it fails: A user's physical location plays no part in SAML assertion validation; errors arise from mismatched entity IDs, expired certificates, or incorrect attribute mappings between the IdP and service provider. It is tempting because geo-restrictions exist in some access policies, but those are enforced separately from the SAML protocol exchange.

Vault search

Why it fails: Vault search supports eDiscovery and legal holds over Gmail and Drive content, not compromise detection. It is tempting because searching user activity feels investigative, but it would be the correct choice for litigation or audit retrieval, whereas compromised accounts are surfaced through login audit and security alert tooling.

Group settings

Why it fails: Group settings govern membership, permissions, and delivery options, not account compromise indicators. It is tempting because group configuration sits alongside user security controls, but it would be the correct choice when managing access or mailing lists, not when identifying suspicious sign-in behaviour.

Data regions

Why it fails: Data regions control where data is stored for compliance, not account compromise detection. It is tempting because region settings appear in security-related Admin Console areas, but it would be the correct choice when configuring data residency obligations, not investigating suspicious sign-ins or compromised credentials.

The user's home network speed

Why it fails: Home network speed affects general connectivity, not the device's ability to authenticate to Google's mail servers, so it cannot explain a sync failure specific to corporate email. It is tempting because slow links do delay large mailbox downloads, and it would be worth checking when a device syncs intermittently across all apps.

The user's browser plugin list

Why it fails: Browser plugins affect webmail rendering in a browser, not the native mobile sync client that fetches corporate mail. It is tempting because plugin conflicts do break Gmail in a desktop browser, and it would be the right check when webmail misbehaves while mobile and desktop clients sync normally.

Force all files to be stored in a specific shared drive regardless of where the user creates them.

Why it fails: Google Workspace does not provide a setting that forces all user-created files into a specific shared drive. Shared drives are separate containers, and users choose where to create files. Administrators can control access to shared drives and set defaults, but they cannot redirect all file creation to one shared drive through sharing settings.

Set a maximum file size limit for uploads to Drive for the organizational unit.

Why it fails: Drive sharing settings do not include a maximum file size limit for uploads. File size limits are governed by the service itself and the user's license, not by sharing configuration. Administrators cannot set an arbitrary upload size cap per organizational unit through the sharing settings interface.

Require that all shared files be reviewed by an administrator before external sharing is allowed.

Why it fails: Google Drive does not provide a built-in approval workflow that routes external sharing requests to an administrator for review. While third-party tools or custom workflows might approximate this, the native sharing settings do not include an admin approval step. This is not a valid action in the Drive sharing settings for an organizational unit.

Require a password change every 30 days for all users.

Why it fails: Forced 30-day rotation does not prevent unauthorised admin access; it often weakens passwords through predictable increments. Admin protection requires 2-Step Verification enforcement, super admin role limitation and recovery options. Password rotation would be correct where a compliance standard explicitly mandates periodic credential expiry.

Disable all non-Google apps in the Marketplace.

Why it fails: Marketplace app restrictions govern third-party OAuth access, not admin authentication. Unauthorised admin access is mitigated by enforcing 2-Step Verification, strong admin passwords and role scoping. Disabling Marketplace apps would be correct when the requirement is limiting third-party data access or OAuth scopes.

Allow external sharing for all users

Why it fails: Allowing external sharing for all users lets anyone send files outside the organisation, directly enabling leakage. It is tempting because unrestricted external collaboration is convenient, and would be correct where the domain is trusted and no confidential data is stored.

Enable 'Allow user to set their own sharing'

Why it fails: Permitting users to set their own sharing widens distribution beyond administrator control, increasing leakage risk. It is tempting because delegated sharing reduces IT workload, and would be correct in a low-sensitivity environment where user autonomy outweighs data-loss concerns.

Disable all Drive sharing

Why it fails: Disabling all Drive sharing blocks legitimate collaboration entirely, not just leakage-prone external sharing; the stem asks for settings preventing leakage while sharing continues. It is tempting because it guarantees no sharing-based exposure, and would suit a highly classified environment where no Drive sharing is permitted at all.

The number of unread emails in the user's Gmail inbox.

Why it fails: Inbox unread counts are mailbox state, not a device, network, or user identity signal, so no Context-Aware Access access level can reference them. Gmail content filters are tempting because they govern mail handling, but access levels evaluate endpoint, IP, and identity attributes instead.

The user's local operating system password complexity and history length.

Why it fails: Context-Aware Access evaluates device, network, user and location attributes; local password complexity and history length are endpoint policy settings, not signals sent in access level expressions. It is tempting because password strength relates to authentication security, but that is enforced by device management, not Context-Aware Access.

The user's direct manager name listed in the directory schema.

Why it fails: Access level expressions evaluate device, IP, geographic and user-identity attributes; a manager's name from the directory schema is not one of the supported signals. It is tempting because directory data feeds user-based conditions, but manager relationships are organisational metadata, not a Context-Aware Access criterion.

Reset the user's billing settings

Why it fails: Billing settings are unrelated to data protection during offboarding; resetting them neither revokes access nor preserves or transfers the user's data. It is tempting because billing configuration is part of account administration, which is the correct place to adjust payment details when a user changes roles.

Grant user full email access

Why it fails: Granting full email access preserves the departing user's mailbox for continued sign-in, exposing organisational data instead of protecting it. It is tempting because temporary access delegation helps a manager monitor a mailbox during transition, which suits short absences rather than offboarding.

Delete the user account immediately

Why it fails: Immediate deletion destroys the account and its data, preventing transfer of files, mail and Drive content to a supervisor, which offboarding requires. It is tempting because rapid removal revokes access quickly, which is correct for a confirmed security incident or compromised credential.

Enable the device's GPS tracking

Why it fails: Advanced mobile management enforces configuration and security policies, not continuous location tracking; GPS activation is a user-controlled device setting, not a managed policy. It is tempting because location matters for lost-device recovery, but that is handled through device location reporting, not enforced GPS toggling.

Force an OS update

Why it fails: Advanced mobile management cannot push OS version upgrades; it can only require a minimum version and block access until the user updates. Forcing updates is tempting because patching matters for security, but that requires carrier or OEM update mechanisms, not Google endpoint policy.

Verifying the domain

Why it fails: Domain verification is completed under Domains, where a TXT or CNAME record proves ownership before any accounts can exist. It is tempting because verification must precede user provisioning, but the Users section only manages accounts, profiles and organisational units within an already-verified domain.

Configuring SMTP relays

Why it fails: SMTP relay configuration sits under Apps > Google Workspace > Gmail, since it governs outbound mail routing rather than user accounts. It is tempting because relay settings reference senders and domains, but the Users section only handles account creation, profiles, organisational units and directory data.

Creating a new domain

Why it fails: Creating a new domain is performed under Domains, not Users, since it establishes a separate namespace rather than managing accounts within an existing one. It is tempting because domain creation does involve adding users afterwards, but the Admin console separates namespace provisioning from user lifecycle management.

Enable SMS-based 2SV verification as a mandatory fallback for all admin accounts.

Why it fails: SMS codes are vulnerable to SIM swapping, interception and carrier compromise, so they do not defend administrative accounts against credential theft; phishing-resistant FIDO2 security keys or certificate-based authentication are required. It tempts because SMS 2SV is widely available, but it would be correct only for low-risk consumer accounts without stronger authenticator support.

Disable password expiration policies for all admin accounts to prevent administrative lockout.

Why it fails: Disabling password expiration removes the rotation that limits the useful life of a stolen credential, so a leaked admin password stays valid indefinitely. It is tempting because non-expiring passwords do prevent lockouts caused by forgotten rotations, which suits service accounts rather than interactive administrators.

Assign the 'Super Admin' role to all members of the IT helpdesk to ensure fast incident response.

Why it fails: Granting Super Admin to every helpdesk member removes least privilege, so any single compromised helpdesk credential yields full tenant control. It is tempting because broad rights do speed incident response, and Super Admin is appropriate for a small number of dedicated break-glass administrators only.

Configure a sign-in challenge that requires a security key for all users in the organizational unit.

Why it fails: Requiring a security key changes the authentication method but still allows any device that can present the key. A personal device with a registered security key would pass the challenge, so this does not enforce device ownership. The requirement is to deny personal devices entirely, which is a device-policy decision, not an authentication-strength decision.

Deploy a Chrome policy to force users to sign in with their managed Google Account on personal devices.

Why it fails: A Chrome policy can influence browser behavior on managed devices, but it does not prevent a user from accessing Gmail or Drive through a personal browser or mobile app. It also cannot mark a personal device as company-owned in the Workspace device inventory. This approach does not enforce the access restriction and is not a required configuration for the policy.

Enable 2-Step Verification enforcement for all users in the organizational unit.

Why it fails: 2-Step Verification strengthens authentication but does not distinguish between company-owned and personal devices. A user on a personal device could still pass 2-Step Verification and gain access. While 2SV is a good security practice, it does not satisfy the requirement of restricting access to only managed devices, so it is not a required configuration for this policy.

Use Google Vault to set retention policies that prevent data deletion.

Why it fails: Google Vault retention policies preserve data for compliance and legal holds, but they do not monitor user behavior or generate alerts on suspicious activities. Vault is for eDiscovery and archiving, not for real-time threat detection. This action does not fulfill the requirement to monitor and alert on insider threats.

Configure Data Loss Prevention (DLP) rules to block sharing of sensitive files externally.

Why it fails: DLP rules can prevent data exfiltration by blocking external sharing of sensitive content, but they do not provide monitoring or alerting on suspicious behavior like mass downloads or unusual logins. DLP is a preventive control, not a detection and alerting tool for insider threat behavior. It complements but does not replace the need for activity monitoring.

Enforce 2-Step Verification for all users to prevent unauthorized access.

Why it fails: While 2-Step Verification is a critical security measure, it does not provide monitoring or alerting on suspicious behavior such as mass downloads or unusual login locations. It prevents unauthorized access but does not detect insider threats in progress. This action is important but does not meet the specific monitoring and alerting requirements.

Install the Google Credential Provider for Windows on all company-owned devices.

Why it fails: Google Credential Provider for Windows allows users to sign in to Windows with their Google Account, but it does not collect device posture information for Context-Aware Access. It is unrelated to the requirement of enforcing access based on device encryption and OS version.

Set up a Windows device policy in the Admin console to enforce OS updates and encryption.

Why it fails: Google Workspace does not provide a Windows device policy to enforce OS updates or encryption directly. While you can view some Windows device details via Endpoint Verification, enforcement of updates and encryption must be handled by third-party tools or Microsoft Intune. Thus, this is not a required component for Context-Aware Access.

Enable advanced mobile management for Windows devices.

Why it fails: Advanced mobile management is for mobile devices (Android, iOS) and does not apply to Windows desktops. Context-Aware Access for Windows relies on Endpoint Verification, not mobile management. Enabling it would not fulfill the requirement and might be irrelevant.

Whether the users' Gmail IMAP access is disabled for the sales OU, preventing mobile mail clients from authenticating.

Why it fails: IMAP access affects mail client synchronization, not the ability to sign in to a Google Account. Users would still be able to authenticate and use web or native apps even with IMAP disabled. Since the reported problem is account sign-in failure, IMAP settings are unrelated and would not cause the observed symptom on new Android devices.

Whether the sales OU has a password policy that forces a password change on next sign-in for mobile clients only.

Why it fails: Password policies in Workspace apply to accounts, not to specific client types. There is no setting that triggers a password change only for mobile sign-ins. Since the users can authenticate from their laptops, the password is valid and not expired. This makes a mobile-only password policy an implausible explanation and an incorrect troubleshooting direction.

Whether the sales OU has a session length policy that signs users out of mobile apps every hour.

Why it fails: Session length policies control how often users must reauthenticate after being signed in; they do not prevent initial sign-in. Users would still be able to authenticate initially and then be prompted again later. This does not match a scenario where sign-in itself fails on new devices, so it is not a likely cause of the reported problem.

Map every LDAP attribute to a corresponding Workspace field to avoid missing data.

Why it fails: Mapping every attribute is unnecessary and risky because many LDAP attributes have no valid Workspace counterpart, and overly broad mappings can overwrite correct values. Selective, well-planned mapping of supported fields is the correct approach and does not by itself protect against accidental deletion of users.

Grant the sync service account the Super Admin role to avoid permission errors during synchronization.

Why it fails: Super Admin privileges are broader than GCDS requires and violate least privilege. The sync account needs only the specific API scopes and roles to read the directory and manage users and groups, so elevating it to Super Admin increases risk without improving the correctness of attribute mapping or delete handling.

Configure the sync to run continuously in real time so attribute changes propagate instantly.

Why it fails: GCDS is designed for scheduled, batched synchronization, and continuous real-time operation is not how it is intended to run. Running it more often does not address accidental deletions or attribute mapping errors and can increase load on both the LDAP source and the Workspace directory without adding protection.

Remote control of the camera shutter

Why it fails: The Admin console exposes device actions such as remote wipe, lock, and factory reset; camera shutter control is not among them, so this action cannot be performed. It is tempting because Android device management does cover hardware toggles like disabling the camera entirely, which is a different capability from shutter control.

Remote installation of a specific version of Android OS

Why it fails: Android Enterprise cannot push OS version images to devices; only OEM or carrier updates deliver Android builds, so no console action exists for this. It tempts administrators wanting fleet-wide version control, which is achievable only through managed Play Store app updates or OEM-specific tools, not OS flashing.

Remote physical battery removal

Why it fails: The Admin console can wipe, lock or ring a device, but no management API can physically detach or remove a battery from hardware. It is tempting because remote wipe and remote restart are genuine console actions, and battery removal would be correct only as a manual physical intervention on a device in hand.

Device management policies

Why it fails: Device management policies sit under Devices, not Directory, which holds users, groups, and shared contacts. It is tempting because device policies are admin-configured and appear alongside directory settings in the console, but they govern endpoint enrolment and compliance rather than the organisational directory itself.

Gmail routing rules

Why it fails: Gmail routing rules are configured under Apps > Google Workspace > Gmail, not Directory. The option tempts because routing rules reference user addresses and organisational units, which are directory objects, yet the rules themselves are mail-transport settings applied through the Gmail service configuration.