28 questions · Data Governance And Compliance topic · All types, answers revealed
How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?
Vault retention rules preserve data regardless of user deletion actions.
Why this answer
A Vault retention rule for Gmail with a 3-year duration ensures all emails are preserved for that period, overriding user deletion.
Which THREE security settings are commonly configured using Context-Aware Access?
Ensures the device meets security standards.
Why this answer
Context-aware access allows restricting access to apps based on device security posture, IP, and location.
You want to prevent sensitive Drive documents from being printed. Which setting is appropriate?
This setting explicitly disables download, print, and copy for shared files.
Why this answer
Drive sharing settings include an option to disable downloading, printing, and copying for viewers and commenters.
Which TWO actions can you take when a user account is under a Vault hold?
This is the core purpose of a hold.
Why this answer
A hold ensures the data is not deleted, even if the user attempts to delete it or if the account is suspended/deleted.
Your legal team requires that all emails from a specific user be preserved for an upcoming audit. Which tool should you use to ensure these messages are not deleted?
Vault allows administrators to set retention rules and holds to preserve data for legal purposes.
Why this answer
Google Vault is designed for eDiscovery and retention. Setting a retention rule or hold in Vault ensures data is preserved regardless of user actions.
You need to ensure that credit card numbers are not sent via Gmail by your employees. Which tool should you configure?
DLP rules scan for sensitive patterns and block or alert based on policy.
Why this answer
DLP rules in Google Workspace allow administrators to define content detectors to scan for sensitive information like credit card numbers.
Which TWO actions can you perform in Google Vault?
Search and export are core Vault functions.
Why this answer
Vault allows you to place holds on data to prevent deletion and perform searches across user mail and files for eDiscovery.
Which THREE types of data can be managed using Vault retention rules?
Supported for retention.
Why this answer
Vault supports retention for Gmail, Drive, Chat, Groups, and Voice data.
You need to verify if an email was sent to an external address. Where can you see this in the Admin Console?
This tool shows the journey and delivery status of emails.
Why this answer
The Email Log Search tool in the Admin Console allows administrators to trace email delivery and identify recipients.
Which THREE features are part of the Security Center?
Shows best practices and configuration recommendations.
Why this answer
The Security Center provides tools for proactive security, incident investigation, and reporting on security metrics.
You have a Data Region policy configured for the US. A user moves from the US to the EU. How do you trigger the migration of their existing data to the EU?
Moving the user to an OU associated with the EU data region triggers the automated migration process.
Why this answer
Google Workspace automatically migrates data to the new region once the user's organizational unit (OU) is updated to a region mapped to the new location.
Which Google Workspace service should you use to search and export user data for legal requests?
Vault is built for eDiscovery, search, and export.
Why this answer
Vault is the primary tool for eDiscovery and legal data requests in Google Workspace.
You need to prevent users from sharing sensitive files outside the organization. Which setting should you modify?
You can restrict external sharing at the organizational unit level.
Why this answer
Drive sharing settings allow administrators to restrict sharing to internal users or specific whitelisted domains.
You need to create a report showing which users have been affected by a specific DLP policy violation in the last month. Where can you find this?
You can filter logs by DLP rule name or event type.
Why this answer
The Security Center investigation tool allows for queries specifically filtered by DLP rule violations.
Which TWO actions should be taken when offboarding a user to protect organizational data?
Prevents further access.
Why this answer
Suspending access and ensuring data is preserved or transferred are critical offboarding steps.
You need to ensure that Google Chat messages are retained for 5 years. How do you do this?
Vault provides explicit support for Chat retention.
Why this answer
Vault supports retention rules for Google Chat, which can be configured for a specific time period.
Which THREE criteria can you use to build a DLP rule in Google Workspace?
Useful for finding organization-specific sensitive patterns.
Why this answer
DLP rules can be based on predefined content detectors, custom regex, and document metadata like labels.
You need to investigate a potential data breach where a user downloaded a large number of sensitive files. Which tool provides the most granular audit logs for Drive file downloads?
This tool provides detailed event logs including 'download' actions.
Why this answer
The Investigation tool within the Security Center provides the most granular logs for file-level activities, including downloads.
An employee is suspected of leaking data. You need to search their past Gmail and Drive files for specific terms. Which tool do you use?
Vault search is designed to find specific content within user data.
Why this answer
Vault allows for full-text search across Gmail, Drive, and other services to support eDiscovery investigations.
Where do you go in the Admin Console to view the current data region for your organization?
This is the correct path for viewing and managing data region policies.
Why this answer
The 'Account settings' section under 'Account' contains the data regions configuration.
When a user leaves the company, which status should you set their account to if you want to keep their data but stop them from logging in?
Suspension removes access while maintaining the account and data.
Why this answer
Suspending a user account prevents access but keeps the account and data intact for admins to access or migrate.
Which TWO tools in the Admin Console help you identify potentially compromised accounts?
Shows alerts for suspicious login events.
Why this answer
The Security dashboard and the Investigation tool are the primary means of identifying suspicious activity in user accounts.
You have a Data Region policy, but a user is still showing data in the global region. What is the most likely cause?
Migration is driven by the OU's mapped location.
Why this answer
Data region policies require the user's OU to be updated to match the intended region. If the OU is not updated, the migration process does not begin.
Which TWO settings in Drive sharing can help prevent data leakage?
This protects document content from unauthorized distribution.
Why this answer
Restricting sharing to the organization and preventing viewers from downloading files are effective ways to protect data.
A user is leaving the company. You need to keep their data for 7 years. What is the best practice?
A Vault hold preserves all data for the user account for as long as the hold is active.
Why this answer
Placing a legal hold in Vault ensures all of a user's data is preserved indefinitely or until the hold is removed, which is appropriate for offboarding.
You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?
You can create an access level based on IP and assign it to the Admin Console.
Why this answer
Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.
Which dashboard provides a summary of security incidents and potential policy violations?
This dashboard provides alerts and reports on security events.
Why this answer
The Security Center dashboard provides an overview of security-related events and policy violations across the workspace.
You need to monitor for potentially malicious third-party apps accessing Drive data. Which feature should you use?
This allows you to whitelist or block apps based on their requested access levels.
Why this answer
App access control allows admins to review and restrict third-party apps that have OAuth scopes to access Drive files.
Ready to test yourself?
Try a timed practice session using only Data Governance And Compliance questions.