CCNA Endpoint Management Questions

A rooted Android device is considered compromised because root access bypasses security controls. Google Mobile Management detects rooting and marks the device as compromised, which can block access to Workspace data. This is the most likely cause and explains why the device cannot receive work emails.

The Endpoint Verification extension reports device attributes such as screen lock, encryption, OS version and disk status to Google, which context-aware access then evaluates against access levels. It satisfies the stem's requirement by supplying device trust signals for policy decisions.

Advanced mobile management for iOS supports the separation of work and personal data through managed accounts and apps. It allows admins to wipe only corporate data (e.g., managed apps and accounts) without erasing personal content. This meets the requirement of securing corporate data while preserving personal data on BYOD devices. It also provides more granular policies and reporting.

The Devices > Mobile & endpoints > Devices page in the Admin console lists enrolled computers, phones and tablets accessing organisational data. This is the central inventory satisfying the need to view all devices currently touching your organisation's data.

Enabling advanced mobile management for iOS triggers automatic enrollment when a user adds a managed Google Workspace account to the native iOS Mail app. This applies passcode and encryption policies without requiring a separate agent. It is the correct step to enforce security on personal iOS devices accessing corporate email.

Managed application deployment is enforced through managed Google Play, letting admins push and configure apps silently on Android devices. This satisfies the stem's Advanced mobile management requirement, which extends beyond basic device restrictions to application-level control, including per-app VPN and managed configurations unavailable under basic management.

Advanced mobile management for iOS enforces passcode and encryption requirements when accessing Google apps like Gmail through the Gmail app. However, if users access Gmail via a mobile web browser (e.g., Safari or Chrome), these device-level policies are not enforced because the browser is not a managed app. This allows users to bypass the passcode requirement. To prevent this, administrators can disable mobile web access or enforce policies through other means.

In advanced mobile management, the 'Wipe corporate data' action removes only the managed Google Workspace data and accounts from the device, leaving personal apps and data intact. This is exactly what is needed to secure corporate information without affecting the user's personal content. It is available for Android devices enrolled in advanced management.

Access Levels in Context-Aware Access evaluate device signals, including disk encryption state, before granting access. Binding an access level requiring encrypted devices to the Google Drive application ensures only compliant endpoints reach it, satisfying the disk-encryption constraint.

Password settings under Android within Mobile & endpoints define screen lock requirements, including lock type and timeout, applied to enrolled corporate-owned devices. This satisfies the requirement that all corporate-owned Android devices enforce a screen lock.

The security patch level attribute is only available for Android devices enrolled in Advanced mobile management. If devices are in Basic mobile management, this attribute is not collected, so the access level cannot evaluate it. In that case, the access level may treat the attribute as missing and allow access, depending on configuration. Thus, devices with outdated patches might still access if not in Advanced management.

Advanced mobile management pushes configuration profiles to iOS devices, including Wi-Fi settings and certificates. This exceeds basic management, which only enforces screen lock and wipe, satisfying the requirement to distribute network credentials and identity certificates.

Endpoint Verification is the component that collects device attributes such as OS version, disk encryption, and screen lock status, and reports them to Google Workspace. These attributes are then used by Context-Aware Access to evaluate device-based access levels. Without it, the admin console cannot assess device security posture for Windows devices.

Endpoint Verification collects device attributes such as ownership, disk encryption status, and screen lock, and reports them to Google Workspace. These attributes are then used in Context-Aware Access policies to allow or deny access based on device state. Without Endpoint Verification, the admin console cannot evaluate device security posture for access decisions, even if devices are enrolled in Windows management.

Managed Google Play distributes private Android apps through the Admin console, and assigning the app to a specific organisational unit scopes availability to only those users. This avoids manual sideloading and satisfies the subset-targeting requirement efficiently.

OS version is a device attribute evaluated by Context-Aware Access, letting policies grant or deny access based on the endpoint's platform version. This satisfies the stem's requirement for usable policy attributes, since device posture signals such as OS version feed directly into access-level conditions alongside other device and user context signals.

Advanced mobile management for iOS allows you to distribute managed apps and apply app-level policies, including restrictions on data sharing between managed and unmanaged apps. By configuring the internal app as managed and restricting data sharing, you prevent copying patient data into personal apps. This directly addresses the requirement to limit access to the specific app and block data leakage.

To allow only specific extensions and block all others, you must set the ExtensionInstallBlocklist to '*' (block all) and list the allowed extensions in ExtensionInstallAllowlist. If the blocklist is not set to wildcard, users can install any extension not explicitly blocked. This is the correct configuration to enforce a strict allowlist.

Managed app installation depends on the device being enrolled and compliant, so verifying enrolment first confirms the device can receive configuration profiles and policies. Without enrolment, the management console cannot push the app or evaluate compliance, making this the logical initial check.

A passcode policy in the iOS device management settings enforces encryption, satisfying the requirement that all corporate-owned iOS devices are encrypted. On iOS, setting a passcode automatically enables hardware-based data protection encryption; without a passcode, files remain unencrypted. No separate encryption toggle exists, so the passcode policy is the mechanism.

Chrome browser cloud management applies policies directly to signed-in browser instances, so enforcement works on unmanaged devices where you lack OS-level control. This satisfies the stem's constraint: securing Chrome without device management. Enrol browsers via a token, then push policies from the Google Admin console, independent of Microsoft Entra ID or Intune.

Work profile data sharing settings block copy-and-paste and data transfer between the managed work profile and personal apps on Android devices, directly satisfying the requirement to prevent copying from managed apps into personal apps. This control operates at the OS profile boundary, unlike app-level policies that cannot restrict cross-app sharing on the device.

Endpoint Verification collects device attributes and reports them to Google. To enforce access based on those attributes, you must create an access level in Context-Aware Access that requires the device to be verified, and then assign it to the desired apps. This ensures only devices with a valid endpoint verification certificate can access Workspace apps.

The Endpoint Verification extension reports device attributes, including is_encrypted, to Google Workspace, letting Context-Aware Access evaluate encryption state in its access level conditions. Without that signal, the access level cannot determine whether a device meets the encryption requirement.

Context-Aware Access lets you define access levels based on device attributes, such as whether a device is company-owned and managed. By requiring these attributes, you ensure only corporate Windows laptops that are enrolled can access Workspace apps, effectively blocking personal devices. This is the correct approach for granular, identity-aware access control.

Managed Google Play hosts approved Android apps; selecting the app under Apps in the Admin console and assigning it to the target organisational unit scopes distribution precisely. This satisfies the requirement to deploy the application to a subset of users rather than the whole organisation.

When a device shows as 'Pending' in the Admin console, it means enrollment has not been completed. The user must open the Google Device Policy app and follow the prompts to finish enrollment. This app is required for advanced mobile management and ensures the device is properly registered and policies are applied, allowing access to work email and other services.

Mobile devices must have an active internet connection to receive policy updates from Google's servers. If the device is offline or not syncing, new policies will not be applied. This is the most common and basic cause of policy not being applied, so it should be checked first before investigating more complex issues.

Force-installing apps and extensions via the Admin console ensures they are automatically installed and cannot be removed by users. This is the correct method to deploy essential apps to ChromeOS devices and prevent uninstallation, as the policy enforces installation and locks the apps in place.

ExtensionInstallAllowlist specifies which extensions are permitted to be installed. When this policy is set, only extensions on the list can be installed, effectively blocking all others. This is a key policy for controlling extension installation and ensuring users can only add approved extensions. It works in conjunction with other extension policies to enforce a secure browsing environment.

Device details show sync status, last contact time, policy compliance and any blocked or wiped state for that Android work profile. Reviewing them first identifies whether the fault is device, policy or account related before further changes.

Zero-touch enrollment allows you to pre-register ChromeOS device serial numbers with Google so that when the devices are first powered on and connected to the internet, they automatically enroll into your organization's domain. This eliminates manual enrollment steps and ensures devices are enterprise-managed from the start. It requires coordination with the device reseller or uploading serial numbers in the Admin console.

The mobile management audit log records each wipe command and its outcome, showing whether the device acknowledged and completed the wipe or the command failed. Reviewing it verifies what actually happened after the wipe was issued.

Auto-update settings sit under Device settings, letting administrators control ChromeOS version rollout and pin devices to a specific release. This satisfies the stem's requirement for a configurable option in that section, distinct from user-level or network-level policies found elsewhere in the Admin console.

A 'Blocked' status means the device was denied access under mobile management rules. Approving it in the device list restores the trust state, allowing the device to sync work email and satisfy the user's access requirement.

Forced re-enrollment binds a wiped device back to your domain by checking its identifier against the enrollment record during initial setup, so a factory reset cannot shed management. This directly satisfies the stem's requirement that the restriction be enforceable through ChromeOS device settings, without relying on user compliance.

Android work profiles are fully managed by the Admin console, so an administrator can wipe just the work profile and its corporate data without touching the user's personal apps or files — satisfying the requirement to act remotely on a personally owned, BYOD-enrolled device.

QR code scanning enrols Android devices by provisioning a work profile or device owner configuration without factory reset, satisfying the stem's enrolment requirement. During setup, the device scans the code to download management credentials and register with Microsoft Entra ID, enabling bulk, touchless onboarding of corporate-owned or personally-owned Android hardware.

Endpoint Verification requires the extension to be installed and enabled in Chrome. If it is missing or disabled, the device will not report its status to the Admin console, so it won't appear in the device list. This is the most common cause when the user is already signed in to Chrome with their managed account but the device is not showing up.

Setting the extension to 'Force installed' ensures it is automatically installed and cannot be disabled or removed by users. This enforces the presence of Endpoint Verification for Context-Aware Access. It is the correct policy to prevent tampering.

A work profile creates a separate, managed container on the device, isolating work apps and data from the personal side. This satisfies the scenario's aim by letting IT control work resources without accessing or wiping personal content on the same device.

Context-Aware Access access levels can include device conditions such as 'Verified' which checks that the Endpoint Verification extension is installed, the device is synced, and meets other criteria. Applying this access level to Google Drive enforces the requirement. This is the correct way to restrict access based on device posture.

Access levels define the conditions (e.g., device owned by company, encrypted) that must be met for access. You must create an access level and assign it to Gmail in the Admin console to enforce the policy. This is the core of Context-Aware Access.

Endpoint Verification reports disk encryption status, and Context-Aware Access can evaluate it. Creating an access level that requires the device to be encrypted will block access from unencrypted devices. This is the correct condition to meet the requirement.

The 'Wipe device' action performs a full factory reset, erasing all data including personal data. This is the correct action for a lost company-owned device where data security is paramount. It ensures that no corporate or personal data remains on the device.

Endpoint Verification collects many attributes, but the company-owned attribute is only available for devices managed by Windows device management (e.g., via GCPW or third-party UEM integration). If the Windows devices are not enrolled in a management system that reports ownership, the attribute is absent, and Context-Aware Access may fail open or treat the device as not company-owned, depending on the access level configuration. This explains why personal Windows devices can still access.

Context-Aware Access can evaluate device ownership and OS. By creating an access level that requires company-owned Windows devices and assigning it to the apps, you block non-corporate Windows sign-ins while leaving other platforms unaffected. This is the intended way to enforce device trust for Windows endpoints in Google Workspace.

In Google Workspace, when a mobile device attempts to access work data, it can appear as 'Pending' until an administrator approves it. Until approval, the device cannot sync work email or other data. This matches the user's symptom and the Admin console status, so the most likely reason is that the device is awaiting admin approval.

Force-installed extensions are pushed through the Chrome Enterprise policy *ExtensionInstallForcelist*, applied via a cloud-managed policy or a Windows registry/GPO setting, so they deploy to every signed-in user without user consent. This satisfies the stem's requirement for a browser setting controllable across all users.

Chrome Endpoint Verification checks device posture, such as encryption and screen lock, and reports it to Workspace, letting access policies require managed devices. This satisfies the stem's requirement to verify security posture before granting access to Workspace data.

The Wipe device command remotely erases all data from the managed Android device, protecting company information even though the hardware is unrecoverable. It satisfies the stem's security requirement more effectively than blocking sign-in, which leaves locally cached data exposed.