GWS-ADMIN Practice Questions

Question 1

Your organization wants to ensure that all outgoing mail is routed through a third-party email security gateway for scanning. What is the correct configuration?

Accepted Answer

Apps > Google Workspace > Gmail > Routing. Outbound routing is configured in Apps > Google Workspace > Gmail > Routing by setting an outbound gateway.

Answer

Security > Compliance > Gateway

Answer

Apps > Google Workspace > Gmail > Compliance

Answer

Account > Network > SMTP relay

Question 2

You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?

Accepted Answer

Security > Access and data control > API controls > Manage domain-wide delegation. For service accounts performing domain-wide delegation, scopes must be defined in the Security > Access and data control > API controls > Manage domain-wide delegation section.

Answer

Account > Security > App access

Answer

Directory > Users > Service Accounts

Answer

Apps > Google Workspace > Gmail > API

Question 3

A Google Workspace administrator notices that a user's account is repeatedly locked out after multiple failed login attempts from different IP addresses. The user insists they are not attempting to sign in. What should the administrator do first to mitigate the issue?

Accepted Answer

Check the user's recent login activity and audit logs for suspicious IPs.. Repeated lockouts from different IPs indicate a potential brute-force or credential-stuffing attack. The administrator should first review login audit logs to identify the attacking IPs and assess the threat. This informs subsequent actions, such as blocking IPs, enforcing two-step verification, or resetting passwords. Suspending the account or resetting the password without investigation may not stop the attack or could disrupt the user unnecessarily.

Answer

Enable two-step verification for the user and require it immediately.

Answer

Temporarily suspend the user's account to stop the lockouts.

Answer

Reset the user's password and enforce a password change at next login.

Question 4

A user reports that their company-owned Windows laptop is not appearing in the list of devices under Endpoint Verification. You have confirmed that the user is signed in to Chrome with their Workspace account. What is the most likely reason for this issue?

Accepted Answer

The Endpoint Verification extension is not installed or is disabled in the user's Chrome browser.. Endpoint Verification relies on the Chrome extension to collect and report device details. If the extension is not installed or is disabled, the device will not appear. Since the user is signed in to Chrome with their managed account, the next step is to verify the extension's presence and status. Other factors like sync or Windows Hello are irrelevant to this functionality.

Answer

The device is not enrolled in Windows Hello for Business.

Answer

The Admin console setting 'Endpoint Verification' is turned off for the organizational unit.

Answer

The user has not enabled Chrome Sync for their Workspace account.

Question 5

A company is preparing for a compliance audit and needs to ensure that all Google Workspace data is retained according to legal requirements. The compliance team asks you to identify which two settings can be configured to prevent users from permanently deleting data. (Choose two.)

Accepted Answer

Configure a Google Drive retention rule in Vault to retain files for a set period.. Google Vault retention rules for Gmail and Drive are the primary mechanisms to prevent permanent data deletion. They retain data according to policy, even if users delete items. Other settings like Data Regions or labels do not prevent deletion, and there is no Admin Console toggle to disable delete buttons.

Answer

Apply a data classification label to all files to prevent deletion.

Answer

Set up a Google Workspace Admin Console setting to disable the 'Delete' button for all users.

Answer

Enable 'Data Regions' for all users to store data in a specific geographic location.

Question 6

Your organization uses Chrome browser on Windows devices. You want to ensure that users cannot disable or remove the Endpoint Verification extension. What should you do?

Accepted Answer

In the Admin console, go to Devices > Chrome > Apps & extensions > Users & browsers, and set the Endpoint Verification extension to 'Force installed'.. To prevent users from disabling or removing the Endpoint Verification extension, you must force-install it via the Chrome Apps & extensions policy. This policy ensures the extension is automatically installed and cannot be removed. It is the standard method for enforcing extensions in managed Chrome browsers.

Answer

In the Admin console, go to Devices > Chrome > Settings > Users & browsers, and enable 'Endpoint Verification' under Security.

Answer

In the Admin console, go to Devices > Chrome > Settings > Device settings, and enable 'Force re-enrollment'.

Answer

In the Admin console, go to Devices > Mobile & endpoints > Settings > Universal settings, and enable 'Force Endpoint Verification'.

Question 7

A healthcare organization uses Google Workspace. A compliance officer asks you to ensure that any Gmail message containing a patient identifier is automatically quarantined for review rather than delivered. Which configuration accomplishes this with the least administrative overhead?

Accepted Answer

Configure a Gmail DLP rule with a custom pattern and set the action to quarantine.. Gmail DLP evaluates message content against detectors and can take actions such as quarantine, which places the message in a review queue. This directly addresses the need to hold messages containing patient identifiers instead of delivering them, and it requires only a single DLP rule rather than custom routing.

Answer

Create a content compliance rule that adds a header to matching messages.

Answer

Add the pattern to the blocked senders list in Gmail settings.

Answer

Use an attachment compliance rule to reject messages with matching attachments.

Question 8

You need to restrict access to the Admin Console to only users connecting from your corporate office IP address. Which tool do you use?

Accepted Answer

Context-aware access. Context-aware access allows you to define access levels based on IP ranges and apply them to the Admin Console.

Answer

DLP policy

Answer

2-Step Verification

Answer

Vault access settings

Question 9

A user reports that emails sent to a specific external domain are bouncing with a '550 5.7.1' error. What is the likely reason?

Accepted Answer

The domain's email authentication (SPF/DKIM/DMARC) is failing.. 550 5.7.1 errors are typically related to SPF, DKIM, or DMARC failures, indicating the recipient domain is rejecting the mail due to authentication issues.

Answer

The message size exceeds the limit.

Answer

The user's storage quota is exceeded.

Answer

The recipient's mailbox is full.

Question 10

Your organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?

Accepted Answer

Place contractors in a dedicated OU, navigate to Security > Authentication > 2-step verification, and configure the allowed methods to only include security keys.. Security key enforcement can be targeted to specific organizational units or security groups by setting the 2SV policy appropriately.

Answer

Modify the default domain-wide sign-in security policy to require security keys globally and grant exceptions via API.

Answer

Configure Context-Aware Access to block non-security key authentications for the contractors group.

Answer

Create an IAM custom role that revokes prompt-based authentication for external users.

Question 11

Which TWO of the following are valid methods to verify domain ownership in Google Workspace? (Choose two)

Accepted Answer

Adding a TXT or CNAME record to your DNS settings.. Google Workspace provides multiple methods for domain verification, including DNS records and file uploads.

Answer

Enabling SSO via a SAML metadata file.

Answer

Sending an email to the registrar's abuse alias.

Answer

Creating a new admin account with the '@gmail.com' suffix.

Question 12

Your company uses Windows 10 laptops. You want to ensure that only devices with a valid and up-to-date Endpoint Verification extension and a recent sync can access Google Drive. You have already deployed the extension. Which additional step must you take to enforce this requirement?

Accepted Answer

Create a Context-Aware Access access level that requires the device to be 'Verified' and apply it to Google Drive.. Context-Aware Access allows you to define access levels based on device attributes, including whether the device is 'Verified' by Endpoint Verification. By applying such an access level to Google Drive, you ensure that only devices with the extension installed and recently synced can access the service. This is the intended mechanism for enforcing endpoint verification on desktop devices.

Answer

Enable 'Advanced' mobile management for Windows devices in the Admin console.

Answer

Configure a device policy that blocks access to Google Drive unless the device is company-owned.

Answer

Set up a SAML SSO profile that requires device certificate authentication for Google Drive.

Question 13

When a user leaves the company, which status should you set their account to if you want to keep their data but stop them from logging in?

Accepted Answer

Suspend the account. Suspending a Google Workspace account immediately blocks sign-in while preserving all data, including Gmail, Drive, and Calendar content. The account remains in the directory and can be restored later. This matches the requirement to keep data but stop logins.

Answer

Reset the 2-Step Verification

Answer

Change the password

Answer

Delete the account

Question 14

When troubleshooting a SAML application error, which THREE of the following should you check?

Accepted Answer

SAML application metadata. Option A (SAML application metadata) is correct because the metadata XML defines the entity ID, ACS URL, and signing certificates that the IdP and SP exchange; a mismatched or stale metadata file is a common cause of SAML assertion failures. Option C (User attribute mapping) is correct because SAML assertions must carry the attributes the SP expects (for example NameID, email, or role claims), and incorrect or missing mappings cause authorization or login errors. Option E (Certificate expiration status) is correct because SAML signing and encryption certificates have validity periods, and an expired IdP or SP certificate will invalidate assertions and break the trust relationship. Option B (the user's computer operating system) is not relevant because SAML is a browser-based federation protocol independent of the client OS, and Option D (the user's physical location) is not relevant because SAML troubleshooting focuses on identity configuration, not geographic location.

Answer

The user's computer operating system

Answer

The user's physical location

Question 15

Which TWO tools in the Admin Console help you identify potentially compromised accounts?

Accepted Answer

Security dashboard. The Security dashboard (C) is correct because it surfaces security-related metrics and alerts in the Admin Console, including suspicious login activity and other indicators that can point to potentially compromised accounts. The Investigation tool (D) is correct because it lets admins run targeted searches across Gmail, Drive, and other Workspace logs (e.g., login and device events) to dig into anomalous user activity and confirm whether an account has been compromised. Vault search (A) is for eDiscovery and content retention/legal holds, not for identifying compromised accounts. Group settings (B) only manage membership and group configuration, and Data regions (E) controls where data is stored, neither of which helps detect account compromise.

Answer

Vault search

Answer

Group settings

Answer

Data regions

Google Cloud Associate Google Workspace Administrator GWS-ADMIN practice test

Three ways to study

Study GWS-ADMIN by domain

Study GWS-ADMIN by topic

Data Governance And Compliance practice questions

Endpoint Management practice questions

Security Policies And Access Controls practice questions

Troubleshooting practice questions

User Accounts Domains And Directory practice questions

Core Workspace Services practice questions

GWS-ADMIN fundamentals practice questions

GWS-ADMIN scenario practice questions

Google Cloud Associate Google Workspace Administrator (GWS-ADMIN) practice questions