CCNA Security Policies And Access Controls Questions

Another Super Administrator can clear the locked admin's 2-Step Verification enrolment from the Google Admin console, forcing re-enrolment at next sign-in. This satisfies the stem's constraint: recovery without the lost device, using a peer Super Administrator's existing privileged access rather than self-service or backup codes.

This is the correct configuration because it enforces 2SV for all users and restricts the allowed methods to only security keys. This meets the requirement of using hardware security keys exclusively, preventing the use of SMS or phone calls. The setting is located under Security > Authentication > 2-Step Verification.

This is the correct path because App access control in API controls allows administrators to set app access policies per org unit. By configuring the policy for the Sales org unit, the admin can block apps with High Risk and unverified scopes, meeting the requirement precisely.

IP subnet conditions allow an administrator to allow or deny access based on the source IP address range in CIDR notation. This is a valid network-origin condition that can be combined with device policy to restrict Drive access for the remote workforce.

Context-Aware Access rules bind to organizational units and access levels, so moving the user to an OU without the rule, or granting a temporary exception access level, restores Gmail access. This satisfies the stem's requirement to grant access temporarily without weakening long-term security.

The 'Sign out of all sessions' button in the user's Security settings immediately revokes all active sessions for that user across all devices. Upon next access, the user must sign in again, and if 2-Step Verification is enforced, they will be prompted for it. This directly meets the requirement to terminate sessions immediately and require re-authentication with 2-Step Verification.

Periodic audits confirm that OU placement and inherited policies still grant each user the intended security controls, catching drift after role or team changes. This satisfies the requirement for recommended OU configuration practices alongside applying policies at the correct hierarchy level.

TOTP authenticator apps generate rotating six-digit codes from a shared secret, requiring no network or hardware token. Google Workspace natively enrols them during 2SV setup, satisfying the stem's demand for a supported second factor alongside prompts and security keys.

Enforce applies 2-Step Verification to every user in the selected organisational unit, satisfying the mandatory requirement for that department. Users outside the OU remain unaffected and can still enrol voluntarily through their individual settings, giving the split behaviour the scenario demands.

The Investigation Tool in Security Center runs targeted queries across Gmail, Drive and user logs, letting admins trace sign-in anomalies and take remediation actions such as deleting mail or suspending accounts. It satisfies the requirement to investigate suspicious activity rather than merely view alerts.

Placing contractors in a dedicated OU lets you apply an authentication policy scoped to that group alone, satisfying the requirement that only contractors are restricted. Within Security > Authentication > 2-step verification, limiting allowed methods to security keys enforces phishing-resistant hardware authentication, while employees in other OUs retain prompts and authenticator apps.

Context-Aware Access evaluates conditions like IP subnet and device management status before granting access to Google Workspace apps. By creating an access level that includes the corporate IP range and requires a managed device, then applying it to Gmail, the administrator can block all other access. This directly meets the scenario's need for granular, attribute-based control.

Configuring the SAML Single Logout URL in the SSO profile makes Google Workspace redirect the user's browser to the IdP's SLO endpoint on sign-out, terminating the IdP session. This directly satisfies the stem's requirement that IdP sessions also end.

The service status being OFF for the user's organizational unit or access group prevents the SAML app from being served to that user, producing the 'app_not_configured_for_user' 403. Google Workspace evaluates service status per OU before SAML authentication, so users outside the enabled scope cannot access the app regardless of valid credentials.

Context-Aware Access access levels combine IP subnet conditions with device policy compliance, and assigning them to targeted apps enforces both constraints at access time. This satisfies the requirement that access occur only from managed corporate devices within the corporate IP range.

Groups Admin grants domain-wide creation and management of Google Groups, including membership and settings, without conferring super admin or other service privileges. It satisfies the constraint of delegating group management across the entire domain while withholding full admin rights.

Selecting Services > Google Meet hardware grants only the privileges needed to manage Meet hardware devices and view their health, satisfying the least-privilege constraint. It excludes unrelated services, so the custom role cannot administer Gmail, Drive or other workloads.

Work profiles on Android create a separate, encrypted container where corporate apps and data reside, isolating them from personal apps. This satisfies the requirement to protect corporate data on mobile devices, since administrators can enforce policies within the work profile without touching personal content.

Creating an access level alone does not enforce anything; it must be assigned to specific Google Workspace applications and scoped to an organizational unit. By assigning the device-based access level to Gmail and Drive for the desired organizational unit, the policy becomes active. Users on personal devices will be denied access, while managed devices meeting the criteria are allowed.

Restricting Admin console sign-in to trusted IP ranges blocks credential use from unauthorised networks, directly limiting where admin authentication can succeed. This satisfies the stem's goal of preventing unauthorised admin access by constraining the source network.

Assigning Security Center privileges for the Investigation Tool and Alerts plus Reporting audit log access grants the analyst the required visibility. Leaving User Management and OU privileges unchecked enforces least privilege, preventing password or organisational unit modifications.

Context-Aware Access access levels can be assigned per app and per organizational unit. Applying the managed-device access level to Drive for the main OU blocks unmanaged access, while contractors in a separate OU without that access level can still use Gmail from personal devices, meeting both requirements.

Security Center's dashboard surfaces recent security alerts alongside proactive recommendations, directly satisfying the stem's requirement to review both. Unlike the alert centre or investigation tool, which focus on triaging active incidents, the dashboard aggregates posture findings and remediation guidance, making it the correct first stop for improvement recommendations.

Because the partner users authenticate in their own domain, only their administrators can apply Context-Aware Access or device policies to their sign-ins. By sharing the folder with the partner domain and asking them to enforce managed-device access on their side, both organizations contribute the controls they each own, satisfying the requirement.

Security > Authentication > SSO with third-party IdP is where SAML federation settings for an external IdP are configured and verified. It holds the entity ID, ACS URL, certificate and attribute mappings that Microsoft Entra ID exchanges with the third-party IdP, so a broken sign-in is diagnosed there.

Cloud Identity Premium's automated lifecycle management, or the Admin SDK API, enforces time-bound access by suspending the contractor account on a scheduled date, satisfying the 30-day automatic deactivation constraint without manual intervention. This removes standing access risk while retaining auditability, unlike manual reminders or shared credentials.

Custom roles with privileges like 'Users: Reset password' can be assigned at the organizational unit level. By assigning the role to the helpdesk admin only for the Sales organizational unit, the admin can reset passwords for users in Sales but not for users in Finance or other OUs. This is the correct way to scope administrative privileges to a subset of users.

Selective assignment lets the SAML SSO profile apply only to chosen organisational units or access groups, so contractors remain on Deactivated SSO and authenticate against Google's native login with their password and 2SV, satisfying the mixed-environment requirement.

The IdP's Entity ID, also called the Issuer, identifies the identity provider in SAML assertions and must be entered in the Google Admin console so Google can validate the issuer field. Without it, Google cannot confirm which IdP signed the response.

Context-Aware Access evaluates conditions such as geographical location before granting access, so an access level can deny sign-ins originating outside the home country. This directly satisfies the requirement to block authentication attempts from foreign locations.

Context-Aware Access evaluates access levels built from device policy compliance and operating system conditions, so an access level restricted to compliant desktop operating systems blocks mobile devices entirely while permitting enrolled Chromebooks and Windows machines. This satisfies both the managed-device and no-mobile constraints in one policy.

The 2-Step Verification adoption report under Reporting > Reports > Security lists enrolment status per user, directly identifying accounts without 2SV enabled. This satisfies the requirement to audit organisation-wide adoption without inspecting each user individually.

The User Management Admin role allows managing users, including creating, editing, and deleting users, as well as resetting passwords. It does not grant access to Gmail content or security settings. This role is designed for helpdesk staff who need to handle user account tasks without broader privileges.

Security > Authentication > 2-step verification is the console path holding enforcement settings, where you select the Sales OU and set enforcement to on. This satisfies the stem's requirement to apply 2-Step Verification to a specific organisational unit.

Security Center's investigation tool allows administrators to create activity rules based on specific events, such as Drive download counts. You can set thresholds to alert on mass downloads, which helps detect insider threats. This is a core feature for monitoring suspicious behavior and is essential for the requirement.

The 'https://www.googleapis.com/auth/drive.file' scope grants per-file access to files that the app creates or that the user explicitly shares with the app. This aligns with the requirement to restrict access to only files users share with the app. It does not allow access to other files in the user's Drive. This scope is designed for apps that need to work with specific files, providing a balance between functionality and security.

Geographic location is a supported access-level criterion, evaluated through IP-based country/region detection within Context-Aware Access expressions. This satisfies the stem's requirement for a valid criterion, letting administrators restrict corporate data access to approved countries, complementing device and user attributes in the same expression.

The Admin console provides a centralized setting under Security > Authentication > 2-Step Verification where administrators can enforce 2SV for all users in an organizational unit or the entire domain. Setting enforcement to 'On' requires users to enroll in 2SV and use it for sign-in. This is the correct location to apply a domain-wide enforcement policy, ensuring all users comply with the requirement.

Login audit log events record every authentication attempt with its outcome, including Context-Aware Access denials, so they satisfy the stem's need to verify blocked connections. Each entry shows the user, device, and access-level evaluation result, letting the administrator confirm unauthorised attempts were rejected rather than merely logged elsewhere.

Hardware security keys bind authentication to a phishing-resistant FIDO credential, so stolen passwords or relayed OTP prompts cannot complete sign-in. Restricting administrators to this method satisfies the stem's requirement to secure administrative accounts against credential theft and unauthorised access.

Context-Aware Access evaluates device attributes such as whether the device is company-owned and encrypted, so an access level scoped to managed devices will allow corporate Chromebooks and Windows endpoints while denying unmanaged personal devices. Applying it at the org unit level for Gmail and Drive enforces the restriction across the targeted apps.

App Access Control allows administrators to set global settings for third-party apps, including restricting access to Gmail. By configuring the Gmail service to 'Restricted' and specifying trusted apps, administrators can block unapproved apps from accessing Gmail data. This directly addresses the requirement to prevent students from installing apps that request Gmail access.

Publishing a TXT or CNAME record in the domain's DNS zone proves control because only the domain owner can edit that zone. Google Workspace queries the record directly, satisfying verification without website or server access, and it supports domains with no web presence.