How should I use these Security Policies And Access Controls practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

GWS-ADMIN · topic practice

Security Policies And Access Controls practice questions

Q: Can I practise just Security Policies And Access Controls questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Policies And Access Controls domain.

This domain covers how Google Workspace administrators enforce authentication, delegate privileges, and protect organizational data. Questions present realistic Admin console scenarios: configuring 2-Step Verification enforcement by organizational unit or group, verifying domain ownership, building custom admin roles with granular privileges, and applying least-privilege delegation for helpdesk and security staff.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Security Policies And Access Controls

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Policies And Access Controls

Be able to configure 2-Step Verification enforcement and allowed methods by organizational unit or group, verify domain ownership, and build custom admin roles granting only needed privileges. The most important thing: apply least privilege, giving helpdesk or analysts scoped roles rather than broad built-in admin roles.

Configuring 2-Step Verification enforcement and allowed methods per organizational unit or group

Verifying domain ownership via DNS TXT records, CNAME, or HTML file upload

Creating custom admin roles with granular privileges in the Google Admin console

Delegating user management and password resets without granting Gmail or security access

Watch out for

Common Security Policies And Access Controls exam traps

▸Assuming 2-Step Verification settings apply uniformly; enforcement and allowed methods are configured per organizational unit or group, so contractors and employees can differ.
▸Granting the built-in Super Admin or User Management Admin role when a narrowly scoped custom role would satisfy least privilege.
▸Confusing domain ownership verification methods with email authentication records like SPF, DKIM, or DMARC.

Practice set

Security Policies And Access Controls questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Security Policies And Access Controls explanation →

An administrator needs to configure password requirements, such as minimum length and expiration policies, for all users in the domain. Where is this configured in the Google Admin console?

Trap 1: Apps > Google Workspace > Gmail > Security

This path configures email-specific security rules, not domain user passwords.

Trap 2: Directory > Users > Password settings

User settings do not host the global password rules.

Trap 3: Account settings > Personalization > Passwords

Account settings contains branding and customer info, not security policies.

Study all Security Policies And Access Controls common traps →

A
Apps > Google Workspace > Gmail > Security
Why it fails: This path configures email-specific security rules, not domain user passwords.
B
Directory > Users > Password settings
Why it fails: User settings do not host the global password rules.
C
Security > Password management
Security > Password management is the correct location to enforce length, expiration, and strong password requirements.
D
Account settings > Personalization > Passwords
Why it fails: Account settings contains branding and customer info, not security policies.

Security Policies And Access Controls practice questions

What to know about Security Policies And Access Controls

Common Security Policies And Access Controls exam traps

Security Policies And Access Controls questions

An administrator needs to configure password requirements, such as minimum length and expiration policies, for all users in the domain. Where is this configured in the Google Admin console?

Your organization has configured third-party SAML SSO. However, you need to ensure that Super Administrators can always bypass SSO and sign in using their Google credentials in case the third-party IdP goes down. What configuration setting should you enable?

An administrator needs to grant a helpdesk employee the ability to reset user passwords and view user information without granting them full super administrator privileges. Which built-in admin role should be assigned?

Your company uses a third-party Identity Provider (IdP) for Single Sign-On (SSO) via SAML. A newly hired employee is unable to sign in, and you suspect their account is not properly mapped or provisioned. Where can you check SAML sign-in activity and error logs in the Google Admin console?

Your organization wants to prevent users from sharing Google Drive files externally, but you need to make an exception for a specific partner domain. Where should you configure this allowed domain list?

An administrator has configured a new SAML SSO integration with a third-party IdP. Users are complaining that they can log in successfully, but after 30 minutes, they are unexpectedly forced to re-authenticate. Where can the administrator adjust the session duration for SAML apps?

Your company requires that any user attempting to access Google Drive from an unmanaged mobile device must be blocked, while desktop browsers on unmanaged devices are permitted read-only access via Context-Aware Access. How should you structure your Access Levels and assignments?

You need to ensure that administrative actions taken by Super Administrators trigger real-time alerts to the security team's email distribution list. Which tool should you use to set this up?

An administrator wants to ensure that users cannot use weak or commonly breached passwords. Where can password monitoring be enabled in the Google Admin console?

You are troubleshooting an issue where a user is unable to authenticate via SAML SSO. You need to inspect the raw SAML request and response messages sent between the IdP and Google Workspace. What is the most effective way to capture this?

Your security team requires that all administrators must use a hardware security key (FIDO2) for 2-Step Verification and are prohibited from using SMS or phone prompts. Where can you enforce this requirement specifically for admin accounts?

An administrator wants to ensure that users cannot reuse any of their last 5 passwords when changing their password. Where is this setting configured?

Which THREE built-in administrator roles in Google Workspace grant privileges to manage user accounts and reset passwords? (Choose three.)

An administrator is reviewing API controls and third-party app access in Google Workspace. Which THREE access states can be configured for third-party OAuth applications? (Choose three.)

An organization wants to configure SSO with a third-party SAML IdP. Which THREE advanced settings can be configured within the Google Workspace SAML application settings? (Choose three.)

Your organization requires that users can only access Google Drive when connected to the corporate VPN. How can you achieve this using Context-Aware Access?

An auditor requests that you restrict administrative access to the Google Workspace Admin console to a specific set of IP addresses. What is the most effective way to implement this?

A new IT support staff member needs to manage user passwords but should not be able to delete users or modify billing settings. Which role should you assign?

You need to prevent users from installing third-party Marketplace apps that request access to their Gmail data. What is the best approach?

You want to ensure that all users have a strong password policy. Where can you enforce password length and complexity requirements?

Track your progress over time

Start a Security Policies And Access Controls only practice session

Related GWS-ADMIN topic practice pages

Data Governance And Compliance practice questions

Endpoint Management practice questions

Security Policies And Access Controls practice questions

Troubleshooting practice questions

User Accounts Domains And Directory practice questions

Core Workspace Services practice questions

GWS-ADMIN fundamentals practice questions

GWS-ADMIN scenario practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid