Black Friday Special Sale - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: mxmas70

Home > Google > Workspace Administrator > Google-Workspace-Administrator

Google-Workspace-Administrator Google Cloud Certified - Professional Google Workspace Administrator Question and Answers

Question # 4

Your organization is planning to remove any dependencies on Active Directory (AD) from all Cloud applications they are using You are currently using Google Cloud Directory Sync (GCDS) with on-premises AD as a source to provision user accounts in Google Workspace. Your organization is also using a software-as-a-service (SaaS) human resources information system (HRIS) that offers integration via CSV export and Open API standard.

Additional requirements for the solution include:

• It should not require a subscription to any additional third-party service.

• The process must be automated from beginning to end.

You are tasked with the design and implementation of a solution to address user provisioning with these requirements.

What solution should you implement?

A.

Set up Azure AD and federate on-premises AD with it. Provision user accounts from Azure AD with the Google-recommended process.

B.

Modify the GCDS configuration to use the HRIS application as the data source and complete any necessary adjustments

C.

Export HRIS data to a CSV file every day. and build a solution to define the delta with the previous day;

import the result as a CSV file via the Admin console.

D.

Build an application that will fetch updated data from the HRIS system via Open API. and then update

Google Workspace with the Directory API accordingly.

Full Access
Question # 5

Your organization has offices in Canada Italy and the United States You want to ensure that employees can access corporate Gmail and Drive from these three geographic locations only What should you do?

A.

Require the use of corporate devices for any access to corporate Gmail and Drive

B.

Use context-aware access to create access levels based on the geographic location and assign them to corporate Gmail and Drive

C.

Create address lists to restrict the delivery of incoming and outgoing messages and to block notifications from Google Doc comments

D.

Create data protection rules in Google Workspace that allow data access from only three geographic locations

Full Access
Question # 6

Your organization is migrating to Google Workspace and wants to improve how newly created files are classified You must find a scalable solution to improve security and transparency on how to handle sensitive files What should you do?

A.

Set data loss prevention (DLP) policies to label data automatically disable label locking, and educate users

B.

Create classification labels enable automatic classification, and educate users

C.

Migrate data to Google Workspace map classifications and migrate with the Drive Labels API

D.

Integrate with the Cloud DLP API map identifiers and classifications install the Google Drive label client and run the application

Full Access
Question # 7

Your organization has a data loss prevention (DLP) rule to detect and warn users about external sharing of sensitive files in Google Drive You also want to prevent external users from downloading files with viewer permissions to their local machines What should you do?

A.

Do nothing. View-only Drive files automatically prevent the user from downloading the files

B.

Modify the existing DLP rule to Disable download, print, and copy for commenters and viewers

C.

Create a new DLP rule by using the existing content detector conditions but change the action for the new rule to Disable download. print, and copy for commenters and viewers

D.

Create a new DLP rule and set the scope to the organizational unit or group that you want to restrict

Full Access
Question # 8

A user reached out to the IT department about a Google Group that they own: info@company.com. The group is receiving mail, and each message is also delivered directly to the user's Gmail inbox. The user wants to be able to reply to messages directly from Gmail and have them sent on behalf of the group, not their individual account. Currently, their replies come from their individual account. What would you instruct the user to do?

A.

Create a new content compliance rule that matches the user's outgoing messages with the group copied, and have it modify the sender to be the group address.

B.

Add the group as an email address that can be sent from within Gmail, and verify that the user has access. They can then choose to reply from the group.

C.

Add the user's individual account as a delegate to the group's inbox. They can then toggle between the accounts and use the Gmail interface on behalf of the group.

D.

Set the group address to be the default sender within the group's posting policies.

Full Access
Question # 9

Your executive team has asked you to export all available data for 1,200 of your 1,500 Google Workspace Domain users. How should you proceed to export the data with the least amount of effort?

A.

Perform a search in Google Vault for the 500 users and export all of the results.

B.

Create a shared drive for the exports. Instruct end users to manually use Google Takeout to export the data and place the exported files in the shared drive.

C.

Contact Google Cloud support to perform the export for you.

D.

Contact Google Cloud Support to enable the Data Export tool for your organization, because you have more than 1,000 users, then use the tool to export data for the domain, and remove any unnecessary user data.

Full Access
Question # 10

You have implemented a data loss prevention (DLP) policy for a specific finance organizational unit. You want to apply the same security policy to a shared drive owned by the finance department in the most efficient manner. What should you do?

A.

In the Admin console sharing settings, select the finance organizational unit and deselect Allow users outside the domain to access files in shared drives

B.

Assign the Shared Drive to the finance organizational unit

C.

Create a new DLP policy for shared drive users

D.

Change the scope of the policy to apply to all in the domain

Full Access
Question # 11

You need to protect your users from untrusted senders sending encrypted attachments via email. You must ensure that these messages are not delivered to users' mailboxes. What step should be taken?

A.

Use the security center to remove the messages from users' mailboxes

B.

Use Google Vault to remove these messages from users mailboxes.

C.

Enable a safety rule to send these types of messages to spam.

D.

Enable a safety rule to send these types of messages to a quarantine.

Full Access
Question # 12

Several customers have reported receiving fake collection notices from your company. The emails were received from accounts.receivable@yourcompany.com, which is the valid address used by your accounting department for such matters, but the email audit log does not show the emails in question. You need to stop these emails from being sent.

What two actions should you take? (Choose two.)

A.

Change the password for suspected compromised account accounts.receivable@yourcompany.com.

B.

Configure a Sender Policy Framework (SPF) record for your domain.

C.

Configure Domain Keys Identified Mail (DKIM) to authenticate email.

D.

Disable mail delegation for the accounts.receivable@yourcompany.com account.

E.

Disable “Allow users to automatically forward incoming email to another address.”

Full Access
Question # 13

Your organization was recently targeted by a phishing attempt that affected several users You must efficiently determine the full extent of the phishing attempt and prevent further issues from occurring What should you do?

A.

• 1 Search BigQuery 0Q9 Km b I message marked as phishing

• 2 Require Transport Layer Security (TLS) for all email communications

• 3 Instruct all users to reset their passwords

B.

• 1 Use email log search to pull all emails for the past three days

• 2 Analyze logs of common emails received and contact users.

• 3 Instruct users on how to create a Gmail filter to block malicious email addresses

C.

• 1 Use the security dashboard to view the number of messages showing evidence ot potential spoofing and then use the investigation tool on affected users to remove malicious email

• 2 Enable advanced phishing and malware protection

• 3 Deploy Google s Password Alert extension for Chrome

D.

• 1 Collect phishing samples forwarded from users

• 2 Add IP addresses and email addresses to your denylist

• 3. Enroll only affected users to multi-factor authentication (MFA)

Full Access
Question # 14

Your company works regularly with a partner. Your employees regularly send emails to your partner's employees. You want to ensure that the Partner contact information available to your employees will allow them to easily select Partner names and reduce sending errors.

What should you do?

A.

Educate users on creating personal contacts for the Partner Employees.

B.

Add a secondary domain for the Partner Company and create user entries for each Partner user.

C.

Create shared contacts in the Directory using the Directory API.

D.

Create shared contacts in the Directory using the Domain Shared Contacts API.

Full Access
Question # 15

The company's ten most senior executives are to have their offices outfitted with dedicated, standardized video conference cameras, microphones, and screens. The goal is to reduce the amount of technical support they require due to frequent, habitual switching between various mobile and PC devices throughout their busy days. You must ensure that it is easier for the executives to join Meet video conferences with the dedicated equipment instead of whatever device they happen to have available.

What should you do?

A.

Set up unmanaged Chromeboxes and set the executives’ homepage to meet.google.com via Chrome settings.

B.

Set up the executive offices as reservable Calendar Resources, deploy Hangouts Meet Hardware Kits, and associate the Meet hardware with the room calendars.

C.

Deploy Hangouts Meet Hardware Kits to each executive office, and associate the Meet hardware with the executives’ calendars.

D.

Provision managed Chromeboxes and set the executives’ Chrome homepage to meet. google.com via device policy.

Full Access
Question # 16

Your organization has users in the United States and Europe For compliance reasons you want to ensure that user data is always stored in the region where the user is located What should you do?

A.

Create two Google Groups titled "United States' and "Europe " Assign users to either group based on location

B.

Specify a data region policy for each Organizational Unit (OU) where users are grouped by location

C.

Populate the Address field on each user record ensuring the country information is accurate

D.

Do nothing No extra configuration is needed because user data is always stored in the region the user is located

Full Access
Question # 17

Your organization has a strict requirement that your temporary employees can only send emails to and receive emails from specific external domains You must define a policy in Google Workspace that meets this requirement for users in the temporary employee organizational unit (OU) What should you do?

A.

Create a policy in Gmail settings that rewrites the recipient for outbound messages and quarantines incoming messages to review before delivery

B.

Add the allowed domains when configuring the restrict delivery setting in Gmail settings, and select the box to bypass for internal emails

C.

Restrict sending and receiving to Google Groups, and carefully curate the temporary employees" memberships

D.

Configure the restrict delivery setting to limit domains that the temporary employees can communicate with Allow Google Docs sharing

Full Access
Question # 18

Your company has received help desk calls from users about a new interface in Gmail that they had not seen before. They determined that it was a new feature that Google released recently. In the future, you'll need time to review the new features so you can properly train employees before they see changes.

What action should you take?

A.

Company Profile > Profile > New User Features > Enable “Scheduled Release”

B.

Apps > Google Workspace > Gmail > Uncheck “Enable Gmail Labs for my users”

C.

Company Profile > Profile > New User Features > Enable “Rapid Release”

D.

Device Management > Chrome > Device Settings > Stop auto-updates

Full Access
Question # 19

HR informs you that a user has been terminated and their account has been suspended. The user is part of a current legal investigation, and HR requires the user's email data to remain on hold. The terminated user's team is actively working on a critical project with files owned by the user. You need to ensure that the terminated user's content is appropriately kept before provisioning their license to a new user.

What two actions should you take? (Choose two.)

A.

Extend the legal hold on the user's email data.

B.

Move project files to a Team Drive or transfer ownership.

C.

Rename the account to the new user starting next week.

D.

Delete the account, freeing up a Google Workspace License.

E.

Assign the terminated user account an Archive User license.

Full Access
Question # 20

The security team for your organization is concerned about phishlng attacks against your end user base. What two actions should you take to configure the strongest possible preventative measure against phishing attacks?

Choose 2 answers

A.

Configure spoofing and authentication controls to quarantine messages that are perceived as threats

B.

Train end users to mark messages as spam when they see something suspicious.

C.

Configure spoofing and authentication controls to warn end users about messages that are perceived as threats.

D.

Enforce confidents mode for all messages sent and received from your Workspace domain

E.

Force encryption on all inbound and outbound emails from your Workspace domain.

Full Access
Question # 21

The credentials of several individuals within your organization have recently been stolen. Using the Google Workspace login logs, you have determined that in several cases, the stolen credentials have been used in countries other than the ones your organization works in. What else can you do to increase your organization's defense-in-depth strategy?

A.

Implement an IP block on the malicious user's IPs under Security Settings in the Admin Console.

B.

Use Context-Aware Access to deny access to Google services from geo locations other than the ones your organization operates in.

C.

Enforce higher complexity passwords by rolling it out to the affected users.

D.

Use Mobile device management geo-fencing to prevent malicious actors from using these stolen credentials.

Full Access
Question # 22

Your company has sales offices in Madrid, Tokyo, London, and New York. The outbound email for those offices needs to include the sales person's signature and a compliance footer. The compliance footer needs to say “Should you no longer wish to receive emails about this offer, please reply with UNSUBSCRIBE.” You are responsible for making sure that users cannot remove the footer.

What should you do?

A.

Send an email to each sales person with the instructions on how to add the footer to their Signature.

B.

Ensure that each sales team is in their own OU, and configure the Append Footer with the signature and footer content translated for each locale.

C.

Ensure that each sales team is in their own OU, and configure the Append Footer with footer content.

D.

Ensure that each sales team is in their own OU, and configure the Append Footer with the footer content translated for each locale.

Full Access
Question # 23

Your company frequently hires from five to ten interns for short contract engagements and makes use of the

same generically named Google Workspace accounts (e.g., user1@your-company.com, user2@your-company.com, user3@your-company.com). The manager of this program wants all email to these accounts routed to the manager's mailbox account also.

What should you do?

A.

Setup address forwarding in each account's GMail setting menu.

B.

Set up recipient address mapping in GMail Advanced Settings.

C.

Configure an Inbound Gateway route.

D.

Give the manager delegated access to the mailboxes.

Full Access
Question # 24

An employee has left your organization and their Drive data must be retained for three years The retention rule has been set for three years You must ensure the employee's data is visible in Vault and accessible to the Vault Administrator in the most cost-effective way What should you do?

A.

Export the users Drive data from Vault, then delete the user.

B.

Assign an Archive User (AU) license to the user

C.

Change ownership of the Drive data to the user's Manager, then delete the user

D.

Suspend the user until the end of the three-year period

Full Access
Question # 25

Security and Compliance has identified that data is being leaked through a third-party application connected to Google Workspace. You want to investigate using an audit log.

What log should you use?

A.

Admin audit log

B.

SAML audit log

C.

Drive usage audit log

D.

OAuth Token audit log

Full Access
Question # 26

You are in the middle of migrating email from on-premises Microsoft Exchange to Google Workspace. Users that you have already migrated are complaining of messages from internal users going into spam folders. What should you do to ensure that internal messages do not go into Gmail spam while blocking spoofing attempts?

A.

Train users to click on Not Spam button for emails.

B.

Add all users of your domain to an approved sender list.

C.

Force TLS for your domain.

D.

Ensure that your inbound gateway is configured with all of your Exchange server IP addresses.

Full Access
Question # 27

Your organization has confidential internal content for which only authorized employees are allowed to access Access to this content is managed by using Google Groups Only administrators can create and manage membership You need to provide only the necessary functionality and follow the principle of least privilege What should you do?

A.

Make a dynamic group so security team members are automatically added

B.

Make a moderated group so all incoming communications can be monitored

C.

Use a group as a collaborative inbox that allows easier sharing

D.

Make a security group to apply access policies

Full Access
Question # 28

Your company has been engaged in a lawsuit, and the legal department has been asked to discover and hold all email for two specific users. Additionally, they have been asked to discover and hold any email referencing “Secret Project 123.”

What steps should you take to satisfy this request?

A.

Create a Matter and a Hold. Set the Hold to Gmail, set it to the top level Organization, and set the search terms to “secret project 123.” Create a second Hold. Set the second Hold to Gmail, set it to Accounts, and enter: user1 @your-company.com, user2@your-company.com. Save.

B.

Create a Matter and a Hold. Set the Hold to Gmail, set it to Accounts, and set the usernames to: user1@your-company.com, user2@your-company. Set the search terms to: (secret project 123). Save.

C.

Create a Matter and a Hold. Set the Hold to Gmail, set it to Accounts, and enter: user1@your- company.com AND user2@your-company.com. Set the search terms to: secret AND project AND 123. Save.

D.

Create a Matter and a Hold. Set the Hold to Gmail, set it to Accounts, and set the usernames to: user1@your-company.com, user2@your-company. Set the search terms to secret OR project OR 123. Save.

Full Access
Question # 29

You want to create a list of IP addresses that are approved to send email to your domain. To accomplish this, what section of the Google Workspace Admin console should you update?

A.

Bypass spam filter

B.

Content compliance rule

C.

Approved email denylist

D.

Email allowlist

Full Access
Question # 30

As the Workspace Administrator, you have been asked to configure Google Cloud Directory Sync (GCDS) in order to manage Google Group memberships from an internal LDAP server. However, multiple Google Groups must have their memberships managed manually. When you run the GCDS sync, you notice that these manually managed groups are being deleted. What should you do to prevent these groups from being deleted?

A.

In the GCDS configuration manager, update the group deletion policy setting to “don't delete Google groups not found in LDAP.”

B.

Use the Directory API to check and update the group’s membership after the GCDS sync is completed.

C.

Confirm that the base DN for the group email address attribute matches the base DN for the user email address attribute.

D.

In the user attribute settings of the GCDS configuration manager options, set the Google domain users deletion/suspension policy to “delete only active Google domain users not found in LDAP.”

Full Access
Question # 31

You have enabled Automatic Room Replacement for your calendar resources, but it is not working for any instances of a conflict booking. What could be the issue?

A.

Automatic Room Replacement does not work on recurring events.

B.

This feature requires calendar event owners to have the Buildings and resources administrator privilege

C.

The calendar resources do not have the Resource Category configured as CONFERENCE_ROOM

D.

The events have more than 20 attendees.

Full Access
Question # 32

In the years prior to your organization moving to Google Workspace, it was relatively common practice for users to create consumer Google accounts with their corporate email address (for example, to monitor Analytics, manage AdSense, and collaborate in Docs with other partners who were on Google Workspace.) You were able to address active employees’ use of consumer accounts during the rollout, and you are now concerned about blocking former employees who could potentially still have access to those services even though they don't have access to their corporate email account.

What should you do?

A.

Contact Google Enterprise Support to provide a list of all accounts on your domain(s) that access non-Google Workspace Google services and have them blocked.

B.

Use the Transfer Tool for Unmanaged Accounts to send requests to the former users to transfer their account to your domain as a managed account.

C.

Provide a list of all active employees to the managers of your company's Analytics, AdSense, etc. accounts, so they can clean up the respective access control lists.

D.

Provision former user accounts with Cloud Identity licenses, generate a new Google password, and place them in an OU with all Google Workspace and Other Google Services disabled.

Full Access
Question # 33

Your organization has enabled spoofing protection against unauthenticated domains. You are receiving complaints that email from multiple partners is not being received. While investigating this issue, you find that emails are all being sent to quarantine due to the configured safety setting. What should be the next step to allow uses to review these emails and reduce the internal complaints while keeping your environment secure?

A.

Add your partner domains IPs to the Inbound Gateway setting.

B.

Change the spoofing protection to deliver the emails to spam instead of quarantining them.

C.

Add your partner sending IP addresses to an allowlist.

D.

Change the spoofing protection to deliver the emails to inboxes with a custom warning instead of quarantining them.

Full Access
Question # 34

A company using Google Workspace has reports of cyber criminals trying to steal usernames and passwords to access critical business data. You need to protect the highly sensitive user accounts from unauthorized access.

What should you do?

A.

Turn on password expiration.

B.

Enforce 2FA with a physical security key.

C.

Use a third-party identity provider.

D.

Enforce 2FA with Google Authenticator app.

Full Access
Question # 35

Your organization is working on a confidential project with details that cannot be shared through email with anyone outside your organization You want to add controls in Gmail that prevent any mention of the project from being sent by employees Only the CEO and the CFO can send information about the project over email and without a delay What should you do?

A.

Configure the Gmail Restrict delivery setting and add an allowlist with all domains that your employees are allowed to send emails to Include the CEO and CFO email addresses to the allowlist

B.

Configure a Gmail Content compliance rule for outbound email that quarantines all email mentioning the project Bypass the rule by using the address list with the CEO and CFO email addresses.

C.

Configure a Gmail Content compliance rule for outbound email that quarantines all email mentioning the project Manually review all quarantined emails and choose to deliver the ones sent by the CEO and CFO

D.

Configure the Gmail Restrict delivery setting for all outgoing messages, except the internal emails Add the CEO and CFO email

Full Access
Question # 36

Users at your organization are reporting issues with Google Voice including disconnected calls and overall connection issues. You want to identify whether these issues affect just your organization or whether it's a global Google issue What should you do?

A.

Use the Security Investigation Tool with Voice Log Events as the data source field In the search operator fields select Event is and Network Statistics (client) Analyze the packet loss

B.

Verify if there is a service outage for Google Voice reported on the Google Workspace Status Dashboard

C.

Use the Security investigation Tool with User Log Events as the data source field In the search operator fields select Event is and Call failed Analyze the packet loss

D.

Verify if there is a service interruption for Google Voice reported on the Google Workspace Updates Blog website

Full Access
Question # 37

The Director of your Finance department has asked to be alerted if two financial auditors share any files outside the domain. You need to set an Admin Alert on Drive Sharing.

What should you do?

A.

Create a Google Group that has the two auditors as members, and then create a Drive DLP Rule that is assigned to that Group.

B.

Create a Content Compliance rule that looks for outbound share notifications from those two users, and Bcc the Director on those emails.

C.

Create two Drive Audit Alerts, one for each user, where the Visibility is “Shared Externally,” and email them to the Director.

D.

Check the Admin Console Dashboard Insights page periodically for external shares, and notify the Director of any changes.

Full Access
Question # 38

Your company has just received a shipment of ten Chromebooks to be deployed across the company, four of which will be used by remote employees. In order to prepare them for use, you need to register them in Google Workspace.

What should you do?

A.

Turn on the Chromebook and press Ctrl+Alt+E at the login screen to begin enterprise enrollment.

B.

In Chrome Management | Device Settings, enable Forced Re-enrollment for all devices.

C.

Turn on the chromebook and log in as a Chrome Device admin. Press Ctrl+Alt+E to begin enterprise enrollment.

D.

Instruct the employees to log in to the Chromebook. Upon login, the auto enrollment process will begin.

Full Access
Question # 39

Your company has acquired a new company in Japan and wants to add all employees of the acquisition to your existing Google Workspace domain. The new company will retain its original domain for email addresses and, due to the very sensitive nature of its work, the new employees should not be visible in the global directory. However, they should be visible within each company's separate directory. What should you do to meet these requirements?

A.

Create a new Google Workspace domain isolated from the existing one, and create users in the new domain instead.

B.

Under Directory Settings > Contact sharing, disable the contact sharing option and wait for 24 hours to allow the settings to propagate before creating the new employee accounts.

C.

Redesign your OU organization to have 2 child OUs for each company directly under the root. In Directory Settings > Visibility Settings, define custom directories for each company, and set up Visibility according to the OU.

D.

Create one dynamic group for each company based on a custom attribute defining the company. In Directory Settings > Visibility Settings, define custom directories for each company, and set up Visibility according to the dynamic group.

Full Access
Question # 40

Your employer, a media and entertainment company, wants to provision Google Workspace Enterprise accounts on your domain for several world-famous celebrities. Leadership is concerned with ensuring that these VIPs are afforded a high degree of privacy. Only a small group of senior employees must be able to look up contact information and initiate collaboration with the VIPs using Google Workspace services such as Docs, Chat, and Calendar.

You are responsible for configuring to meet these requirements. What should you do?

A.

In the Users list, find the VIPs and turn off the User setting “Directory Sharing.”

B.

Create a Group for the VIPs and their handlers, and set the Group Access Level to Restricted.

C.

In Directory Settings, disable Contact Sharing.

D.

Create separate Custom Directories for the VIPs and regular employees.

Full Access
Question # 41

Your large organization, 80,000 users, has been on Google for two years. Your CTO wants to create an integrated team experience with Google Groups, Teams Drives, and Calendar. Users will use a Google Form and Apps Script to request a new “G-Team.” A “G-Team’ is composed of a Google Group and a Team Drive/ Secondary Calendar that is shared using that Google Group.

What two design decisions are required to implement this workflow securely? (Choose two.)

A.

The Apps Script will need to run as a Google Workspace admin.

B.

You will need a Cloud SQL instance to store “G-Team’ data.

C.

The Google Form will need to be limited to internal users only.

D.

The Apps Script will need to run on a timed interval to process new entries.

E.

The Google Form will need to enforce Group naming conventions.

Full Access
Question # 42

As a Workspace Administrator, you want to keep an inventory of the computers and mobile devices your company owns in order to track details such as device type and who the device is assigned to. How should you add the devices to the company-owned inventory?

A.

Download the company owned inventory template CSV file from the admin panel, enter the serial number of the devices, and upload it back to the company owned inventory in the admin panel.

B.

Download the company owned inventory template CSV file from the admin panel, enter the Device OS, serial number and upload it back to the company owned inventory in the admin panel.

C.

Download the company owned inventory template CSV file from the admin panel, enter the asset tag of the devices, and upload it back to the company owned inventory in the admin panel.

D.

Download the company owned inventory template CSV file from the admin panel, enter the Device OS, asset tag and upload it back to the company owned inventory in the admin panel.

Full Access
Question # 43

Madeupcorp.com is in the process of migrating from a third-party email system to Google Workspace. The VP of Marketing is concerned that her team already administers the corporate AdSense, AdWords, and YouTube channels using their @madeupcorp.com email addresses, but has not tracked which users have access to which service. You need to ensure that there is no disruption.

What should you do?

A.

Run the Transfer Tool for Unmanaged users.

B.

Use a Google Form to survey the Marketing department users.

C.

Assure the VP that there is no action required to configure Google Workspace.

D.

Contact Google Enterprise Support to identify affected users.

Full Access
Question # 44

Your sales team, which is organized as its own organizational unit, is prone to receiving malicious attachments. What action should you take, as an administrator, to apply an additional layer of protection in the admin console for your sales team without disrupting business operation?

A.

Configure an attachment compliance rule to send any emails with attachments received by users within the sales team organizational unit to an administrator quarantine.

B.

Configure an attachment compliance rule to strip any attachments received by users within the sales team organizational unit.

C.

Configure the security sandbox feature on the sales team organizational unit.

D.

Update the Email Allowlist in the admin console to only include IP addresses of known senders.

Full Access
Question # 45

A user is reporting that after they sign in to Gmail, their labels are not loading and buttons are not responsive. What action should you take to troubleshoot this issue with the user?

A.

Collect full message headers for examination.

B.

Check whether the issue occurs when the user authenticates on a different device or a new incognito window.

C.

Check whether a ping test to service.gmail.com (pop.gmail.com or imap.gmail.com) is successful.

D.

Check whether traceroute to service.gmail.com (pop.gmail.com or imap.gmail.com) is successful.

Full Access
Question # 46

A disgruntled employee has left your company and deleted all their email messages and files in Google Drive. The security team is aware that some intellectual property may have surfaced on a public social media site. What is the first step to start an investigation into this leak?

A.

Delete the user's account in the Admin Console.

B.

Transfer data between end user Workspace accounts.

C.

Instruct a Google Vault admin to create a matter, and place all the user data on ‘hold.’

D.

Use Google Vault to export all the user data and share among the security team.

Full Access
Question # 47

Your admin quarantine is becoming a burden to manage due to a consistently high influx of messages that match the content compliance rule Your security team will not allow you to remove or relax this rule, and as a result, you need assistance processing the messages in the quarantine. What is the first step you should take to enable others to help manage the quarantine, while maintaining security?

A.

Give the users super admin rights to view the admin quarantine.

B.

Give the users Services > Gmail > Access Admin Quarantine admin privileges.

C.

Configure the admin quarantine to allow end users to release messages.

D.

Give the users Services > Security Center admin privileges.

Full Access
Question # 48

Your global marketing team has over 500 employees. They recently started working with Google Analytics and want to move to managed accounts You decide to use Google Cloud Directory Sync (GCDS) to sync users from your current identity provider Your organization currently has no Google Workspace licenses linked to the Admin console You run GCDS for the first lime and receive the following error. "Domain user limit reached " You need to identify and fix the problem What should you do?

A.

Ensure that there is a subscription available and enough licenses to sync the new users

B.

Check if GCDS has the correct permissions to run a sync on your domain

C.

Wait 48 hours until the domain is fully provisioned

D.

Update the delete limits of GCDS and try again

Full Access
Question # 49

Your company has decided to change SSO providers. Instead of authenticating into Google Workspace and other cloud services with an external SSO system, you will now be using Google as the Identity Provider (IDP) and SSO provider to your other third-party cloud services.

What two features are essential to reconfigure in Google Workspace? (Choose two.)

A.

Apps > add SAML apps to your domain.

B.

Reconfigure user provisioning via Google Cloud Directory Sync.

C.

Replace the third-party IDP verification certificate.

D.

Disable SSO with third party IDP.

E.

Enable API Permissions for Google Cloud Platform.

Full Access
Question # 50

Your company policy requires that managers be provided access to Drive data once an employee leaves the company.

How should you grant this access?

A.

Make the manager a delegate to the former employee's account.

B.

Copy the data from the former employee’s My Drive to the manager's My Drive.

C.

Transfer ownership of all Drive data using the file transfer ownership tool in the Google Workspace Admin console.

D.

Login as the user and add the manager to the file permissions using the “Is owner’ privilege for all Drive files.

Full Access
Question # 51

The CEO of your company has indicated that messages from trusted contacts are being delivered to spam, and it is significantly affecting their work. The messages from these contacts have not always been classified

as spam. Additionally, you recently configured SPF, DKIM, and DMARC for your domain. You have been tasked with troubleshooting the issue.

What two actions should you take? (Choose two.)

A.

Obtain the message header and analyze using Google Workspace Toolbox.

B.

Review the contents of the messages in Google Vault.

C.

Set up a Gmail routing rule to whitelist the sender.

D.

Conduct an Email log search to trace the message route.

E.

Validate that your domain is not on the Spamhaus blacklist.

Full Access
Question # 52

Your company is using macOS devices for all employees and has built a process to allow a Google account to be used as credentials (or the device Your company wants to manage newly acquired Windows 10 devices with Google Workspace endpoint management and have employees use their Google Workspace account as login credentials for Windows 10 Which steps should you take to enable this?

Choose 2 answers

A.

Install and configure Google Credential Provider for Windows (GCPW) on each device

B.

Configure Chrome policies on Windows to push advanced device management policies

C.

Enable Windows device management in Devices > Mobile & endpoints > Settings > Windows settings

D.

Sync the Google Accounts and password to AD via Google Cloud Directory Sync V1 (GCDS)

E.

Install and configure Password Sync on each Active Directory (AD) domain controller

Full Access
Question # 53

An end user informs you that they are having issues receiving mail from a specific sender that is external to your organization. You believe the issue may be caused by the external entity’s SPF record being incorrectly configured. Which troubleshooting step allows you to examine the full message headers for the offending message to determine why the messages are not being delivered?

A.

Use the Postmaster Tools API to pull the message headers.

B.

Use the Email Log Search to directly review the message headers.

C.

Use the Security Investigation Tool to review the message headers.

D.

Perform an SPF record check on the domain to determine whether their SPF record is valid.

Full Access
Question # 54

Your organization uses a third-party product to filter mail before it arrives at your Workspace Domain. How should you configure Gmail to ensure that inbound messages are not seen as a spam attack due to the volume of mail being received from this product?

A.

Add the product's IP addresses as an approved sender.

B.

Allowlist the IP addresses of the third-party filtering product.

C.

Add the product's IP addresses to your organization's SPF record.

D.

List the IP addresses of the product as an Inbound Gateway.

Full Access
Question # 55

The nature of your organization's business makes your users susceptible to malicious email attachments. How should you implement a scan of all incoming email attachments?

A.

Configure a safety rule to protect against encrypted attachments from untrusted senders

B.

Configure a safety rule to protect against attachments with scripts from untrusted senders.

C.

In the security sandbox section, enable virtual execution of attachments for (he targeted OU

D.

In the security sandbox section, enable virtual execution of attachments for the entire organization.

Full Access
Question # 56

A user does not follow their usual sign-in pattern and signs in from an unusual location.

What type of alert is triggered by this event?

A.

Suspicious mobile activity alert.

B.

Suspicious login activity alert.

C.

Leaked password alert.

D.

User sign-in alert.

Full Access
Question # 57

Your chief compliance officer is concerned about API access to organization data across different cloud vendors. He has tasked you with compiling a list of applications that have API access to Google Workspace data, the data they have access to, and the number of users who are using the applications.

How should you compile the data being requested?

A.

Review the authorized applications for each user via the Google Workspace Admin panel.

B.

Create a survey via Google forms, and collect the application data from users.

C.

Review the token audit log, and compile a list of all the applications and their scopes.

D.

Review the API permissions installed apps list, and export the list.

Full Access
Question # 58

Your company uses a whitelisting approach to manage third-party apps and add-ons. The Senior VP of Sales

& Marketing has urgently requested access to a new Marketplace app that has not previously been vetted. The company’s Information Security policy empowers you, as a Google Workspace admin, to grant provisional access immediately if all of the following conditions are met:

  • Access to the app is restricted to specific individuals by request only.
  • The app does not have the ability to read or manage emails.
  • Immediate notice is given to the Infosec team, followed by the submission of a security risk analysis report within 14 days.

Which actions should you take first to ensure that you are compliant with Infosec policy?

A.

Move the Senior VP to a sub-OU before enabling Marketplace Settings > “Allow Users to Install Any App from Google Workspace Marketplace.”

B.

Confirm that the Senior VP’s OU has the following Gmail setting disabled before whitelisting the app: “Let users delegate access to their mailbox.”

C.

Add the Marketplace app, then review the authorized scopes in Security > Manage API client access.

D.

Search the Google Workspace support forum for feedback about the app to include in the risk analysis report.

Full Access