Free Google-Workspace-Administrator Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

To audit if [email protected] has shared any sensitive documents outside the organization, use

the Security Investigation Tool in the Google Admin console. This tool allows administrators to

investigate and take action on security issues within the organization.

Open Security Investigation Tool:

Go to the Google Admin console.

Navigate to Security > Investigation tool.

Set Conditions in Drive Log Events:

In the Investigation Tool, select the data source as "Drive Log Events".

Add the following conditions:

Visibility Is External: This filters the events to show only documents that have been shared externally.

Actor Is [email protected]: This specifies that the actions performed by the [email protected]

should be displayed.

Run the Investigation:

Click on “Search” to run the investigation with the specified conditions.

Review the results to identify any documents that have been shared externally by the user.

Remediate:

For any documents that were shared inappropriately, you can take corrective actions such as

changing permissions or removing external sharing.

Reference:

Security Investigation Tool

Audit Drive log events

To enable others to help manage the admin quarantine while maintaining security, give the users

Services > Gmail > Access Admin Quarantine admin privileges. This specific privilege allows

designated users to view and manage the admin quarantine without granting excessive

administrative rights.

Go to the Admin console.

Navigate to Account > Admin roles.

Select the role that you want to assign to users or create a new role.

Assign the "Services > Gmail > Access Admin Quarantine" privilege to the role.

Add the users to this role.

Reference:

Google Workspace Admin Help: Admin quarantine

Testing on Different Device or Incognito Window:

This helps determine if the issue is related to the user's current device, browser, or cached data.

Incognito mode runs a clean session without extensions or cached data, which can help identify if

browser settings or cache are causing the issue.

Steps to Test:

Ask the user to sign in to Gmail on a different device (e.g., another computer or mobile phone).

Alternatively, instruct the user to open a new incognito or private browsing window in their browser

and sign in to Gmail.

Observe if the problem persists in these different environments.

Reference

Google Workspace Admin Help: Troubleshoot Gmail Issues

Access Admin Console: Log in to the Google Admin console.

Navigate to Admin Roles: Go to Admin roles under Account settings.

Create Custom Role: Click on 'Create new role' and name it appropriately.

Assign Vault Privileges: Select the privileges related to Google Vault, including managing matters,

holds, searches, and exports.

Assign Role to User: Assign this custom role to the designated administrator who will handle the

security investigations.

Verify Access: Ensure that the new administrator has the necessary access to Google Vault to monitor

and manage ongoing security investigations.

Reference:

Google Workspace Admin Help - Create Custom Admin Roles

Google Workspace Admin Help - Google Vault Privileges

To fulfill the request from the head of marketing, you need to:

Create an isolated Organizational Unit (OU) for the consultants who need restricted contact access.

This helps in managing and applying specific policies to the consultants without affecting other users.

Create a group that includes the contacts the consultant is allowed to view. This group will contain

the marketing team members' contact details, ensuring that the consultant has access only to these

specific contacts.

Reference:

Google Workspace Admin Help - Manage user access to contacts

Google Workspace Admin Help - Create and manage groups

Create a Matter: Access Google Vault and create a new matter for the lawsuit. Matters are used to

manage legal holds and searches.

Create a Hold: Within the matter, create a new hold.

Set the Hold Scope: Set the hold scope to Gmail, since the requirement is to discover and hold

emails.

Specify Accounts: Set the usernames to [email protected] and [email protected].

This ensures that all emails for these specific users are held.

Set Search Terms: Use the search terms “secret project 123” to hold any emails that reference this

specific term. This is a broad search that captures any email mentioning "Secret Project 123."

Save the Hold: Save the hold to ensure that it captures all relevant emails for the specified users and

the search term.

Reference

Google Support: Create or update a hold

Secure Transport Compliance:

TLS (Transport Layer Security) ensures that emails are encrypted during transit between sending and

receiving email servers.

Setting up secure transport compliance ensures that emails sent to or received from a particular

domain use TLS.

Steps to Enforce TLS:

Navigate to the Google Admin console.

Go to Apps > Google Workspace > Gmail > Advanced settings.

In the "Compliance" section, select "Secure transport (TLS) compliance".

Click "Add setting" and configure the following:

Select the appropriate organizational unit.

Specify the receiving domain(s) for which TLS should be enforced.

Choose to enforce TLS for incoming, outgoing, or both types of messages.

Save the changes and apply them.

Reference

Google Workspace Admin Help: Set Up TLS Compliance

Open Developer Tools:

In Chrome, click the three dots menu (More).

Select "More Tools" > "Developer Tools".

Replicate the Error:

Go to the "Network" tab in Developer Tools.

Reload the Gmail page to replicate the 500 error.

Export HAR:

After the error is replicated, right-click on the network log.

Select "Save all as HAR with content".

Save the HAR file, which contains detailed logs of the network activity.

This file can then be provided to Google support for further analysis.

Reference

Google Workspace Admin Help: Troubleshooting Network Issues

Access the Admin Console: Log into your Google Workspace Admin Console.

Navigate to Security Settings: Go to the Security section in the Admin Console.

Password Recovery: Enable the option for non-admin password recovery. This feature allows users to

reset their own passwords using their recovery email address or phone number without needing to

contact the helpdesk.

Configure Recovery Options: Ensure users have their recovery options set up (recovery email and

phone number) so they can use this feature effectively.

Inform Users: Notify users about this new self-service password recovery option and provide

instructions on how to use it.

Reference

Google Support: Set up self-service password recovery

To ensure that the Context-Aware Access policy is working correctly, perform the following checks:

Confirm Google Workspace License:

Verify that the user has a Google Workspace Enterprise Plus license. Context-Aware Access is a

feature available only to Enterprise Plus customers.

In the Admin console, navigate to Billing > Subscriptions and confirm the license type assigned to the

user.

Check Endpoint Verification:

Ensure that Endpoint Verification is installed and active on users’ desktops.

Go to the Admin console, navigate to Devices > Endpoint Verification.

Check the list of devices to confirm that Endpoint Verification is installed and reporting the status of

users' devices.

Additional Steps:

Ensure that policies are correctly configured and applied to the relevant Organizational Units (OUs).

Verify that the Context-Aware Access policies are correctly set up in Security > Context-Aware Access.

By confirming the correct license and ensuring Endpoint Verification is installed, you can

troubleshoot and resolve issues related to Context-Aware Access policy enforcement.

Reference:

Set up Context-Aware Access

Endpoint Verification overview

Additional GCDS Instance:

Running a separate instance of GCDS on another server allows you to manage synchronization for the

acquired organization independently.

This avoids conflicts and simplifies management for different LDAP directories.

Multiple LDAP Version:

Upgrading to the multiple LDAP version of GCDS supports synchronizing data from multiple LDAP

directories.

This is useful for handling different organizations with distinct LDAP setups.

Steps for Setting Up:

Install a second instance of GCDS on a separate server.

Configure the new instance with the acquired organization's LDAP details.

If using the multiple LDAP version, upgrade your existing GCDS setup and configure rules for both

LDAP directories.

Test the synchronization to ensure proper setup and no conflicts.

Reference

Google Workspace Admin Help: Set Up GCDS

Inbound Gateway Configuration:

An inbound mail gateway ensures that all incoming emails are routed through specified servers.

Configuring the inbound gateway to recognize your Exchange server IP addresses prevents internal

emails from being marked as spam.

Steps to Configure:

Go to the Google Admin console.

Navigate to Apps > Google Workspace > Gmail > Advanced settings.

Scroll to the "Spam, Phishing, and Malware" section.

Configure the "Inbound Gateway" settings:

Add your Exchange server IP addresses.

Ensure these addresses are listed as trusted sources.

Reference

Google Workspace Admin Help: Configure Inbound Mail Gateway

Sign in to the Google Admin console.

From the Admin console Home page, go to "Security" and then "Login challenges."

Enable the "Employee ID login challenge" setting.

Configure the challenge by defining the employee IDs that users need to provide during the login

process.

Enabling Employee ID login challenges adds an additional layer of security without requiring 2-Step

verification. This helps prevent unauthorized access by ensuring that users provide an additional

piece of information known only to them.

Reference:

Google Workspace Admin Help - Configure login challenges

“?>>?b GF\]\rom the Admin console Home page, go to "Security."

Under "Security," select "API controls."

In the "API controls" section, click on "Manage Third-Party App Access."

Find the Google Drive API in the list.

Choose "Disable All Access" for Google Drive to ensure that no third-party apps have OAuth

permissions to Google Drive.

This configuration adheres to the policy set by the Chief Information Security Officer by preventing

third-party apps from accessing Google Drive via OAuth.

Reference:

Google Workspace Admin Help - Manage API client access

Sign in to the Google Admin console.

From the Admin console Home page, go to "Apps" and then "Google Workspace" and "Gmail."

Select "Compliance" and then "Content compliance."

Click on "Add another rule" to create a new content compliance rule.

In the new rule setup, specify conditions:

For "Email messages to affect," choose "Outbound" and "Internal - sending."

Under "Add expressions," select "If ANY of the following match the message" and choose

"Predefined content match," then select "Credit Card Numbers."

In the "Actions" section, select "Add more recipients" and specify the custom header your encryption

provider uses.

Save the rule.

This ensures that emails containing credit card numbers are flagged and encrypted by your third-

party encryption provider, fulfilling the security requirements set by your cyber security team.

Reference:

Google Workspace Admin Help - Set up rules for content compliance

When configuring Google Cloud Directory Sync (GCDS) to manage Google Group memberships from

an internal LDAP server, it’s crucial to ensure that manually managed groups are not inadvertently

deleted during the sync process. The correct setting to prevent this is found within the GCDS

configuration manager.

Access GCDS Configuration Manager:

Open the GCDS configuration manager on your server.

Navigate to Group Settings:

Go to the section where group settings are configured.

Update Group Deletion Policy:

Find the group deletion policy setting.

Change the policy to “don't delete Google groups not found in LDAP.”

Save Configuration:

Save the updated configuration to ensure that the settings are applied during the next

synchronization.

By updating this setting, GCDS will no longer delete Google Groups that are not found in LDAP,

thereby preserving manually managed groups.

Reference:

Google Cloud Directory Sync Admin Help

GCDS Configuration Guide

To prevent data exfiltration from Google apps on iOS devices, you need to configure the appropriate

settings in the Google Admin console.

Navigate to Device Management:

In the Google Admin console, go to Devices > Mobile and endpoints > Universal Settings > iOS

settings.

Configure Data Protection Settings:

Find the setting for "Allow items created with managed apps to open in unmanaged apps".

Clear this checkbox to prevent users from copying data from managed (work) apps to unmanaged

(personal) apps.

Save Changes:

Save the changes to ensure that the policy is enforced.

Verification:

Verify that the policy is applied by checking the behavior on an iOS device to ensure that data cannot

be copied from managed apps to unmanaged apps or third-party applications.

By clearing this checkbox, you enforce a policy that restricts the movement of data from managed

apps to unmanaged environments, thereby preventing data exfiltration.

Reference:

Manage iOS settings

Endpoint management settings

To recover user accounts deleted two weeks ago:

Sign in to the Admin console as a Super Admin.

Navigate to user management.

Use the filter to select "recently deleted" users.

Recover the deleted user accounts from the list.

Google Workspace allows recovery of deleted users within a 20-day window.

Reference:

Google Workspace Admin Help: Restore a recently deleted user

Access Admin Console: Log into your Google Workspace Admin Console.

Navigate to Alert Center: Go to Security > Alert Center.

Enable Alert Rule: Find and enable the “Suspended user made active” rule.

Configure Recipients: In the alert rule settings, add the CTO as an additional recipient under the

“Other Recipients” section.

Save Settings: Save the configuration. The CTO will now receive notifications whenever a suspended

user’s account is re-enabled, ensuring compliance with the new security policy.

Reference

Google Support: Alert Center

Create Secondary Calendar: As the team manager, create a new calendar under your Google account

specifically for tracking team vacations.

Access Settings: Go to the calendar settings and navigate to "Share with specific people".

Grant Access: Add your team members and give them "Make changes to events" access, allowing

them to add their vacation times directly to the calendar.

Educate Team: Inform team members on how to use this calendar to add their vacation times and

check others' schedules.

Monitor Usage: Regularly review the calendar to ensure it is being used correctly and effectively by

all team members.

Reference:

Google Workspace Admin Help - Share a Calendar

Google Workspace Admin Help - Create a Team Calendar

Admin Console: Log into the Google Admin console at admin.google.com.

Enable Advanced Mobile Management for Sales OU:

Navigate to Devices > Mobile & endpoints > Settings.

Select the Sales OU and turn on Advanced Mobile Management.

Set Up an Apple Push Certificate:

Go to Devices > Mobile & endpoints > Apple certificates.

Follow the instructions to obtain and upload an Apple Push Certificate.

Device Policies:

After setting up the Apple Push Certificate, configure the desired device policies such as password

policies, app distribution, and remote wipe capabilities.

Reference

Google Workspace Admin: Set up advanced mobile management

Google Workspace Admin: Set up an Apple Push Certificate