PGWA practice questions 91–100

1. Question 91 · 151 in bank

   Your organization is about to expand by acquiring two companies, both of which are using Google Workspace. The CISO has mandated that strict ‘No external content sharing’ policies must be in place and followed. How should you securely configure sharing policies to satisfy both the CISO’s mandate while allowing external sharing with the newly acquired companies?

   • AAllow external sharing of Drive content for the IT group only.
   • BCreate a Drive DLP policy that will allow sharing to only domains on an allowlist.
   • CUse shared drives to store the content, and share only individual files externally.
   • DLet users share files between the two companies by using the ‘Trusted Domains’ feature. Create an allowlist of the trusted domains, and choose sharing settings for the users.

   Show answer

   Answer: D

   Explanation

   Option D: Let users share files between the two companies using the 'Trusted Domains' feature. Create an allowlist of the trusted domains and choose sharing settings for the users. By using the 'Trusted Domains' feature, you can specify the domains that are allowed for external sharing while restricting sharing with other domains. This allows users from the newly acquired companies to share files and collaborate with your organization, while still maintaining strict restrictions on general external content sharing. This approach provides a controlled and secure environment for sharing files between the two organizations, as the sharing is limited to the trusted domains specified in the allowlist.

   Source: Adapted from community discussion — karl19

   References

   • support.google.com documentation

   Next question

2. Question 92 · 151 in bank

   Your company is using Google Workspace Enterprise Plus, and the Human Resources (HR) department is asking for access to Work Insights to analyze adoption of Google Workspace for all company employees. You assigned a custom role with the work Insights permission set as “view data for all teams” to the HR group, but it is reporting an error when accessing the application. What should you do?

   • AAllocate the “view data for all teams” permission to all employees of the company.
   • BConfirm that the Work Insights app is turned ON for all employees.
   • CConfirm in Security > API controls > App Access Controls that Work Insights API is set to “unrestricted.”
   • DConfirm in Reports > BigQuery Export that the job is enabled.

   Show answer

   Answer: B

   Explanation

   Correcting myself here, after reviewing the question a second time.. i go for option B.. first here is the documentation of the View data for all teams priviledge: https://support.google.com/a/answer/9135419?fl=1#zippy=%2Cstep-understand-work-insights-privileges Then here is the documentation about turning the service On and it mentions, it will not have access unless the appropiate privilege is granted, so it already has the correct privilege, just need to confirm that the app is on: https://support.google.com/a/answer/9135183?fl=1#zippy=%2Cstep-turn-work-insights-on-or-off-for-organizational-units I was able to test on an Enterprise edition and this is the correct answer because I did not find it under API controls > apps.. or not sure if I did it incorrectly but indeed B seems correct here.

   Source: Adapted from community discussion — jaxclain

   References

   • support.google.com documentation
   • support.google.com documentation

   Next question

3. Question 93 · 151 in bank

   Select 2

   You received this email from the head of marketing: Hello Workspace Admin: Next week, a new consultant will be starting on the “massive marketing mailing” project. We want to ensure that they can view contact details of the rest of the marketing team, but they should not have access to view contact details of anyone else here at our company. Is this something that you can help with? What are two of the steps you need to perform to fulfill this request? (Choose two.)

   • ACreate an isolated OU for the consultants who need the restricted contacts access.
   • BCreate a group that includes the contacts that the consultant is allowed to view.
   • CApply the role of owner to the consultant in the group settings.
   • DCreate the consultant inside under the marketing OU.
   • EEnsure that you have the Administrator Privilege of Services > Services settings and that Services > Contacts > Contacts Settings Message is set.

   Show answer

   Answer: AB

   Explanation

   Option A: Create an isolated OU for the consultants who need restricted contacts access: By creating a separate organizational unit (OU) specifically for the consultants, you can apply different access policies and permissions to that OU. This allows you to control the visibility of contact details for the marketing team while restricting access to other company contacts. Option B: Create a group that includes the contacts the consultant is allowed to view: Create a group specifically for the marketing team contacts that the consultant should be able to access. Add the relevant marketing team members to this group. By granting access to this group, the consultant will be able to view the contact details of the marketing team members. Please note that options C, D, and E are not directly related to fulfilling the request mentioned in the email and are not necessary for achieving the desired outcome.

   Source: Adapted from community discussion — karl19

   References

   • support.google.com documentation

   Next question

4. Question 94 · 151 in bank

   A disgruntled employee has left your company and deleted all their email messages and files in Google Drive. The security team is aware that some intellectual property may have surfaced on a public social media site. What is the first step to start an investigation into this leak?

   • ADelete the user's account in the Admin Console.
   • BTransfer data between end user Workspace accounts.
   • CInstruct a Google Vault admin to create a matter, and place all the user data on ‘hold.’
   • DUse Google Vault to export all the user data and share among the security team.

   Show answer

   Answer: C

   Explanation

   If it was me, I would just search for the users data then share it with the security team. If there is not any retention policy applied then yes a Hold but most companies have Vault retention to indefinite so there is no need to use a Hold but for this question (bad elaborated) then yes, the correct answer is C, because there is no mention of what retention policies they are using. https://support.google.com/vault/answer/7664657?hl=en#zippy=%2Cwhats-the-difference-between-a-hold-and-a-retention-rule

   Source: Adapted from community discussion — jaxclain

   References

   • support.google.com documentation

   Next question

5. Question 95 · 151 in bank

   Users in your organization are routinely complaining that they receive messages containing words of profanity they find inappropriate in a professional setting. As the administrator, what steps should you take to prevent the messages from being delivered to users’ mailboxes?

   • AConfigure an objectionable content rule.
   • BConfigure an attachment compliance rule.
   • CEnable optical character recognition (OCR).
   • DSet up a Gmail DLP policy.

   Show answer

   Answer: A

   References

   • support.google.com documentation

   Next question

6. Question 96 · 151 in bank

   A user joined your organization and is reporting that every time they start their computer they are asked to sign in. This behavior differs from what other users within the organization experience. Others are prompted to sign in biweekly. What is the first step you should take to troubleshoot this issue for the individual user?

   • AReset the user’s sign-in cookies.
   • BConfirm that this user has their employee ID populated as a sign-in challenge.
   • CCheck the session length duration for the organizational unit the user is provisioned in.
   • DVerify that 2-Step Verification is enforced for this user.

   Show answer

   Answer: C

   Explanation

   Correct answer is C - checking the session length. User may be in an OU w/more rigid (less than 24 hours) while other in the org session length is 14 days https://support.google.com/a/answer/7576830?hl=en&fl=1&sjid=18033713616032115750-NA

   Source: Adapted from community discussion — cloudguy2

   References

   • support.google.com documentation

   Next question

7. Question 97 · 151 in bank

   Select 2

   Your organization recently implemented context-aware access policies for Google Drive to allow users to access Drive only from corporate managed desktops. Unfortunately, some users can still access Drive from non-corporate managed machines. What preliminary checks should you perform to find out why the Context-Aware Access policy is not working as intended? (Choose two.)

   • AConfirm that the user has a Google Workspace Enterprise Plus license.
   • BDelete and recreate a new Context-Aware Access device policy.
   • CCheck whether device policy application is installed on users’ devices.
   • DConfirm that the user has at least a Google Workspace Business license.
   • ECheck whether Endpoint Verification is installed on users’ desktops.

   Show answer

   Answer: AE

   Explanation

   Agree, the first answer should be the Enterprise license (A) https://support.google.com/a/answer/9275380?hl=en&fl=1 And we need to check whether the end point verification is installed or not (E), the endpoint verification can be use to filter the approved devices https://support.google.com/a/answer/9007320?hl=en&fl=1

   Source: Adapted from community discussion — HM2H

   References

   • support.google.com documentation
   • support.google.com documentation
   • support.google.com documentation
   • support.google.com documentation
   • support.google.com documentation

   Next question

8. Question 98 · 151 in bank

   Select 2

   Your organization has a new security requirement around data exfiltration on iOS devices. You have a requirement to prevent users from copying content from a Google app (Gmail, Drive, Docs, Sheets, and Slides) in their work account to a Google app in their personal account or a third-party app. What steps should you take from the admin panel to prevent users from copying data from work to personal apps on iOS devices? (Choose two.)

   • AClear the “allow users to copy data to personal apps” checkbox.
   • BTurn on “Advanced Mobile Management.”
   • CNavigate to Devices > Mobile and Endpoint > iOS Settings > Data Sharing > Data Protection.
   • DNavigate to Devices > Mobile and Endpoint > iOS Settings > Data Sharing > Open Docs in Unmanaged Apps.
   • EClear the “allow items created with managed apps to open in unmanaged apps” checkbox.

   Show answer

   Answer: AC

   Explanation

   B - not correct because Data protection works for basic and advanced mobile management D- not correct - the path to E E - not correct - they can still open docs but not copying it

   Source: Adapted from community discussion — Bardapapa

   References

   • support.google.com documentation
   • support.google.com documentation

   Next question

9. Question 99 · 151 in bank

   You have been asked to set up a new Google Group for your Human Resources department as they onboard staff. The membership of the group will change often. The HR team and all group members need to be able to send messages to and receive messages from all members of the group. They are worried that new staff may accidentally post personal information to the group. How do you configure the Google Group to prevent onboarded staff from sharing sensitive information to all group members?

   • AWhen provisioning the group, configure it as DLP enabled and select PII from the list of “Content Detectors”.
   • BConfigure the group so that members cannot view group conversations.
   • CConfigure the group with new member post moderation.
   • DConfigure the group so only Owners or Managers can post to the group.

   Show answer

   Answer: C

   Explanation

   Correct is C : Moderation. New messages must be approved by managers or owners to be sure there is no personal information posted. Member should be added using Google Groups to have the New member status instead of Google Admin. Publication restrictions for New members should be removed by group owner or admin. A : DLP / Content Detectors work only on outbound messages B : "all group members need to be able to send messages to and receive messages from all members of the group". If members cannot view group conversations, they can't receive too. D : Owners or Managers can post to the group : same as B, if members cannot post group conversations, they can't send messages.

   Source: Adapted from community discussion — jcloud965

   References

   • support.google.com documentation

   Next question

10. Question 100 · 151 in bank

    You are the administrator for a 30,000-user organization. You have multiple Workspace licensing options available to end users in your domain, according to their work responsibilities. A user may be transitioned to a different license type multiple times in a given year. Your organization has a high turnover rate for employees. What is the most efficient way to manage your organization’s licensing?

    • AUse the Directory API to create a custom batch script that modifies the users license on a daily basis.
    • BCreate a license assignment rule in the Google Admin console to set user licensing based on directory attributes.
    • CUse Google Cloud Directory Sync to modify user licensing with each sync, according to information available in the organization’s LDAP.
    • DUpdate user licensing in the user portion of the Admin console on an as-needed basis.

    Show answer

    Answer: C

    Explanation

    C is correct. GCDS can use different rules to assign licenses based on LDAP query. GCDS can also (un)archive users the same way. A. The Directory API can't update license. License Manager API should be used. B. The only assignment rule available in the Google Admin console is based on the Org Unit. There is no way to choose based on directory attributes. D. Not efficient with 30,000 users and multiple changes in a given year

    Source: Adapted from community discussion — jcloud965

    References

    • support.google.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PGWA practice, question 91. 151 questions available.