PGWA practice questions 21–30

1. Question 21 · 151 in bank

   An employee has been leaking confidential salary information to an external party. You must use Vault to preserve the messages for an investigation. What should you do?

   • ACreate a matter and add a hold on the employee's email.
   • BUse the security investigation tool to find the messages. Create a hold to preserve the messages.
   • CCreate a custom retention policy. Use the audit feature to view captured email logs.
   • DUse the search and export features to find all the messages sent externally.

   Show answer

   Answer: A

   Next question

2. Question 22 · 151 in bank

   The compliance team at your organization is conducting a legal investigation into some concerning sales activities of an employee eight months ago. The compliance team contacted you for assistance on the situation. You set up the default Google Vault retention rules so all data is retained only for one year. You must assist the compliance team with the investigation. What should you do?

   • ADo nothing. The retention period has already ended and the evidence has already been purged.
   • BSuspend the employee and export all data by using Google Takeout.
   • CAssign the compliance team a Google Vault administrator role and create a legal hold for the employee.
   • DAssign the compliance team a Google Vault administrator role and change the default retention rules to three years.

   Show answer

   Answer: C

   Next question

3. Question 23 · 151 in bank

   Your team is collaborating on a new project by using a Google Doc. They are using Doc comments to add numerous questions and suggestions. You want to ensure that sensitive data in the Doc comments does not appear in the recipients’ inboxes when a user is notified that a comment has been assigned to them. What should you do?

   • ASet up an email quarantine to quarantine all incoming emails that contain sensitive data.
   • BDisable comments in the Google Doc for your users.
   • CCreate a Gmail content compliance rule and turn off dynamic email for your team.
   • DCreate a Gmail content compliance rule to block incoming messages that contain sensitive data.

   Show answer

   Answer: C

   Next question

4. Question 24 · 151 in bank

   A user is reporting that external, inbound messages from known senders are repeatedly being incorrectly classified as spam. What steps should the admin take to prevent this behavior in the future?

   • AModify the SPF record for your internal domain to include the IPs of the external user's mail servers.
   • BUpdate the spam settings in the Admin Console to be less aggressive.
   • CAdd the sender's domain to an allowlist via approved senders in the Admin Console.
   • DInstruct the user to add the senders to their contacts.

   Show answer

   Answer: C

   Explanation

   SPF is used to indicate which mail servers are allowed to send emails from YOUR domain and has nothing to do with external, inbound emails. Where are these answers derived from, Google? Can't be.

   Source: Adapted from community discussion — Steventjie

   References

   • support.google.com documentation
   • support.google.com documentation

   Next question

5. Question 25 · 151 in bank

   Your organization was recently targeted by a phishing attempt that affected several users. You must efficiently determine the full extent of the phishing attempt and prevent further issues from occurring. What should you do?

   • A1. Search BigQuery logs for all messages marked as phishing. 2. Require Transport Layer Security (TLS) for all email communications. 3. Instruct all users to reset their passwords.
   • B1. Use email log search to pull all emails for the past three days. 2. Analyze logs of common emails received and contact users. 3. Instruct users on how to create a Gmail filter to block malicious email addresses.
   • C1. Use the security dashboard to view the number of messages showing evidence of potential spoofing, and then use the investigation tool on affected users to remove malicious email. 2. Enable advanced phishing and malware protection. 3. Deploy Google's Password Alert extension for Chrome.
   • D1. Collect phishing samples forwarded from users. 2. Add IP addresses and email addresses to your denylist. 3. Enroll only affected users to multi-factor authentication (MFA).

   Show answer

   Answer: C

   Explanation

   Using the security dashboard and investigation tool helps quickly identify affected users and remove malicious emails. Enabling advanced phishing and malware protection adds another layer of security, and deploying Password Alert helps detect password compromises.

   Source: Adapted from community discussion — apb98

   Next question

6. Question 26 · 151 in bank

   Your organization has offices in Canada, Italy, and the United States. You want to ensure that employees can access corporate Gmail and Drive from these three geographic locations only. What should you do?

   • ARequire the use of corporate devices for any access to corporate Gmail and Drive.
   • BUse context-aware access to create access levels based on the geographic location, and assign them to corporate Gmail and Drive.
   • CCreate address lists to restrict the delivery of incoming and outgoing messages, and to block notifications from Google Doc comments.
   • DCreate data protection rules in Google Workspace that allow data access from only three geographic locations.

   Show answer

   Answer: B

   Next question

7. Question 27 · 151 in bank

   Your organization has upgraded to a Google Workspace edition with Vault and has hired a new audit team. You are configuring access for this audit team with these privileges: • Chief legal executive - reporting privileges • Legal audit manager - full Vault privileges • Data reviewer - searching privileges. You must enable access for these three roles. What should you do?

   • ASet up Google Vault service as On for these specific users.
   • BAssign Google Vault licenses to these users that allow all privileges required for access.
   • CSet up an Admin role with minimal Vault privileges and assign the role to all Vault users. Approve additional privileges that are requested through a formal approval process.
   • DSet up three different Admin roles with specific privileges that match the audit team’s responsibilities. Assign these Admin roles to the respective users.

   Show answer

   Answer: D

   Next question

8. Question 28 · 151 in bank

   Employees at your organization frequently and mistakenly delete important emails that they receive from your payroll department. The employees have to file support tickets for the IT team to find and restore these emails. You must provide an automated solution that minimizes IT overhead and prevents these emails from being permanently deleted from their inboxes. What should you do?

   • ACreate a content compliance rule that targets internal messages. Use an advanced content match for the sender header to match the payroll department's email. Quarantine the message so that administrators can review the email before they release it to the user.
   • BCreate an Apps Script project that uses the Gmail API to find any recently deleted emails and automatically restore them to the inboxes. Set the script trigger to be time-driven and run every hour.
   • CCreate a content compliance rule that targets all internal messages that are sent from the payroll department. Modify the message by prepending a custom subject line to all payroll emails so that employees know not to delete them.
   • DCreate an activity rule by using Gmail log events with two conditions: one for the event of an email deletion and another that matches the header address to the payroll department's email. Create an action that restores messages. Set the rule to run every hour.

   Show answer

   Answer: D

   Next question

9. Question 29 · 151 in bank

   An employee has left your organization, and their Drive data must be retained for three years. The retention rule has been set for three years. You must ensure the employee's data is visible in Vault and accessible to the Vault Administrator in the most cost-effective way. What should you do?

   • AExport the user's Drive data from Vault, then delete the user.
   • BAssign an Archive User (AU) license to the user.
   • CChange ownership of the Drive data to the user's Manager, then delete the user.
   • DSuspend the user until the end of the three-year period.

   Show answer

   Answer: B

   Next question

10. Question 30 · 151 in bank

    Recently, your organization has had an increase in messages marked as spam. You need to quickly and efficiently obtain detailed information regarding each message. What should you do?

    • ACreate an investigation by using a SQL query to search for all spam audit logs exported to BigQuery.
    • BSend an alert to all users to mark all suspicious Gmail messages as spam and review the Alert center messages.
    • CUse Google Vault to put all messages marked as spam in a legal hold and review the messages.
    • DUse the spam filter report in the security dashboard to see messages Google's spam filter marked as spam during a specific time period.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PGWA practice, question 21. 151 questions available.