PGWA practice questions 71–80

1. Question 71 · 151 in bank

   An end user informs you that they are having issues receiving mail from a specific sender that is external to your organization. You believe the issue may be caused by the external entity’s SPF record being incorrectly configured. Which troubleshooting step allows you to examine the full message headers for the offending message to determine why the messages are not being delivered?

   • AUse the Postmaster Tools API to pull the message headers.
   • BUse the Email Log Search to directly review the message headers.
   • CUse the Security Investigation Tool to review the message headers.
   • DPerform an SPF record check on the domain to determine whether their SPF record is valid.

   Show answer

   Answer: C

   Explanation

   The question says to review Full message header. Email log search doesn't allow you to see full message header. Security tool does this https://support.google.com/a/answer/9300435?hl=en#zippy=%2Cstep-view-the-email-message-and-take-action%2Cstep-provide-justification-to-view-messages%2Cstep-get-started-with-your-investigation

   Source: Adapted from community discussion — RJRF503

   References

   • support.google.com documentation

   Next question

2. Question 72 · 151 in bank

   Select 2

   You have been asked to support an investigation that your litigation team is conducting. The current default retention policy for mail is 180 days, and there are no custom mail retention policies in place. The litigation team has identified a user who is central to the investigation, and they want to investigate the mail data related to this user without the user's awareness. What two actions should you take? (Choose two.)

   • AMove the user to their own Organization Unit, and set a custom retention policy.
   • BCreate a hold on the user's mailbox in Google Vault.
   • CReset the user's password, and share the new password with the litigation team.
   • DCopy the user's data to a secondary account.
   • ECreate a matter using Google Vault, and share the matter with the litigation team members.

   Show answer

   Answer: BE

   Explanation

   100% B and E are correct, holds will take over any retention policy so first, create the hold on the users mailbox then create the matter, do the search of the user data and share it with the litigation team.

   Source: Adapted from community discussion — jaxclain

   Next question

3. Question 73 · 151 in bank

   A recent legal investigation requires all emails and Google Drive documents from a specific user to be retrieved. As the administrator, how can you fulfill the legal team's request?

   • AUse Security Investigation Tool to Search Google Drive events for all of the user's documents, and use Google Admin > Reports > Email Log Search to find their emails.
   • BSearch Google Drive for all of the user’s documents, and ask them to forward all of their emails.
   • CUse the Gmail API and Google Drive API to automatically collect and export data.
   • DUtilize Google Vault to hold, search, and export data of interest.

   Show answer

   Answer: D

   Explanation

   D is the correct answer for sure, just keep in mind that Vault will not export folders / labels, just raw data so for emails, you need to look at the header to see if the email belongs to a label or if it was sent, received, deleted, etc... This is why Vault is not recommended for doing Backups but analizing the 4 options here, A will not work, B is too exausting, C will work but you will need a 3rd party app or something like Google Workspace Migrate but that service is only for Enterprise companies so the only option left is D lol

   Source: Adapted from community discussion — jaxclain

   Next question

4. Question 74 · 151 in bank

   What steps does an administrator need to take to enforce TLS with a particular domain?

   • AEnable email safety features with the receiving domain.
   • BSet up secure transport compliance with the receiving domain.
   • CConfigure an alternate secure route with the receiving domain.
   • DSet up DKIM authentication with the receiving domain.

   Show answer

   Answer: B

   References

   • support.google.com documentation

   Next question

5. Question 75 · 151 in bank

   Your company has a broad, granular IT administration team, and you are in charge of ensuring proper administrative control. One of those teams, the security team, requires access to the Security Investigation Tool. What should you do?

   • AAssign the pre-built security admin role to the security team members.
   • BCreate a Custom Admin Role with the Security Center privileges, and then assign the role to each of the security team members.
   • CAssign the Super Admin Role to the security team members.
   • DCreate a Custom Admin Role with the security settings privilege, and then assign the role to each of the security team members.

   Show answer

   Answer: B

   Next question

6. Question 76 · 151 in bank

   Your company’s Google Workspace primary domain is “mycompany.com,” and it has acquired a startup that is using another cloud provider with a domain named “mystartup.com.” You plan to add all employees from the startup to your Google Workspace domain while preserving their current mail addresses. The startup CEO's email address is andrea@mystartup.com, which also matches your company CEO's email address as andrea@mycompany.com, even though they are different people. Each must keep the usage of their email. In addition, your manager asked to have all existing security policies applied for the new employees without any duplication. What should you do to implement the migration?

   • ACreate a secondary domain, mystartup.com, within your current Google Workspace domain, set up necessary DNS records, and create all startup employees with the secondary domain as their primary email addresses.
   • BCreate an alias domain, mystartup.com, in your existing Google Workspace domain, set up necessary DNS records, and create all startup employees with the alias domain as their primary email addresses.
   • CCreate a new Google Workspace domain with “mystartup.com,” and create a trust between both domains for reusing the same security policies and sharing employee information within the companies.
   • DCreate the startup employees in the “mycompany.com’ domain, and add a number at the end of the user name whenever there is a conflict. In Gmail > Routing, define a specific route for the OU that targets the startup employees, which will modify the email address domain to “mystartup.com,” and remove any numbers previously added. In addition, confirm that the SPF and DKIM records are properly set.

   Show answer

   Answer: A

   Explanation

   @RAZKZ, what is wrong with A? lol having a secondary domain, creating the incoming users with that domain, you can add them to a sub OU, also the policies applied at the OU level will apply to those incoming users, the other options B, C and D makes no sense so you need to get used to Google exams... as a tip if this is your first exam, just look for the most logical answer, discard the less logical or the ones that makes no sense, in the end you will always have 2 options lol I have done many Google exams.. CDL, ACE, PCA twice and next week i will do this exam lol

   Source: Adapted from community discussion — jaxclain

   Next question

7. Question 77 · 151 in bank

   You are in charge of automating and configuring Google Cloud Directory Sync for your organization. Within the config manager, how can you proactively prevent applying widespread deletions within your Workspace environment if your company’s LDAP undergoes a substantial modification?

   • AManually run Google Cloud Directory Sync only after performing a simulated sync.
   • BSpecify the minimum and maximum number of objects to synchronize in each configuration item.
   • CConfigure the tool to delete users only when run from the config manager.
   • DConfigure limits for the maximum number of deletions on each synchronization.

   Show answer

   Answer: D

   Explanation

   Answer is D You can use limits with Google Cloud Directory Sync (GCDS) to set the maximum number of deletions permitted on each simulation or synchronization. If it reaches this limit, GCDS stops and does not sync any changes. https://support.google.com/a/answer/9520714?fl=1

   Source: Adapted from community discussion — RJRF503

   References

   • support.google.com documentation

   Next question

8. Question 78 · 151 in bank

   Select 2

   Your company recently acquired an organization that was not leveraging Google Workspace. Your company is currently using Google Cloud Directory Sync (GCDS) to sync from an LDAP directory into Google Workspace. You want to deploy a second instance of GCDS and apply the same strategy with the newly acquired organization, which also has its users in an LDAP directory. How should you change your GCDS instance to ensure that the setup is successful? (Choose two.)

   • AProvide your current GCDS instance with admin credentials to the recently acquired organization's LDAP directory.
   • BAdd an LDAP sync rule to your current GCDS instance in order to synchronize new users.
   • CSet up exclusion rules to ensure that users synced from the acquired organization's LDAP are not, suspended.
   • DSet up an additional instance of GCDS running on another server, and handle the acquired organization's synchronization.
   • EUpgrade to the multiple LDAP version of GCDS.

   Show answer

   Answer: CD

   Explanation

   Correct answer - C & D https://support.google.com/a/answer/7177266?hl=en#zippy=%2Ccan-i-sync-gcds-from-multiple-ldap-directories GCDS can only sync from a single LDAP directory. If you have multiple LDAP directories, it is recommended that you consolidate your LDAP server data into a single directory. You need to run 2 separate GCDS instances while creating exclusion rules to prevent suspensions/deletions.

   Source: Adapted from community discussion — RJRF503

   References

   • support.google.com documentation
   • support.google.com documentation

   Next question

9. Question 79 · 151 in bank

   A user reached out to the IT department about a Google Group that they own: info@company.com. The group is receiving mail, and each message is also delivered directly to the user's Gmail inbox. The user wants to be able to reply to messages directly from Gmail and have them sent on behalf of the group, not their individual account. Currently, their replies come from their individual account. What would you instruct the user to do?

   • ACreate a new content compliance rule that matches the user's outgoing messages with the group copied, and have it modify the sender to be the group address.
   • BAdd the group as an email address that can be sent from within Gmail, and verify that the user has access. They can then choose to reply from the group.
   • CAdd the user's individual account as a delegate to the group's inbox. They can then toggle between the accounts and use the Gmail interface on behalf of the group.
   • DSet the group address to be the default sender within the group's posting policies.

   Show answer

   Answer: B

   Explanation

   Option B is correct, it works the same as an Alias, you add the Group email address to the "Send Mail As" from your GW Gmail settings, using the "treat as an alias" option and you are all set.

   Source: Adapted from community discussion — jaxclain

   References

   • support.google.com documentation
   • support.google.com documentation

   Next question

10. Question 80 · 151 in bank

    Your organization recently deployed Google Workspace. Your admin team has been very focused on configuring the core services for your environment, which has left you little time to pay attention to other areas. Your security team has just informed you that many users are leveraging unauthorized add-ons, and they are concerned about data exfiltration. The admin team wants you to cut off all add-ons access to Workspace data immediately and block all future add-ons until further notice. However, they approve of users leveraging their Workspace accounts to sign into third-party sites. What should you do?

    • AModify your Marketplace Settings to block users from installing any app from the Marketplace.
    • BSet all API services to “restricted access” and ensure that all connected apps have limited access.
    • CRemove all client IDs and scopes from the list of domain-wide delegation API clients.
    • DBlock each connected app's access.

    Show answer

    Answer: B

    Explanation

    B. Set all API services to "restricted access" and ensure that all connected apps have limited access. By setting API services to "restricted access," you can control the access and permissions granted to third-party apps and add-ons. This allows you to review and manage the level of access each app has to Workspace data. Additionally, ensuring that all connected apps have limited access helps minimize the risk of data exfiltration or unauthorized data access. This approach allows users to continue leveraging their Workspace accounts to sign into third-party sites while maintaining control over the add-ons and their access to Workspace data.

    Source: Adapted from community discussion — karl19

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PGWA practice, question 71. 151 questions available.