Professional Google Workspace Administrator

Here you have the best Google Professional Google Workspace Administrator practice exam questions

You have 151 total questions to study from
Each page has 5 questions, making a total of 31 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on May 23, 2025
This site is not affiliated with or endorsed by Google.

Question 1 of 151

As the Workspace Administrator, you have been asked to configure Google Cloud Directory Sync (GCDS) in order to manage Google Group memberships from an internal LDAP server. However, multiple Google Groups must have their memberships managed manually. When you run the GCDS sync, you notice that these manually managed groups are being deleted. What should you do to prevent these groups from being deleted?

In the GCDS configuration manager, update the group deletion policy setting to “don't delete Google groups not found in LDAP.”

Use the Directory API to check and update the group’s membership after the GCDS sync is completed.

Confirm that the base DN for the group email address attribute matches the base DN for the user email address attribute.

In the user attribute settings of the GCDS configuration manager options, set the Google domain users deletion/suspension policy to “delete only active Google domain users not found in LDAP.”

Correct Answer: A

To prevent manually managed Google Groups from being deleted during a GCDS sync, you should configure the GCDS settings to avoid deleting groups that are not found in the LDAP directory. This can be done by updating the group deletion policy setting to 'don't delete Google groups not found in LDAP' within the GCDS configuration manager. This setting ensures that groups managed outside of LDAP are retained even if they are not present in the LDAP server.

Question 2 of 151

Your marketing department needs an easy way for users to share items more appropriately. They want to easily link-share Drive files within the marketing department, without sharing them with your entire company. What should you do to fulfil this request? (Choose two.)

Create a shared drive that's shared internally organization-wide.

Update Drive sharing for the marketing department to restrict to internal.

Create a shared drive for internal marketing use.

Update the link sharing default to the marketing team when creating a document.

In the admin panel Drive settings, create a target audience that has all of marketing as members.

Correct Answer: C, E

To fulfill the request for the marketing department to easily share Drive files within the department without sharing them with the entire company, you should create a shared drive that is specifically for internal marketing use. This allows all marketing team members to access and share files conveniently within the group. Additionally, by setting up a target audience in the admin panel that includes all marketing team members, you can further ensure that the shared drive and its link shares are confined to the marketing department. This setup restricts access and shares appropriately within the desired group.

Question 3 of 151

Your company has a broad, granular IT administration team, and you are in charge of ensuring proper administrative control. One of those teams, the security team, requires access to the Security Investigation Tool. What should you do?

Assign the pre-built security admin role to the security team members.

Create a Custom Admin Role with the Security Center privileges, and then assign the role to each of the security team members.

Assign the Super Admin Role to the security team members.

Create a Custom Admin Role with the security settings privilege, and then assign the role to each of the security team members.

Correct Answer: B

To ensure the security team has access to the Security Investigation Tool, you need to create a Custom Admin Role with the Security Center privileges. This approach allows you to tailor the access to the specific needs of the security team without granting unnecessary permissions. Creating a custom role is the most precise method to ensure they have the required capabilities for their tasks.

Question 4 of 151

Your organization has a new security requirement around data exfiltration on iOS devices. You have a requirement to prevent users from copying content from a Google app (Gmail, Drive, Docs, Sheets, and Slides) in their work account to a Google app in their personal account or a third-party app. What steps should you take from the admin panel to prevent users from copying data from work to non-work apps on iOS devices?

Navigate to “Data Protection” setting in Google Admin Console's Device management section and disable the “Allow users to copy data to personal apps” checkbox.

Disable “Open Docs in Unmanaged Apps” setting in Google Admin Console’s Device management section.

Navigate to Devices > Mobile and endpoints > Universal Settings > General and turn on Basic Mobile Management.

Clear the “Allow items created with managed apps to open in unmanaged apps” checkbox.

Correct Answer: D

To prevent users from copying data from work apps to personal or third-party apps on iOS devices, the correct step is to clear the 'Allow items created with managed apps to open in unmanaged apps' checkbox. This setting is found in the Google Admin Console under Devices > Mobile and endpoints > iOS settings > Data sharing. This action ensures that managed app data cannot be opened or shared with unmanaged apps, effectively preventing data exfiltration.

Question 5 of 151

Your organization recently implemented context-aware access policies for Google Drive to allow users to access Drive only from corporate managed desktops. Unfortunately, some users can still access Drive from non-corporate managed machines. What preliminary checks should you perform to find out why the Context-Aware Access policy is not working as intended? (Choose two.)

Confirm that the user has a Google Workspace Enterprise Plus license.

Delete and recreate a new Context-Aware Access device policy.

Check whether device policy application is installed on users’ devices.

Confirm that the user has at least a Google Workspace Business license.

Check whether Endpoint Verification is installed on users’ desktops.

Correct Answer: A, E

To investigate why the Context-Aware Access policy for Google Drive isn't working as intended, it’s essential to verify that the user has the correct license and to ensure the endpoint verification is operative. First, confirm that the user has a Google Workspace Enterprise Plus license, as this license tier is necessary for implementing context-aware access policies. Additionally, check whether Endpoint Verification is installed on users’ desktops. Endpoint Verification is crucial for identifying and verifying managed devices, enabling the application of the predefined access policies.