Free Google-Workspace-Administrator Actual Exam Questions

It’s C because delegating access to a group simplifies management and avoids password sharing risks. Plus, multiple assistants can handle the CEO’s emails without needing separate aliases or complicated sender settings.

D is out for sure; sharing passwords is a major security risk.

This one feels like C makes the most sense because it’s low-cost and can be tailored with App Script for automation and access controls. D might be overkill since AppMaker is deprecated and adds complexity. With C, you can set up the script to update data weekly and use separate filtered views or protected ranges so leaders only see their reports. The key is automating the sync so it’s hands-off for the team leads while keeping everything secure and within budget.

C, it’s simple and cost-effective with manageable access controls.

Option A feels right since the login audit report specifically tracks suspicious login events, which matches the requirement better than general account activity reports.

It’s D because creating a custom BigQuery query lets you tailor the data exactly by user and time frame, which the standard reports might not break down as precisely for suspicious logins.

D imo, since provisioning those accounts with Cloud Identity and disabling services is a more direct way to block access after employees leave. Relying on the transfer tool (B) assumes former users will cooperate, which might not happen. Also, option A feels off because support usually won’t manage blocking accounts like that. Cleaning up access lists (C) is useful but reactive and won’t stop former users from accessing consumer accounts tied to corporate emails. So D gives you a way to lock down those accounts even if users don’t respond.

Probably B since it actively tries to regain control of those unmanaged accounts.

Maybe C, since Team Drives don’t allow subfolder-level permission changes directly.

C imo, because Team Drives don’t support subfolder-level restrictions, so separate drive makes sense.

I get why B looks appealing for combining data, but it sounds like extra hassle matching OrgIDs with the user list. D feels more straightforward since you get all user info—including status and Org unit—in one export. That means you can quickly pivot or filter in Sheets without additional API steps. So, I’d pick D for simplicity and less chance of messing up data joins.

Maybe D makes the most sense here since it directly gives you all user info including status and Org unit, no need for extra API work or joins. That way you can just filter and count active vs suspended in Sheets without fuss. B sounds more complicated with having to merge data sets and handle OrgIDs separately, which might slow things down. If the goal’s a quick and straightforward report, grabbing all data straight from the Users Menu seems cleaner and less error-prone.

C. The Security Dashboard usually gives a real-time snapshot of blocked threats, including phishing. It feels more reliable for showing what was actually stopped rather than just received emails. Since spam filters catch phishing too, this should give a clearer picture of attempts prevented since 2FA was put in place. Plus, it's likely easier to correlate the timing with the 2FA rollout compared to broader reports.

Probably D since Reporting usually gives detailed, date-filtered data, so you can track phishing attempts after 2FA was put in place, which fits the CISO’s request best.

B/D? Alerts from Drive audit reports (B) catch new external shares fast, while a custom dashboard (D) helps track ongoing external sharing more closely. The other options seem more static or restrictive.

Good point about ongoing alerts; B for sure, and D for continuous monitoring.

D/C? D seems like the best starting point since it helps locate those conflict accounts without messing anything up right away. But if the issue is users not having proper Workspace accounts yet, then C might be necessary to get them properly onboarded. I think handling the detection first with D and then creating new accounts as needed (C) makes sense before jumping to removal or renaming.

A vs D? While D helps identify conflict accounts, A actually solves the problem by removing those conflicts. But I worry about data loss with A if it’s done too quickly. Maybe use D first to check, then A once you’re sure. Just jumping to removal without assessment seems risky.

A/E? Disabling guest and public sessions cuts off quick access, and restricting sign-in to the employee’s email makes sure no one else can log on. Seems like the cleanest combo to lock down the device.

A and E, Guest Mode off plus restricting sign-in to just that user.

Maybe A. Blocking known malicious IPs can immediately stop suspicious login attempts, which is quicker to implement compared to changing passwords or device management setups.

A/C? Blocking malicious IPs is a quick way to cut off known bad actors without waiting for users to change passwords, which might not stop current breaches fast enough. Higher complexity helps but won’t stop stolen creds alone.

Temporarily moving users seems best; option B lets them reset 2SV without risking security. B

It’s B because temporarily moving users lets them set up 2SV without risking org-wide security.

D imo, requiring admin approval adds a solid control layer for any app installs, not just Android. It covers more devices and is more reliable if the MDM can’t directly toggle unknown sources settings.

Maybe D could work too since requiring admin approval adds a gate before any app installs, which would naturally stop apps from unknown sources without needing to tweak Android settings directly. It’s broader but still effective in preventing unauthorized app installations. C is very Android-specific, but if the environment manages different device types, D might offer a more universal way to control app installs. Still, for strictly stopping unknown sources on Android, C seems more targeted, but I don’t think D should be dismissed outright as it enforces admin control overall.

D seems solid since config groups can be applied without restructuring OUs, keeping things simple and still ensuring European data stays local. Less hassle than changing OU setups.

B tbh. Adding location-based OUs seems like a clean way to segment data region controls without messing with existing business unit structures too much. It directly ties data storage rules to user location, which matches the requirement well. Plus, it avoids potential confusion from overlapping config groups or needing complex rules. Seems more straightforward for compliance and performance.

Option B seems solid since it directly targets the two users and applies the exact project phrase as a search term, keeping things straightforward without unnecessary complexity.

Makes sense to keep it separate like in A since you want all emails from those users plus any mentioning the project, no overlap risks. A’s the safest bet here.