Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What is the primary purpose of organizational units in Google Workspace?
Manage organizational structures and policies
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Terraform modules and infrastructure blueprints for advanced exploration of Google Cloud design. This is supporting engineering material, not an exam course.
Try it: Read one small VPC or service-account module. Draw the resources and permission boundaries it creates, and explain a least-privilege change without deploying an entire landing zone.
Reading the code is free. Deployment requires suitable permissions and can create billable infrastructure.
Official certification paths with exam-specific guides and preparation links for cloud roles.
Try it: Open the guide for your chosen role. For each weak domain, write one service-selection decision you cannot yet explain and find its product documentation.
Public certification information is free; training, labs, and exam registration may be paid.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What is the primary purpose of organizational units in Google Workspace?
To apply policies and manage users/groups in a hierarchical structure
To increase the maximum mailbox storage for specific users
To enable external users to access internal resources without authentication
To replace the need for custom domain names
Correct answer
To apply policies and manage users/groups in a hierarchical structure
Organizational units allow administrators to group users and apply settings such as security policies and feature controls. This structure supports delegated administration and consistent management at scale.
Which setting helps reduce spam and phishing by verifying the sending mail server?
SPF record
Browser cookies
Drive sharing defaults
Calendar availability settings
Correct answer
SPF record
Sender Policy Framework (SPF) records specify which mail servers are allowed to send email for a domain. Proper DNS records like SPF help mail servers validate senders and reduce spoofing.
What is a benefit of using shared drives for team collaboration?
Files remain accessible to the team even if a member leaves
Shared drives automatically encrypt all data at rest
Shared drives can only be accessed by the owner
Shared drives reduce the need for user accounts
Correct answer
Files remain accessible to the team even if a member leaves
Shared drives are owned by the team rather than individuals, ensuring continuity of access when team members change. Content and permissions stay with the drive.
Which action helps maintain data security when a device is lost?
Remotely wipe the device using admin controls
Change the user's password only
Disable the user account without device controls
Enable two-factor authentication for all users
Correct answer
Remotely wipe the device using admin controls
Remote wipe capabilities allow administrators to remove corporate data from lost or stolen devices. This is often managed through mobile device management policies.
What does enabling 2-Step Verification primarily protect against?
Unauthorized access due to compromised passwords
Data loss from accidental deletion
Malware infections in email attachments
Slow sign-in performance for users
Correct answer
Unauthorized access due to compromised passwords
Two-Step Verification adds an extra layer beyond passwords, requiring a second form of identity. This significantly reduces the risk of account takeover from stolen credentials.
Which feature allows administrators to control which apps can access user data?
OAuth app controls
Drive offline mode
Calendar resource booking
Chat message retention policies
Correct answer
Chat message retention policies
OAuth app controls let admins review and restrict third-party applications that request access to Google Workspace data. This helps prevent unauthorized data exposure.
What is a recommended practice for assigning Google Workspace roles?
Assign the fewest privileges necessary to perform job functions
Share admin credentials among team leads for efficiency
Grant all users super admin rights to simplify support
Avoid using custom roles to reduce complexity
Correct answer
Assign the fewest privileges necessary to perform job functions
Principle of least privilege ensures users have only the access needed for their tasks. This minimizes potential impact from errors or compromised accounts.
Which tool helps locate and remove sensitive content across Drive and Gmail?
Data Loss Prevention (DLP) search
Activity audit logs
Drive labels
User provisioning reports
Correct answer
Data Loss Prevention (DLP) search
DLP search enables admins to find sensitive information such as credit card numbers or personal data across services. It can be used to enforce retention and removal policies.
What is a primary function of Google Groups in Workspace?
To create email aliases for distributing messages to multiple users
To provide individual users with additional storage quotas
To replace the need for organizational units
To manage billing for the entire domain
Correct answer
To create email aliases for distributing messages to multiple users
Google Groups simplifies communication by allowing a single email address to represent multiple members. It is useful for teams, roles, and notification lists.
Which setting can help prevent data exfiltration via copy and paste?
Drive block copy and download for certain users
Restrict chat message formatting
Disable calendar invitations
Limit shared drive creation to admins
Correct answer
Drive block copy and download for certain users
Content controls in Drive and other Workspace apps can limit downloading, printing, and copy/paste for sensitive documents. These settings help protect confidential information.
What does a custom retention policy help ensure?
Data is preserved or deleted according to organizational or legal requirements
All users can access archived data at any time
Drive files are automatically shared with external partners
Email messages are never marked as spam
Correct answer
All users can access archived data at any time
Retention policies define how long data is kept and when it should be deleted or preserved. They support compliance with regulations and internal governance.
Which method is most effective for revoking access when an employee leaves?
Deactivate or remove the user account
Delete all documents created by the user
Change the domain name
Remove all organizational units
Correct answer
Deactivate or remove the user account
Deactivating or removing a user account immediately disables sign-in and access to resources. It is a critical step in offboarding to protect company data.
What is a best practice for managing service accounts?
Use unique, non-human accounts for automated processes and restrict their privileges
Share service account credentials with multiple administrators
Enable 2-Step Verification on service accounts
Use service accounts for everyday user tasks
Correct answer
Use unique, non-human accounts for automated processes and restrict their privileges
Service accounts should have minimal permissions and be monitored separately. Avoid using them for interactive access to reduce security risks.
Which feature allows you to control how external users can interact with shared documents?
Link sharing settings and access levels
User profile photos
Drive activity charts
Chat do not disturb mode
Correct answer
Link sharing settings and access levels
Link sharing settings let admins define whether external users can view, comment, or edit shared content. Controls can be enforced domain-wide or per item.
What is the purpose of audit logs in Google Workspace?
To track user activity and changes for security and compliance
To store backup copies of all emails
To increase available storage for users
To manage calendar event reminders
Correct answer
To store backup copies of all emails
Audit logs record actions such as sign-ins, admin changes, and file accesses. They are essential for monitoring, troubleshooting, and meeting compliance requirements.
Recall the answer before opening each card.
To group users for applying policies (security, settings) and delegated administration in a hierarchical structure.
SPF (Sender Policy Framework) record. It lists authorized IPs to reduce spoofing and phishing.
Files remain accessible even if a member leaves because the drive is team-owned, not individual.
Remotely wipe corporate data using Admin console's mobile device management policies.
Unauthorized access due to compromised passwords. Adds a second factor beyond password.
OAuth app controls in Admin console allow review and blocking of risky apps.
Assign the fewest privileges necessary (least privilege) to perform job functions.
Data Loss Prevention (DLP) search scans Drive and Gmail for sensitive data.
They provide a single email alias that distributes messages to all group members.
Drive content controls: block download, print, and copy for specific users or OUs.
How long data is kept and when it is deleted or preserved, ensuring compliance with regulations.
Deactivate or remove the user account to immediately revoke all access.
Use unique non-human accounts with minimal permissions; monitor separately; avoid interactive logins.
Use link sharing settings to set view, comment, or edit permissions for external users.
To record actions like sign-ins and file accesses for monitoring, troubleshooting, and compliance.
SPF, DKIM, and DMARC records authenticate email sources, reducing phishing success.
Apply the 2FA policy at an organizational unit level to target specific user groups.
Content remains because the drive is team-owned. Only the member's access is removed.
Prevents unauthorized third-party apps from accessing Workspace data, reducing data breach risk.
Review audit logs in the Admin console; they track admin changes, sign-ins, and file access.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This section covers foundational elements for controlling who can access resources and how they authenticate. Organizational units (OUs) enable hierarchical policy application. Two-Step Verification adds a second factor beyond passwords to prevent credential-based breaches. The principle of least privilege dictates that roles should grant minimal necessary permissions. When employees leave, deactivating their account immediately revokes access. Service accounts need unique identities and restricted scopes for automation. These concepts together form the backbone of identity governance.
Protecting sensitive information and meeting regulatory requirements is essential. Data Loss Prevention (DLP) search helps locate and remove sensitive content across Drive and Gmail. Retention policies define how long data is kept and when it is deleted, ensuring compliance. Audit logs record user and admin actions for monitoring and investigation. Content controls such as blocking copy/download for certain users prevent data exfiltration. External sharing settings limit how outsiders can view or edit documents. These tools collectively enforce data governance.
Effective team collaboration and secure email communication depend on proper configuration. SPF records verify sending mail servers to reduce spam and phishing. Shared drives ensure team files remain accessible even when members change, unlike individual My Drive. Google Groups simplify sending messages to multiple users via a single alias. OAuth app controls let administrators restrict which third-party apps access user data, preventing unauthorized data exposure. These features balance productivity with security in a collaborative environment.
Managing devices that access Workspace is critical for security. Remote wipe allows administrators to erase corporate data from lost or stolen devices, enforced through mobile device management policies. Device management settings can also require passcodes, encryption, and restrict app installation. Coupled with contextual access policies (e.g., only allow from managed devices), these controls mitigate risks from device loss or compromise. Understanding these options helps protect data beyond the corporate network.
Study workflow
In the Admin console, go to Directory > Organizational units. Create top-level OUs for departments (e.g., Sales, Engineering) and sub-OUs for teams. Assign users to OUs. Apply policies like 2-Step Verification or app access settings at the OU level. Inheritance flows downward; override at child OUs as needed.
Access your domain's DNS provider. Create a TXT record with the SPF value: "v=spf1 include:_spf.google.com ~all". This authorizes Google Workspace mail servers. Test with a tool like MXToolbox. Wait for propagation (up to 48 hours). Monitor email delivery issues.
In Admin console, go to Security > Authentication > 2-Step Verification. Select the organizational unit and enable enforcement. Users will be prompted to enroll on next sign-in. Provide setup instructions for phone-based or security key methods. Optionally allow backup codes.
In Google Drive, click Shared drives > New. Name the drive and assign members with appropriate roles: Manager, Content manager, Contributor, or Viewer. Add members using their email addresses. Files added belong to the team. When a member leaves, their access is removed but files remain.
In Admin console, go to Security > Data Protection. Create a DLP rule: choose content detectors (e.g., Credit card numbers), set scope (Drive, Gmail). Run a scan to locate matches. Configure automatic actions like moving to quarantine or applying retention holds. Review audit logs for findings.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Service accounts are non-human accounts used for automated processes like scripts or APIs. They have their own credentials and can be granted limited scopes. User accounts represent real people and have full sign-in capabilities. Service accounts should never be used for interactive logins.
Policies applied to a parent organizational unit (OU) are inherited by child OUs. You can override inheritance at any child OU by setting a custom policy. This allows fine-grained management: for example, enforce 2FA at top level but disable for a testing OU.
Yes, but it requires domain-wide sharing settings to allow external access. You can add external users as members with restricted roles (e.g., Viewer or Commenter). Shared drives always remain accessible to internal members even if external access is removed.
The principle of least privilege means granting users only the permissions necessary for their job. In Workspace, assign predefined roles like User Management Admin instead of Super Admin. Review custom roles regularly. Avoid giving broad access to services like Drive or Groups unless needed.
SPF verifies sending servers, DKIM provides digital signatures, and DMARC tells receivers how to handle failures. Google recommends setting up all three for robust anti-spoofing. SPF alone prevents unauthorized senders but DMARC adds policy enforcement.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
