Free AGWA sample questions

Correct answer: A Drive Data Loss Prevention (DLP) rule with a predefined content detector for TINs, configured to block external sharing, warn the user, and send an alert.

This scenario is a classic use case for Data Loss Prevention (DLP) rules. A Drive DLP rule can be configured to scan files for specific content using predefined detectors (like Tax Identification Numbers). The rule's actions can be set to block external sharing, display a custom warning to the user, and send an email alert to the compliance team, fulfilling all requirements. Vault is for retention/eDiscovery, trust rules manage sharing at a high level without content inspection, and content compliance is specific to Gmail.

Correct answer: Set the main Sales OU Drive sharing policy to 'Off' for sharing outside the organization. Then, create a sharing policy exception for the 'Sales-Managers' group that allows public sharing.

The most direct and modern way to handle this is by using sharing policy exceptions based on groups, which overrides the OU's setting. You set the restrictive policy at the OU level (domain-only sharing) and then apply a more permissive policy specifically to the 'Sales-Managers' group. This avoids restructuring OUs, which can have wider implications. Target audiences are for suggesting shares, not enforcing permissions. Whitelisting domains is too restrictive if they need public sharing.

Correct answer: Suspended

Suspending a user account is the correct action. It immediately blocks user sign-in access and stops new mail delivery. However, all existing data remains in place and is accessible to administrators and Google Vault for eDiscovery purposes. Deleting the account would permanently remove the data after a grace period. Archiving is a paid option that also preserves data but is designed for long-term storage, whereas suspension is the standard immediate action for terminated employees pending data review.

Correct answer: Set up a new route in the 'Routing' settings that adds the Exchange server as an additional recipient.

Dual delivery is configured in the Gmail 'Routing' settings. You create a new routing rule that applies to all inbound messages. In the rule's options, you select 'Also deliver to' and add a new recipient, which would be the mail host of the legacy Exchange server. This ensures a copy is sent to the on-premises server after it's delivered to the Gmail inbox. An inbound gateway is for processing mail coming *from* a specific gateway, not for routing outgoing copies.

Correct answer: A context-aware access policy.

Context-aware access policies are designed for this exact scenario. They allow administrators to create granular access control rules based on user identity, location (IP address), device security status, and other attributes. A policy restricting access to corporate IP addresses for a specific OU is a common implementation of context-aware access. 2SV would prompt for a second factor but not block based on IP. Session control manages what happens *after* login.

Correct answer: The 'Bulk update users' feature in the Admin Console.

The 'Bulk update users' feature in the Google Admin console is specifically designed for this purpose. It allows an administrator to download a CSV template, populate it with new user information (including their OU path), and then upload it to create or update multiple user accounts at once. GCDS is for syncing with a directory server like Active Directory, not for one-off CSV uploads. The Admin SDK requires scripting knowledge.

Correct answer: Disallow users who are not managers from moving files and folders out of this shared drive.

Shared Drives have a specific setting to control data exfiltration. The option 'Disallow users who are not managers from moving files and folders out of this shared drive' directly addresses the requirement. This ensures that only users with the 'Manager' role, who have the highest level of control, can perform this action, preventing Content Managers, Contributors, and others from moving data out. The other options control different permissions (sharing, downloading) but do not specifically prevent the 'Move' action.

Correct answers: Reset the user's password and sign out all web and device sessions.; Review the user's recent login activity and authorized apps for suspicious entries.

Correct answer: True

This statement is true. The Google Workspace OU structure is hierarchical, and policies applied to a parent OU are inherited by all child OUs by default. This allows for efficient policy management. An administrator can then go to a specific child OU and set a different policy (override) if needed for that specific group of users.

Correct answer: Enable 'Host management', then disable 'Share their screen' and enable 'Mute all' for participants.

Google Meet's 'Host management' features are designed for this purpose. By enabling Host management, the organizer gains access to safety controls. They can then toggle off the ability for participants to 'Share their screen', ensuring only hosts can present. While there isn't a 'mute on entry' setting pre-call, the host can use the 'Mute all' function once the meeting starts to control audio. Disabling screen sharing for participants is the key preventative step.