Google Workspace Deployment Services Credential Answers

Google Workspace Deployment Services Credential Answers

• Exam questions: 54
• Target Passing Rate = 75%
• All questions are weighted evenly (no credit for partially correct answers).

Questions:

An organization has created a Google Workspace Vault default retention rule which retains all Gmail messages for all users in the domain for 30 days. There are no active custom rules. A user receives a message on January 1. The user deletes the message and empties it from Trash on January 15. What is the earliest date on which the message will no longer be searchable in Vault?

• January 31
• January 15
• March 1
• February 15

You are migrating Exchange accounts to Google Workspace with Google Workspace Migration for Microsoft Exchange (GWMME). When must a mapping file be used?

• Never. Mappings are included in the GWMME control file.
• The mapping file is required for all Gmail, Contacts and Calendar migrations.
• When migrating from an IMAP server.
• When you need to migrate Calendars and the legacy email addresses are different from the Google Workspace addresses.

Which two types of data CANNOT be retained using Google Workspace Vault?

Select 2 Correct Responses

• Off-the-record Chat conversations
• Email
• On-the-record Chat conversations
• Google Sheets
• Calendar Entries
• Google Slides

A customer wants to disable all the Google Workspace marketplace applications that access Drive and Gmail. What is the recommended approach to disabling users from adding applications that access Drive and Gmail?

• Use the Google Workspace Admin console to disable all OAuth access to the selected services
• Set an alert for all installations of Marketplace applications to trigger an action to suspend a user until the application is removed
• Use the Admin SDK API to run a script that removes access to all applications on a scheduled basis
• Disable users from installing applications in the Marketplace in the Google Workspace Admin console

An organization has provisioned all of their employees in Google Workspace and pointed their MX records to Google. They want to configure email for some users to be delivered in Gmail, while email for other users is delivered to a legacy mail system. What should they do?

• Set up split delivery in their legacy mail system and forward all Google Workspace user mail to aspmx.l.google.com
• Create a Google Group for all legacy mail system users and place the group in an organizational unit that has a “Default Routing” setting to the legacy mail system.
• Add legacy mail system users to an organizational unit and configure a Routing setting to direct mail to the legacy system.
• Place all legacy users in an organizational unit and configure the outbound gateway to the IP address of the legacy mail system.

An organization's MX record points to an inbound mail gateway (gateway1) that must relay all messages through a second gateway (gateway2) before sending messages to Gmail. What are the two Google recommended settings in this architecture?

Select 2 Correct Responses

• Check "Automatically detect external IP" in the Inbound gateway configuration.
• Add the IP address for gateway1 to the Inbound gateway setting.
• Add IP addresses for both gateway1 and gateway2 to the email whitelist.
• Add IPs for both gateway1 and gateway2 to the Inbound gateway setting.
• Ensure that all inbound messages receive a custom header to bypass Google spam checks

A customer has set the Google session control expiration for 8 hours, but reports that users are not being prompted to re-authenticate as expected. What are the two possible causes of this issue?

Select 2 Correct Responses

• The session timeout setting on a third party SSO provider is set longer than the Google session configuration

• Users reporting the issue are on mobile devices which are not subject to the authentication timeout

• An IP whitelist has been configured which takes priority over the session control
• Only Gmail and Drive are subject to session control and user’s are probably using other services
• Users are members of an administrative role that is not subject to session timeout length

Which access method does NOT allow enforcement of policy controls on iOS devices by Google Workspace?

• Google-provided Gmail app
• Google Sync (Microsoft ActiveSync)
• Adding an account type of “Google” through the Mail, Calendar, and Contacts menu
• iOS Sync

Which of the following is required In order to achieve free/busy interoperability between Google and Microsoft Exchange?

• Exchange web services must be opened on port 443 for https://calendar.google.com
• Exchange web services must be opened on port 443 for all of Google’s IPv6 net blocks
• Exchange web services must be opened on port 443 for all of Google’s IP blocks
• Exchange web services must be opened on port 443 for a small subset of Google’s IP blocks

An organization has configured their domain to automatically cancel calendar events for deleted users in the Google Workspace Admin console. Which best describes what happens when a user account is deleted?

• Future events on the user's primary calendar are cancelled 21 days later. No cancellation emails are sent.

• Future events are cancelled on the user's primary calendar immediately. Cancellation emails are sent.
• All events are cancelled on the users primary calendar immediately. No cancellation emails are sent.
• Future events on the user's primary and secondary calendars are cancelled 21 days later. No cancellation emails are sent.

An organization's primary mail domain is altostrat.com. They would like to set up dual delivery of mail and have chosen the subdomain apps.altostrat.com to facilitate mail routing to Google Workspace. Which action must they take?

• Register apps.altostrat.com as the primary domain for Google Workspace.
• Point the MX records for altostrat.com to aspmx.l.google.com.
• Point the MX record for apps.altostrat.com to aspmx.l.google.com.
• Add apps.altostrat.com as an alias Google Workspace domain.

Which Gmail policy type can alter the inbound route of email for specific users?

• Internal-receiving
• Content compliance
• Default routing
• Inbound gateway

What is Google’s recommended network protocol for Google Meet traffic?

• QUIC
• Unsecured TCP
• Secured UDP
• Secured TCP
• Unsecured UDP

An organization has many administrators across different regions and wants to segment the user management by region. How is this accomplished?

• Configure super administrator access for each administrator and assign them to specific OUs.
• Use a group filter to delegate administrative rights to specific users based on group membership.
• Move each IT administrator into the same OU as the users in their respective region and grant them the “User Management Admin” system role.
• Delegate administrators to specific OUs using the “User Management Admin” system role.

You are in the Early Adopters phase of a Google Workspace deployment. Which set of users does Google recommend that you deploy in this phase?

• Executives and IT staff
• 25% of users from technical teams
• 10% of users from across all business units
• IT staff and the project team

A customer with over 25,000 Windows machines wants to enforce strict control over Chrome extensions installed in their environment. What should they do?

• Chrome extensions are controlled only at the user level and must be restricted only through written policies
• The customer should create Chrome manifest files to whitelist extensions during deployment of Chrome browser
• Use the Google Admin console to deploy only approved extensions to all users
• Use Google provided group policy templates (.adm and .admx) to create a centrally controlled level of restriction
• Chrome browser natively inspects and verifies all extensions by default so no further action is needed

An organization with 10,000 employees has multiple Active Directory forests within their environment. When provisioning users for Google Workspace, which two actions does Google recommend when possible?

Select 2 Correct Responses

• Use the Admin console to manually provision users.
• Divide the employees into separate Google Workspace instances based on Active Directory membership.
• Consolidate all forests into a single Active Directory.
• Configure a dedicated (aggregated) LDAP system for GCDS provisioning.
• Configure a single instance of GCDS using a reverse proxy to connect to all forests.

Which option do Google Workspace administrators NOT have for enforcing second factor authentication (2SV) for their users?

• Selective enforcement for diverse user populations
• Allow custom grace periods for new employees to enroll in 2SV
• Admins can enroll and enforce users in 2SV automatically
• Enforcement from a specific date
• Give users the ability to choose “trusted devices” for less frequent 2SV challenges

You are using Google Workspace Calendar Interop for Microsoft Exchange to share availability information between legacy and Google Workspace calendars. Which of the following must you do to allow Exchange users to see Google Calendar availability information?

• Ensure that Google Workspace users do not appear in the Exchange Global Address List.
• Create a "Google Calendar" group in Exchange and add all Google Workspace users to this group.
• Create a role account in Google Workspace to be used by Exchange to get each Google user's availability information.
• Move the Google Workspace users to a specific organizational unit (OU) and enable calendar sharing.

Which of the following is true when handling conflict accounts with Google Workspace customers?

• User’s can decide whether to allow their existing address and data to be added to the corporate Google Workspace tenant
• Administrators can opt-in all existing conflict accounts to be added to the corporate Google Workspace tenant
• User’s can decide whether to allow their existing address to be added to the corporate Google Workspace tenant
• User’s can decide whether to allow their existing data to be added to the corporate Google Workspace tenant

An organization wants to achieve optimal network performance when accessing Google Workspace. Which of the following is a Google recommended best practice for network routing?

• Proxy all network connections to Google through a centralized location and closely measure that location's bandwidth usage.
• Perform DNS lookups geographically close to users
• Use a reverse proxy within your network perimeter
• Proxy enterprise Google Workspace traffic separately from other traffic via Google's netblocks
• Implement a cloud access security broker (CASB) to funnel all requests to Google

While using Google Cloud Directory Sync (GCDS) to provision groups, an administrator notices that GCDS creates the desired groups, but does not populate them with users. What is the most likely cause of this problem?

• The administrator entered an incorrect value for the User Email Address attribute.
• The administrator set the Groups search rule to (&(objectclass=group)(mail=*)).
• The administrator set the Groups search rule to (objectclass=group).
• The administrator left the Groups search rule blank.

A 300-person company is running Microsoft Exchange 2010. Google Workspace Migration for Microsoft Exchange (GWMME) will be used to migrate data from Exchange to Google Workspace. Which action must be taken to run GWMME?

• Install GWMME on the Exchange server.
• Create a Service account and authorize its Client ID in the Google Workspace Admin console domain.
• Enable IMAP in Exchange.
• Decrypt personal contacts.

A customer reports that a large percentage of their users received a phishing email. The customer wants to immediately remove the message from their environment. What action should they take?

• Use the phishing classification via the Gmail API to remove the message
• Search for and remove the message from all mailboxes via the Admin Console Investigation Tool
• Send an email to all users notifying them of the incident and instructing them to remove the message in question.
• Use Google Workspace Vault to remove the message from all mailboxes
• Use IMAP to connect to mailboxes and remove the message

Due to security requirements, an organization requires blocking access to consumer Gmail (gmail.com) while allowing enterprise Google Workspace account access (company.com). How is this accomplished?

• Turn off Gmail for consumer accounts in the organizational service settings in the Google Workspace Admin console.
• Create a CNAME record for gmail.com in your DNS settings to redirect consumer traffic.
• Add a "X-GoogApps-Allowed-Domains HTTP header" header to outbound Google Workspace traffic at your network perimeter.
• Disallowing access to consumer Gmail can only be accomplished via written policy versus technical means

A customer moving to Google Workspace wants to replace the current ticketing system with a Google Workspace account tickets@company.com. Which of the following limits is likely to cause issues with this goal?

• 25 GB of mail storage capacity
• 100 Auto-forward mail filters
• 50,000 received messages per day
• 4 GB of bandwidth per day (upload and download)
• 2,000 sent messages per day

Which API can you use to list, create, and modify Google Workspace users?

• Google Workspace Admin Settings API
• Google Google Workspace Users API
• Admin SDK Directory API
• Admin SDK Enterprise License Manager API
• Google Domain Shared Contacts API

Which three of the following actions can be configured for messages matching a content compliance rule?

Select 3 Correct Responses

• Quarantine
• Deliver with modification
• Reject
• Suspend User
• Deliver after time interval

Which of the following is not available as a means of interoperability between Google Workspace and legacy platforms?

• Full access to calendar events across recent Exchange platforms
• Sophisticated mail routing rules for moving email between platforms
• Federation for XMPP standard based chat systems
• Presence in Microsoft Office files to detect when it’s safe to edit document
• Shared video conferencing between SIP/H.323 systems

An organization is migrating all the employees to Google Workspace except for a small, independent group of users in Antarctica. You want to include the users in Antarctica in the global address list for Google Workspace without additional licensing costs. What should you do?

• Add domain shared contact records for the Antarctic users.
• Add user accounts for the Antarctica users, but suspend their accounts.
• Create an organizational unit for only the Antarctica users.
• Add a new contact for each Antarctica user in the administrator's “My Contacts” list.

Google Workspace Migration for Microsoft Exchange (GWMME) uses a control comma-separated values (CSV) file to map legacy accounts to Google Workspace accounts. An organization yourdomain.com is migrating from Exchange where user Google Workspace addresses will remain unchanged from the Exchange environment. How should each user entry be entered into the control file?

• user@yourdomain.com, user@yourdomain.com, Google Workspace password
• user@yourdomain.com, user@yourdomain.com
• user@yourdomain.com
• user@yourdomain.com, user@yourdomain.com, Google Workspace Organizational Unit

What is the Google-recommended SPF setting for a domain that uses Google Workspace as the primary mail system?

• v=spf1 include:_ghs.google.com ~all
• v=spf1 a:google.com mx ptr ~all
• v=spf1 a:aspmx.l.google.com -all
• v=spf1 include:_spf.google.com ~all
• v=spf1 include:_spf.google.com -all

As the administrator for your Google Workspace domain you need to investigate why one of your users didn’t receive an important message. The message was sent to them 45 days ago. What should you do?

• Obtain the message ID from the sender and use the Gmail API to locate the message.
• Obtain the message ID from the sender and use the Email Log Search feature to confirm the post delivery message status.
• Use the Email Log Search feature in the Admin console to confirm whether the message was delivered using sender and recipient SMTP addresses.
• Use the subject of the message and the Email Log Search feature to confirm the post delivery message status.

An organization wants to enforce policies on iOS devices. Which step must you perform before enabling iOS Sync in the Admin console?

• Configure a whitelist of iOS apps to be installed as managed applications.
• Disable Google Sync.
• Enable device activation.
• Install and set up the Apple Push Certificate.

An organization has successfully installed Password Sync in their environment. They report that not all Active Directory user passwords are syncing to Google Workspace. What should they do to resolve this problem?

• Ensure that Password Sync is installed on their Windows Server Core with the Active Directory role.
• Ensure that Google Cloud Directory Sync (GCDS) has completed the initial password sync.
• Ensure that Password Sync is installed on every writable domain controller.
• Ensure that Password Sync is installed on their Microsoft Exchange Server.

An organization wants to deploy Google Drive File Stream but is concerned about potential implications to their network due to limited bandwidth. What is the Google recommended way to mitigate these concerns?

• Strategically deploy Drive File Stream only to users with ample network bandwidth
• Use registry (Windows) and defaults (macOS) controls on specific clients to reduce requirements
• Allow only Google native files to be streamed to reduce bandwidth
• Drive File Stream automatically scans networks for available bandwidth and reduces usage
• Use the bandwidth controls in the Google Admin console to reduce requirements

A user created a Google Site in the domain altostrat.com. The user wants to make the site accessible using the URL http://myproject.altostrat.com. What should the administrator do?

• Configure a web address mapping in the site settings.
• Create a TXT record that contains "name: myproject value:altostrat.com."
• Configure a web address mapping in the Admin console.
• Create a CNAME record that points myproject.altostrat.com to google.com.

Which of the following is true regarding Google’s native mobile device management (MDM) platform?

• Basic mode MDM is enabled by default for all Google Workspace accounts
• Advanced mode MDM is enabled by default for all Google Workspace accounts
• Basic mode MDM is required for all accounts that use third party MDM providers
• Advanced mode MDM is required for all accounts that use third party MDM providers

What of the following is NOT required to use Endpoint Verification?

• Chrome browser
• Chrome OS
• Endpoint Verification Chrome extension
• Endpoint Verification custom executable

You are working in the Google Workspace Admin console. You need to block sign-in attempts from applications that do not use modern security standards, and thus are considered less secure. What type of applications should you block?

• Applications that rely on certificate based authentication to access an account programmatically
• Applications that rely on plain SSO authentication to access an account programmatically
• Applications that rely on plain authentication to access an account programmatically
• Applications that rely on username/password authentication to access an account programmatically

An organization has the following Vault rules configured:
-A default rule that retains messages for 5 years.
-A custom rule that retains messages with label “misc” for 3 years.
"An organization has the following Vault rules configured:
-A default rule that retains messages for 5 years.
-A custom rule that retains messages with label “misc” for 3 years.
For a conversation started on 1/1/2013, if a user put the “misc” label on a single message in the conversation sent on February 1, 2013, what will the status of all messages in the conversation be on February 1, 2016?

• All messages up to the labelled message are deleted. All messages sent after are retained until 2018.
• All messages up to the labelled message are kept. All messages sent after are removed.
• None of the messages are deleted.
• All of the messages are deleted.

You are installing Google Workspace Migration for HCL Notes (GWMHN) and want to ensure that it will run in the organization's environment. What should you do?

• Sign the GWMHN templates with the migration server ID or the ID of a user who has the rights to run agents on the server.
• Sign the GWMHN templates with a special Google ID and grant the ID full access to all of the organization's mail servers.
• Place GWMHN in a separate Domino organization and cross-certify it with the customer organization.
• Install a GWMHN instance on each of the organization's mail servers.

What must an administrator ensure before using a third party mobile device management (MDM) system for Google Workspace devices?

• Good device policy application must be installed on all devices
• Both Google advanced and basic mode MDM must be disabled
• Users will not require Android Enterprise because it only works with Google MDM
• Google advanced mode MDM must be disabled
• No native Google applications will be used by users for access Google Workspace data

Which two of the following are supported by Google Workspace Migration for Microsoft Exchange (GWMME)?

Select 2 Correct Responses

• ICS
• MBOX
• Microsoft Exchange profile
• PST
• CSV

Which of the following is not a supported source for identifying users during a login challenge to Google Workspace?

• SMS text of pin code
• Google Authenticator code
• Voice call pin code
• Employee ID
• Recovery email account

You have developed a script that uses the Drive API to add files to Google Drive. The script exits early with a 403: Rate Limit exceeded response from the Google servers. What two steps can you take?

Select 2 Correct Responses

• Request additional quota in the Developer Console project.
• Implement exponential back-off in your code
• Add the Override_Rate_Limit header to each API request.
• Insert a delay between each API call in your code.
• Batch your requests.

How can a Google Workspace administrator programmatically access a user's data without any manual authorization on the user’s part?

• Individual user accounts must always consent to having their data accessed
• A support ticket can be filed with Google support to allow time based access to user data by the super administrator
• User accounts can be granted the ‘Data Authority’ administrative role to access other user’s data
• Grant a service account domain-wide delegation of authority
• Super administrators get access to all user data by default in Google Workspace

When using Password Sync to synchronize passwords, how is the password sent to Google from Active Directory?

• Salted SHA-1 over HTTP
• Clear text over HTTP
• Salted SHA-512 over HTTPS
• Clear text over HTTPS
• MD-5 over HTTPS

What is Google’s maximum suggested latency for Google Meet?

• 3,000ms
• 400ms
• 1,000ms
• 100ms
• 20ms

An organization reports that valid email messages sent by their users are being marked as spam by several recipient domains. They ask for your help addressing this issue. What should you do?

• Recommend that they talk to the recipient’s domain administrators and request being added to their whitelist.
• Create a Google provided CNAME record in their DNS settings.
• Ensure that SPF, DKIM, and DMARC are set up correctly for their domain.
• Add the recipient domains to the outbound whitelist in Google Workspace.

What is Google's recommended approach for analyzing patterns in mail flow for large organizations?

• Use the "export Gmail traffic" option in the Google Workspace Admin console to download all data in .csv format for use in the tool of their choice
• Use Google Workspace’s Big Query export functionality and use the SQL interface for analyzing patterns
• Google Workspace provides customizable graphs directly in the Google Workspace Admin console for this purpose
• Use in-line network monitoring tools to capture packet level data for advanced analytics

An organization, domain.com, wants to change their primary Google Workspace domain to newdomain.com. Which steps will achieve this goal?

• Add newdomain.com as an additional domain in the Google Workspace Admin console of domain.com; then use the MAKE PRIMARY option to promote newdomain.com as the account's primary domain.

• Provision newdomain.com as a new primary domain. Use domain whitelisting from newdomain.com to domain.com to allow users to sign in to newdomain.com.
• Provision newdomain.com as a new primary domain. Use the Domains.get method of the Directory API to merge domain.com into newdomain.com.
• Add newdomain.com as a domain alias to domain.com; allow users to sign in using their primary address or their domain alias address.

An organization is using Google Calendar Interop for Microsoft Exchange. Users are provisioned in both Google and the legacy environment. When doing lookups from a Google Workspace account, you want to ensure that free/busy status for a user comes from Exchange. Which two methods should you choose?

Select 2 Correct Responses

• Move the user in Google to an organization unit (OU) with the Calendar service disabled.
• Suspend the user in Google.
• Disable sharing of the user's primary Google calendar within their organization.
• Add the user to the "Exchange Calendar" Google Group.
• Delete the user’s primary Google calendar.

A Google Workspace account is set up with a third-party Single Sign-On (SSO) solution. Which access method will require the user to enter their password stored in Google Workspace versus their SSO login credential?

• Google Workspace Sync for Microsoft Outlook
• Google Workspace Migration for Microsoft Outlook
• Android device using Android sync
• Google Admin console

 More certification answers: https://en.certificationanswers.com/exams-answers/