Your company recently decided to use a cloud-based ticketing system for your customer care needs. You are tasked with rerouting email coming into your customer care address, customercare@your- company.com to the cloud platform's email address, your-company@cloudprovider.com. As a security measure, you have mail forwarding disabled at the domain level.What should you do?
Answer(s): D
Access the Admin Console: Log into your Google Workspace Admin Console. Navigate to Apps: Go to Apps > Google Workspace > Gmail > Compliance. Create a Content Compliance Rule: Create a new content compliance rule. Set Conditions: Set the condition to apply to incoming mail for customercare@your-company.com. Change Route: Configure the rule to change the route to your-company@cloudprovider.com. This effectively reroutes emails without using traditional forwarding, which is disabled at the domain level.Save and Apply: Save the compliance rule and ensure it is applied to enforce the new routing policy.ReferenceGoogle Support: Set up content compliance
Your business partner requests that a new custom cloud application be set up to log in without having separate credentials.What is your business partner required to provide in order to proceed?
Answer(s): B
In order to set up a new custom cloud application to log in without having separate credentials, you need to configure Single Sign-On (SSO) using SAML (Security Assertion Markup Language). The Assertion Consumer Service (ACS) URL is a critical piece of information required for this configuration. It is the endpoint on the service provider's system that receives the authentication assertions from the identity provider (Google Workspace in this case). Service Provider ACS URL: The ACS URL is necessary for the SSO configuration because it is the URL to which the identity provider will send the SAML assertion after authentication. This URL tells the identity provider where to send the SAML response after the user has been authenticated.Configuration Steps:In Google Admin console, navigate to Apps > Web and mobile apps.Add a custom SAML app.Enter the ACS URL provided by the service provider in the appropriate field. Complete the configuration by providing other necessary information such as the Entity ID and Name ID format.Importance: Without the ACS URL, the identity provider will not know where to send the authentication tokens, making SSO impossible.
Google Workspace Admin Help: Set up your own custom SAML app
Your organization has recently gone Google, but you are not syncing Groups yet. You plan to sync all of your Active Directory group objects to Google Groups with a single GCDS configuration.Which scenario could require an alternative deployment strategy?
Answer(s): A
When planning to sync all Active Directory group objects to Google Groups using Google Cloud Directory Sync (GCDS), you must consider the sensitivity of the group memberships. If some of the groups contain sensitive information or membership, an alternative deployment strategy might be necessary.Sensitive Group Membership: If certain groups contain members or data that are sensitive, synchronizing these groups directly might expose this sensitive information to unauthorized users.Alternative Strategies:Implement separate synchronization settings for sensitive groups. Use security groups to control access to sensitive information. Manually manage sensitive groups to ensure tight control over membership and data access.Steps to Consider:Evaluate which groups contain sensitive information.Configure GCDS to exclude these sensitive groups from the general synchronization process. Synchronize sensitive groups separately or manage them manually to ensure data security and compliance with privacy policies.
Google Cloud Directory Sync Admin HelpBest practices for using Google Cloud Directory Sync (GCDS)
Your company has just received a shipment of ten Chromebooks to be deployed across the company, four of which will be used by remote employees. In order to prepare them for use, you need to register them in Google Workspace.What should you do?
To prepare the Chromebooks for use and register them in Google Workspace, enterprise enrollment is required. This process ensures that the devices are managed under your organization's policies.Enterprise Enrollment: This is a process that ties a Chromebook to your organization's Google Workspace account, applying policies and settings you've configured in the Google Admin console.Steps for Enrollment:Turn on the Chromebook: Start the device and wait for the login screen to appear. Initiate Enrollment: Press Ctrl + Alt + E at the login screen. This key combination is specifically designed to start the enterprise enrollment process.Sign In: Use the credentials of an account that has the necessary permissions to enroll devices (typically a Google Workspace admin account).Complete Enrollment: Follow the prompts to complete the process. The device will now be managed under your organization's policies.Re-enrollment Settings: It's recommended to enable forced re-enrollment in the Google Admin console to ensure that devices cannot be used without being enrolled again if they are wiped.
Enroll ChromeOS devices before deployment
All Human Resources employees at your company are members of the "HR Department" Team Drive. The HR Director wants to enact a new policy to restrict access to the "Employee Compensation" subfolder stored on that Team Drive to a small subset of the team.What should you do?
Answer(s): C
To restrict access to the "Employee Compensation" subfolder within a Team Drive (now known as a shared drive), you should move the contents to a new shared drive with restricted membership. Current Setup: All HR employees have access to the "HR Department" Team Drive, but only a subset should access the "Employee Compensation" subfolder.New Shared Drive:Create a New Shared Drive: This shared drive will be specifically for sensitive documents like employee compensation.Move Contents: Transfer the files and folders from the "Employee Compensation" subfolder to this new shared drive.Manage Membership: Add only the relevant team members to this new shared drive, ensuring that only authorized personnel can access the sensitive information.Steps:In the Google Admin console, navigate to Drive and Docs > Manage shared drives.Create a new shared drive and name it appropriately.Move the necessary files and folders into this new shared drive. Set the membership and permissions to include only the relevant users.
Manage shared drivesControl access to files and folders in shared drives
Post your Comments and Discuss Google GOOGLE-WORKSPACE-ADMINISTRATOR exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the GOOGLE-WORKSPACE-ADMINISTRATOR content, but please register or login to continue.