Google Professional Google Workspace Administrator Practice Test - Questions Answers, Page 10

To prepare the Chromebooks for use and register them in Google Workspace, enterprise enrollment is required. This process ensures that the devices are managed under your organization's policies.

Enterprise Enrollment: This is a process that ties a Chromebook to your organization's Google Workspace account, applying policies and settings you've configured in the Google Admin console.

Steps for Enrollment:

Turn on the Chromebook: Start the device and wait for the login screen to appear.

Initiate Enrollment: Press Ctrl + Alt + E at the login screen. This key combination is specifically designed to start the enterprise enrollment process.

Sign In: Use the credentials of an account that has the necessary permissions to enroll devices (typically a Google Workspace admin account).

Complete Enrollment: Follow the prompts to complete the process. The device will now be managed under your organization's policies.

Re-enrollment Settings: It's recommended to enable forced re-enrollment in the Google Admin console to ensure that devices cannot be used without being enrolled again if they are wiped.

Enroll ChromeOS devices before deployment

To restrict access to the 'Employee Compensation' subfolder within a Team Drive (now known as a shared drive), you should move the contents to a new shared drive with restricted membership.

Current Setup: All HR employees have access to the 'HR Department' Team Drive, but only a subset should access the 'Employee Compensation' subfolder.

New Shared Drive:

Create a New Shared Drive: This shared drive will be specifically for sensitive documents like employee compensation.

Move Contents: Transfer the files and folders from the 'Employee Compensation' subfolder to this new shared drive.

Manage Membership: Add only the relevant team members to this new shared drive, ensuring that only authorized personnel can access the sensitive information.

Steps:

In the Google Admin console, navigate to Drive and Docs > Manage shared drives.

Create a new shared drive and name it appropriately.

Move the necessary files and folders into this new shared drive.

Set the membership and permissions to include only the relevant users.

Manage shared drives

Control access to files and folders in shared drives

Step by Step Comprehensive Detailed Explanation: To comply with the company's Information Security policy while granting provisional access to a new Marketplace app, follow these steps:

Add the Marketplace App: Start by adding the requested app to your Google Workspace Marketplace.

Review Authorized Scopes:

Go to the Admin console.

Navigate to Security > API controls > Manage third-party app access.

Add the app and review the scopes it requests. Ensure it doesn't request permission to read or manage emails.

Compliance Steps:

Restrict Access: Configure the app to be accessible only to the specific individuals as per the request.

Immediate Notification: Inform the Infosec team immediately about the provisional access granted.

Security Risk Analysis Report: Prepare and submit a security risk analysis report within 14 days, detailing the app's functionality and security implications.

Verification: Ensure that the Gmail setting 'Let users delegate access to their mailbox' is disabled if the app's authorized scopes are compliant with the policy.

Manage third-party app access to Google Workspace data

Google Workspace Security: API Controls

Access the Admin Console: Log into your Google Workspace Admin Console.

Select User A: Navigate to the Directory and select User A's account.

Check Licenses: Under the Licenses section, check the current license type of User A. As User A holds a Basic License, they lack access to certain services available to Business License holders.

Change License: Change User A's license from Basic to Business. This can be done by assigning the Business License to User A within the Licenses section.

Verify Access: After changing the license, verify that User A can now access Google Drive and Docs without any errors.

Google Support: Assign or remove a user license

Access Admin Console: Log into your Google Workspace Admin Console.

Disable Guest Mode and Public Sessions: Navigate to Devices > Chrome > Settings. Disable Guest Mode and Public Sessions to prevent unauthorized users from accessing the device.

Restrict Sign-In: Go to Device Settings > User & Browser Settings.

Configure Device Policy: Enable the policy 'Restrict Sign-In to List of Users.'

Add Employee Email: Add the specific employee's email address to the list of allowed users. This ensures only the specified employee can sign in to the device.

Google Support: Configure Chrome devices

Access Admin Console: Log into your Google Workspace Admin Console.

Navigate to Transfer Tool: Go to Apps > Google Workspace > Drive and Docs > Transfer ownership.

Initiate Transfer: Enter the email address of the former employee and the manager who will receive the data.

Select Data: Choose to transfer all Drive data to the manager's account.

Complete Transfer: Confirm the transfer. This will transfer ownership of all Drive data from the former employee to the manager, ensuring they have access to the required information.

Google Support: Transfer Drive files to a new owner

Identify Sensitive Information: Determine which users handle sensitive information and assess the current sharing practices.

Define Sharing Boundaries: Establish clear boundaries and guidelines for sharing sensitive information within the organization.

Implement Target Audiences: In the Google Admin console, go to Apps > Google Workspace > Drive and Docs > Sharing settings. Set up target audiences for different groups of users based on their roles and the sensitivity of the information they handle.

Educate Users: Conduct training sessions to educate users on how to share information securely and the importance of adhering to the defined sharing boundaries.

Monitor Sharing Activity: Regularly monitor sharing activity to ensure compliance with the new policies and to identify any instances of oversharing.

Adjust Policies as Needed: Based on the monitoring results, make any necessary adjustments to the sharing policies and target audiences to enhance security and prevent accidental oversharing.

Google Workspace Admin Help - Target Audiences

Google Workspace Admin Help - Sharing Settings

Move to Shared Drive:

Shared Drives in Google Workspace are designed to store files owned by the team or the organization rather than an individual user.

When files are moved to a Shared Drive, the ownership of those files is transferred to the domain, which means the storage quota for individual users is not affected.

To move files to a Shared Drive:

Navigate to Google Drive.

Select the files or folders to move.

Right-click and choose 'Move to' and select the appropriate Shared Drive.

Transfer Ownership:

You can transfer ownership of files from one user to another within the same domain.

This is helpful if a user is running out of storage quota, as the storage used by the file will count against the new owner's quota.

To transfer ownership:

Open the file in Google Drive.

Click on the Share button.

Add the new owner and change their role to 'Owner'.

The new owner must accept the ownership transfer.

Google Workspace Admin Help: Shared Drives

Google Drive Help: Transfer File Ownership

Organizational Units (OUs):

Google Workspace allows the creation of Organizational Units (OUs) to manage and apply settings to specific groups of users.

By placing users in an OU where services are disabled, you can prevent access to Google Workspace services until you are ready to enable them.

Setting Up OUs:

Navigate to the Google Admin console.

Create a new OU for the users whose access needs to be restricted.

Move the users into this OU.

Disable services for this OU:

Go to Apps in the Admin console.

Click on Google Workspace core services.

Select the OU and turn off the services you wish to disable.

Google Workspace Admin Help: Set Up an Organizational Unit

Google Workspace Admin Help: Control Who Uses Google Workspace Services