Google Professional Google Workspace Administrator Practice Test - Questions Answers, Page 20

Access Admin Console: Log into your Google Workspace Admin Console.

Navigate to Alert Center: Go to Security > Alert Center.

Enable Alert Rule: Find and enable the ''Suspended user made active'' rule.

Configure Recipients: In the alert rule settings, add the CTO as an additional recipient under the ''Other Recipients'' section.

Save Settings: Save the configuration. The CTO will now receive notifications whenever a suspended user's account is re-enabled, ensuring compliance with the new security policy.

Google Support: Alert Center

When configuring Google Cloud Directory Sync (GCDS) to manage Google Group memberships from an internal LDAP server, it's crucial to ensure that manually managed groups are not inadvertently deleted during the sync process. The correct setting to prevent this is found within the GCDS configuration manager.

Access GCDS Configuration Manager:

Open the GCDS configuration manager on your server.

Navigate to Group Settings:

Go to the section where group settings are configured.

Update Group Deletion Policy:

Find the group deletion policy setting.

Change the policy to ''don't delete Google groups not found in LDAP.''

Save Configuration:

Save the updated configuration to ensure that the settings are applied during the next synchronization.

By updating this setting, GCDS will no longer delete Google Groups that are not found in LDAP, thereby preserving manually managed groups.

Google Cloud Directory Sync Admin Help

GCDS Configuration Guide

To enable the marketing department to easily share items within their team without exposing them to the entire company, the following steps should be taken:

Create a Shared Drive for Marketing:

In the Google Admin console, navigate to Apps > Google Workspace > Drive and Docs.

Create a new shared drive specifically for the marketing department.

Add all relevant marketing team members to this shared drive, ensuring that it is used for internal purposes only.

Set Up a Target Audience:

In the Admin console, go to Apps > Google Workspace > Drive and Docs > Sharing settings.

Create a target audience that includes all members of the marketing department.

This allows for easier link sharing within the department by setting the target audience as the default sharing option.

Steps to Configure:

Shared Drive: Ensure that the shared drive permissions are set to limit access to the marketing team.

Target Audience: Configure the target audience so that marketing team members can easily share files internally without defaulting to company-wide sharing.

By setting up a dedicated shared drive and configuring a target audience, you ensure that file sharing is streamlined and restricted to the appropriate team members.

Set up target audiences

Create and manage shared drives

To provide the security team with access to the Security Investigation Tool, the appropriate privileges must be granted through a custom admin role.

Create Custom Admin Role:

In the Google Admin console, navigate to Admin roles.

Click on Create new role.

Assign Security Center Privileges:

Name the role appropriately, such as 'Security Investigator'.

Under Privileges, expand the Security Center section.

Select the necessary privileges, including access to the Security Investigation Tool.

Assign Role to Users:

After creating the role, go to the Admin roles section.

Click on Assign users and add the relevant security team members to this custom role.

Save and Verify:

Save the role and verify that the assigned users have the correct access.

Creating a custom admin role with specific security privileges ensures that the security team has the necessary tools to perform their duties without granting excessive permissions.

Manage admin roles

Security Center overview

To prevent data exfiltration from Google apps on iOS devices, you need to configure the appropriate settings in the Google Admin console.

Navigate to Device Management:

In the Google Admin console, go to Devices > Mobile and endpoints > Universal Settings > iOS settings.

Configure Data Protection Settings:

Find the setting for 'Allow items created with managed apps to open in unmanaged apps'.

Clear this checkbox to prevent users from copying data from managed (work) apps to unmanaged (personal) apps.

Save Changes:

Save the changes to ensure that the policy is enforced.

Verification:

Verify that the policy is applied by checking the behavior on an iOS device to ensure that data cannot be copied from managed apps to unmanaged apps or third-party applications.

By clearing this checkbox, you enforce a policy that restricts the movement of data from managed apps to unmanaged environments, thereby preventing data exfiltration.

Manage iOS settings

Endpoint management settings

Access Context-Aware Access Settings: In the Google Admin console, navigate to Security > Context-Aware Access.

Define Access Levels: Create access levels that specify the allowed geographical locations where your organization operates.

Apply Access Levels to Apps: Apply these access levels to Google Workspace applications to ensure that access is restricted based on the defined geographical locations.

Configure Policies: Set policies that deny access to Google services from locations outside the defined areas.

Test Configuration: Test the context-aware access settings to ensure they are working correctly and that unauthorized access attempts from other locations are blocked.

Monitor and Adjust: Continuously monitor the login activity and adjust the access levels as necessary to maintain security.

Google Workspace Admin Help - Context-Aware Access

Google Workspace Admin Help - Setting up Context-Aware Access