Google Professional Google Workspace Administrator Practice Test - Questions Answers, Page 8

Navigate to the Google Admin console at admin.google.com.

From the Admin console Home page, go to 'Security' and then to 'API controls.'

In the 'API controls' section, click on 'Manage Third-Party App Access.'

Here, you can add the OAuth Client ID of your internal app to the trusted list. This ensures that only apps you have vetted and approved can access Google Drive APIs, complying with your security policy.

Enter the OAuth Client ID of the new app and save the changes.

This process ensures that the new, internal, domain-owned app can access Google Drive APIs without compromising the security policies in place.

Google Workspace Admin Help - Manage API client access

Change the password for the suspected compromised account:

Sign in to the Google Admin console.

From the Admin console Home page, go to 'Users.'

Find and select the account '[email protected].'

Click on 'Security' and then 'Password.'

Follow the instructions to change the password.

Configure a Sender Policy Framework (SPF) record for your domain:

Log in to your domain host (e.g., GoDaddy, Bluehost).

Locate the page for updating your domain's DNS records.

Add a new TXT record for your domain with the SPF rule, typically something like:

v=spf1 include:_spf.google.com ~all

Save the changes to update the DNS records.

Changing the password helps secure the compromised account, while configuring SPF helps prevent email spoofing, ensuring that fake emails are less likely to be delivered as though they come from your legitimate email address.

Google Workspace Admin Help - Change or reset a user's password

Google Workspace Admin Help - Set up SPF records

Sign in to the Google Admin console.

From the Admin console Home page, go to 'Apps' and then 'Google Workspace' and 'Gmail.'

Select 'Compliance' and then 'Content compliance.'

Click on 'Add another rule' to create a new content compliance rule.

In the new rule setup, specify conditions:

For 'Email messages to affect,' choose 'Outbound' and 'Internal - sending.'

Under 'Add expressions,' select 'If ANY of the following match the message' and choose 'Predefined content match,' then select 'Credit Card Numbers.'

In the 'Actions' section, select 'Add more recipients' and specify the custom header your encryption provider uses.

Save the rule.

This ensures that emails containing credit card numbers are flagged and encrypted by your third-party encryption provider, fulfilling the security requirements set by your cyber security team.

Google Workspace Admin Help - Set up rules for content compliance

Sign in to the Google Admin console.

From the Admin console Home page, go to 'Security' and then 'Login challenges.'

Enable the 'Employee ID login challenge' setting.

Configure the challenge by defining the employee IDs that users need to provide during the login process.

Enabling Employee ID login challenges adds an additional layer of security without requiring 2-Step verification. This helps prevent unauthorized access by ensuring that users provide an additional piece of information known only to them.

Google Workspace Admin Help - Configure login challenges

''?>>?b GF\]\rom the Admin console Home page, go to 'Security.'

Under 'Security,' select 'API controls.'

In the 'API controls' section, click on 'Manage Third-Party App Access.'

Find the Google Drive API in the list.

Choose 'Disable All Access' for Google Drive to ensure that no third-party apps have OAuth permissions to Google Drive.

This configuration adheres to the policy set by the Chief Information Security Officer by preventing third-party apps from accessing Google Drive via OAuth.

Google Workspace Admin Help - Manage API client access

Sign in to the Google Admin console.

From the Admin console Home page, go to 'Security' and then to 'Alert center.'

In the Alert center, look for alerts related to user-reported spam.

You can review details of these alerts to monitor any spikes in user-reported spam activity.

The Alert center provides a centralized location to review and manage alerts, making it easier to identify trends and spikes in spam reports.

Google Workspace Admin Help - Alert Center Overview BFbC

Schedule regular meetings with your Google Workspace partner.

During these meetings, review the Google Workspace roadmap and upcoming features.

Discuss how new features can be leveraged to benefit your organization.

Plan business reviews to ensure that you are making the most of the platform's capabilities and staying up-to-date with developments.

Establishing a regular cadence of roadmap and business reviews ensures continuous alignment with the latest Google Workspace innovations and allows your organization to take full advantage of new features.

Google Workspace Admin Help - Google Workspace Partners

Verify DMARC, DKIM, and SPF records:

Sign in to your domain host and navigate to the DNS settings.

Ensure that SPF (Sender Policy Framework) is set up correctly to prevent email spoofing.

Configure DKIM (DomainKeys Identified Mail) to add a digital signature to emails sent from your domain.

Set up DMARC (Domain-based Message Authentication, Reporting & Conformance) to provide instructions to receiving mail servers on how to handle emails that fail SPF or DKIM checks.

Enable Gmail spoofing and authentication settings:

Sign in to the Google Admin console.

From the Admin console Home page, go to 'Apps' > 'Google Workspace' > 'Gmail' > 'Safety.'

Enable settings related to spoofing and authentication to add additional layers of protection against phishing attempts.

By verifying these email security settings and enabling spoofing protections, you can help prevent unauthorized or fraudulent emails from being sent, thus reducing the risk of wire transfer fraud.

Google Workspace Admin Help - Set up SPF records

Google Workspace Admin Help - Set up DKIM

Google Workspace Admin Help - Set up DMARC

When developing the application in App Maker, define roles that correspond to the different levels of access needed by users.

Use scripts to control access to data based on user roles. This ensures that only authorized users can perform certain operations.

Set the owner access permissions appropriately to ensure that data can only be accessed or modified by those with the necessary permissions.

Regularly review and update roles and permissions to adapt to any changes in the organization or the application's usage.

Implementing these security measures ensures that data in your internal application is accessed and managed securely, mitigating risks associated with unauthorized access.

Google Workspace Admin Help - App Maker Security

Identify Unmanaged Accounts: First, you need to identify the unmanaged accounts in your domain. These are accounts created by users with their company email address but are not managed by your Google Workspace.

Use the Transfer Tool for Unmanaged Accounts: Google provides a specific tool called the 'Transfer tool for unmanaged users'. This tool allows administrators to invite users with unmanaged accounts to join the organization's managed Google Workspace account.

Send Invitations: Using this tool, you can send invitations to these users to join your Google Workspace domain.

Accept Invitations: The users need to accept the invitation to migrate their unmanaged account into your managed domain.

Monitor and Verify: After the invitation is accepted, monitor the process to ensure that all accounts are successfully migrated and are now managed under your Google Workspace domain.

Google Support: Transfer tool for unmanaged users