GW 11-20

Your organization's information security team has asked you to determine and remediate if a user ([e-mail]) has shared any sensitive documents outside of your organization. How would you audit access to documents that the user shared inappropriately?

• Open Security Investigation Tool-> Drive Log Events. Add two conditions: Visibility Is External, and Actor Is [e-mail].

• Have the super administrator use the Security API to audit Drive access

• As a super administrator, change the access on externally shared Drive files manually under [e-mail].

• Open Security Dashboard-> File Exposure Report-> Export to Sheet, and filter for [e-mail].

A user is reporting that external, inbound messages from known senders are repeatedly being incorrectly classified as spam. What steps should the admin take to prevent this behavior in the future?

• Modify the SPF record for your internal domain to include the IPs of the external user's mail servers.

• Update the spam settings in the Admin Console to be less aggressive

• Add the sender's domain to an allowlist via approved senders in the Admin Console.

• Instruct the user to add the senders to their contacts.

The credentials of several individuals within your organization have recently been stolen. Using the Google Workspace login logs, you have determined that in several cases, the stolen credentials have been used in countries other than the ones your organization works in. What else can you do to increase your organization's defense-in-depth strategy?

• Implement an IP block on the malicious user's IPs under Security Settings in the Admin Console.

• Use Context-Aware Access to deny access to Google services from geo locations other than the ones your organization operates in.

• Enforce higher complexity passwords by rolling it out to the affected users.

• Use Mobile device management geo-fencing to prevent malicious actors from using these stolen credentials.

You are the Workspace administrator for an international organization with Enterprise Plus Workspace licensing. A third of your employees are located in the United States, another third in Europe, and the other third geographically dispersed around the world. European employees are required to have their data stored in Europe. The current OU structure for your organization is organized by business unit, with no attention to user location. How do you configure Workspace for the fastest end user experience while also ensuring that European user data is contained in Europe?

• Configure a data region at the top level OU of your organization, and set the value to “Europe”

• Add three additional OU structures to designate location within the current OU structure. Assign the corresponding data region to each.

• Configure a configuration group for European users, and set the data region to “Europe”.

• Configure three configuration groups within your domain. Assign the appropriate data regions to each corresponding group, but assign no preference to the users outside of the United States and Europe.

As a team manager, you need to create a vacation calendar that your team members can use to share their time off. You want to use the calendar to visualize online status for team members, especially if multiple individuals are on vacation What should you do to create this calendar?

• Request the creation of a calendar resource, configure the calendar to “Auto-accept invitations that do not conflict,” and give your team “See all event details” access.

• Create a secondary calendar under your account, and give your team “Make changes to events” access.

• Request the creation of a calendar resource, configure the calendar to “Automatically add all invitations to this calendar,” and give your team “See only free/busy” access.

• Create a secondary calendar under your account, and give your team “See only free/busy” access.

Your Finance team has to share quarterly financial reports in Sheets with an external auditor. The external company is not a Workspace customer and allows employees to access public sites such as Gmail and Facebook. How can you provide the ability to securely share content to collaborators that do not have a Google Workspace or consumer (Gmail) account?

• Allow external sharing with the auditor using the ‘Trusted Domains’ feature.

• Enable the ‘Visitor Sharing’ feature, and demonstrate it to the Finance team.

• Use the ‘Publish’ feature in the Sheets editor to share the contents externally.

• Attach the Sheet file to an email message, and send to the external auditor.

Your organization has noticed several incidents of accidental oversharing inside the organization. Specifically, several users have shared sensitive Google Drive items with the entire organization by clicking ‘anyone in this group with this link can view’. You have been asked by senior management to help users share more appropriately and also to prevent accidental oversharing to the entire organization. How would you best accomplish this?

• Create groups, add users accordingly, and educate users on how to share to specific groups of people.

• Disable sharing to the entire organization so that users must consciously add every person who needs access.

• Determine sharing boundaries for users that work with sensitive information, and then implement target audiences.

• Temporarily disable the Google Drive service for individuals who continually overshare.

You are a Workspace Administrator with a mix of Business Starter and Standard Licenses for your users. A Business Starter User in your domain mentions that they are running out of Drive Storage Quota. Without deleting data from Drive, what two actions can you take to alleviate the quota concerns for this user? (Choose two.

• Add other users as “Editors” on the Drive object, thus spreading the storage quota debt between all of them.

• Manually export and back up the data locally, and delete the affected files from Drive to alleviate the debt.

• Make another user the “Owner” of the Drive objects, thus transferring the storage quota debt to them.

• Perform an API query for large storage drive objects, and delete them, thus alleviating the quota debt.

• Move the affected items to a Shared Drive. Shared Drives transfer ownership of the drive item to the domain itself, which alleviates the quota debt from that user

Your organization is preparing to deploy Workspace and will continue using your company’s existing identity provider for authentication and single sign-on (SSO). In order to migrate data from an external system, you were required to provision each user’s account in advance. Your IT team and select users (~5% of the organization) have been using Workspace for configuration and testing purposes. The remainder of the organization can technically access their accounts now, but the IT team wants to block their access until the migrations are complete. What should your organization do?

• Remove Google Workspace license to prevent users from accessing their accounts now.

• Suspend users that the organization does not wish to have access.

• Add the users to the OU with all services disabled.

• Use Context-Aware Access to simultaneously block access to all services for all users and allow access to all services for the allowed users.

Use Context-Aware Access to simultaneously block access to all services for all users and allow access to all services for the allowed users.

• Create a new Google Workspace domain isolated from the existing one, and create users in the new domain instead.

• Under Directory Settings > Contact sharing, disable the contact sharing option and wait for 24 hours to allow the settings to propagate before creating the new employee accounts.

• Redesign your OU organization to have 2 child OUs for each company directly under the root. In Directory Settings > Visibility Settings, define custom directories for each company, and set up Visibility according to the OU.

• Create one dynamic group for each company based on a custom attribute defining the company. In Directory Settings > Visibility Settings, define custom directories for each company, and set up Visibility according to the dynamic group.