GOOGLE-WORKSPACE-ADMINISTRATOR Practice Questions

Access Admin Console: Log in to the Google Admin console using your administrator account.

Create a Group: Go to Directory > Groups and create a new group for the administrative assistants.

Add Members: Add the administrative assistants to this group.

Enable Delegated Access: Go to Users > [CEO's account] > Account and click on Email delegation.

Delegate Mailbox Access: Enter the email address of the newly created group. This allows all

members of the group to access the CEO's mailbox.

Save Changes: Confirm and save the changes. The administrative assistants will now have delegated

access to the CEO's email account, allowing them to manage emails while the CEO is traveling.

Reference:

Google Workspace Admin Help: Email delegation

Google Workspace Best Practices for Email Delegation

Develop an App Script:

Write an App Script to retrieve user data from the Google Workspace directory, including license

type and last login date.

Ensure the script filters data based on the team leader's direct reports.

Create a Google Sheet:

Set up a Google Sheet to display the retrieved data.

Use filter views to restrict the data visible to each team leader, showing only their direct reports.

Automate Data Refresh:

Schedule the App Script to run periodically (e.g., once a week) to ensure the data is up-to-date.

Share with Team Leaders:

Share the Google Sheet with team leaders, ensuring they have view-only access to the relevant filter

views.

Reference

Google Workspace Admin Help: App Script

Google Workspace Admin Help: Filter views in Google Sheets

Access the Admin Console:

In the Google Workspace Admin console, navigate to "Reports" > "Audit" > "Login".

Generate a Login Audit Report:

Customize the report to include details about suspicious login attempts.

Set the time frame to the past year and filter the results to show only suspicious logins.

Export the Report:

Export the login audit report in a suitable format (e.g., CSV) for further analysis.

Ensure the report includes user account details and the number of suspicious login attempts for each

account.

Analyze the Data:

Review the exported data to identify patterns and determine how frequently suspicious login

attempts occur within the organization.

Provide the analysis to the CISO with the required details for each user account.

Reference

Google Workspace Admin Help: View and analyze login audit logs

Access the Transfer Tool:

In the Google Workspace Admin console, go to "Users" > "Transfer tool for unmanaged users".

Identify Unmanaged Accounts:

Use the tool to search for unmanaged accounts (consumer Google accounts) that have corporate

email addresses.

Send Transfer Requests:

Send transfer requests to the identified unmanaged accounts, asking the former users to transfer

their accounts to your managed domain.

Monitor and Complete Transfers:

Monitor the transfer process and ensure that the accounts are successfully transferred.

Verify that the transferred accounts are now managed under your Google Workspace domain,

preventing unauthorized access to services.

Reference

Google Workspace Admin Help: Transfer tool for unmanaged users

To restrict access to the "Employee Compensation" subfolder within a Team Drive (now known as a

shared drive), you should move the contents to a new shared drive with restricted membership.

Current Setup: All HR employees have access to the "HR Department" Team Drive, but only a subset

should access the "Employee Compensation" subfolder.

New Shared Drive:

Create a New Shared Drive: This shared drive will be specifically for sensitive documents like

employee compensation.

Move Contents: Transfer the files and folders from the "Employee Compensation" subfolder to this

new shared drive.

Manage Membership: Add only the relevant team members to this new shared drive, ensuring that

only authorized personnel can access the sensitive information.

Steps:

In the Google Admin console, navigate to Drive and Docs > Manage shared drives.

Create a new shared drive and name it appropriately.

Move the necessary files and folders into this new shared drive.

Set the membership and permissions to include only the relevant users.

Reference:

Manage shared drives

Control access to files and folders in shared drives

Admin Console: Log into the Google Admin console at admin.google.com.

Reports Menu: Navigate to Reports > Reports.

Accounts Aggregate Report:

Under the “Reports” section, select “Accounts”.

Click on “Aggregate” to view the report.

Download Data:

Click on the download icon and choose “Google Sheets” as the format to export the data.

This report includes a count of active and suspended users by organizational unit.

Google Sheets:

Open the downloaded report in Google Sheets.

Review and organize the data as needed to present it by Org unit, ensuring it matches the Regions

and Departments within your company.

Reference

Google Workspace Admin: Reports overview

Google Workspace Admin: Aggregate reports

Access Admin Console:

Sign in to the Google Admin console.

Navigate to Reporting:

Go to "Reporting" > "Reports."

Select the Phishing Report:

In the Reports section, find the "Phishing" report.

This report will show data on phishing attempts and their status.

Review Phishing Attempts:

Check the report for the number of phishing attempts.

Analyze trends and details of each attempt to provide comprehensive information to the CISO.

Export and Share Report:

Export the report if needed to share with the CISO or other stakeholders.

Use this data to inform security measures and policies.

Reference:

View Reports on Phishing

Google Workspace Security Reports

Create an Alert for External Sharing:

Access Google Admin Console: Go to admin.google.com and sign in with your administrator account.

Navigate to Rules: Go to "Security" > "Alert Center" > "Manage Rules".

Create a New Rule: Select "Create Rule" and choose "Drive Audit" as the event source.

Configure Rule Settings: Set the conditions to trigger alerts when files or folders are shared

externally.

Set Notification P

Configure who should receive the alerts and how they should be

notified.

Save the Rule: Save and activate the rule to start receiving alerts on external sharing activities.

Create a Custom Dashboard for External Sharing:

Access Security Investigation Tool: In the Admin console, go to "Security" > "Investigation Tool".

Create a New Investigation: Click "Create" and select "Drive" as the data source.

Set Up Investigation Parameters: Define the parameters to track external sharing activities (e.g., file

shared externally, users involved).

Create Dashboard: Save the investigation as a custom dashboard to continuously monitor external

sharing activities.

Review and Monitor: Regularly review the dashboard and set up automated reports if necessary.

Reference

Google Workspace Admin Help - Create and manage alerts

Google Workspace Admin Help - Use the security investigation tool

Access the Transfer Tool:

In the Google Workspace Admin console, navigate to "Users" > "Transfer tool for unmanaged users".

Identify Conflict Accounts:

Use the tool to search for unmanaged users (conflict accounts) that have email addresses matching

your company domain.

Send Transfer Requests:

Send transfer requests to the identified unmanaged users, asking them to transfer their accounts to

your Google Workspace domain.

Complete the Transfer:

Guide the users through the transfer process to ensure their accounts are moved to the managed

Google Workspace environment.

Verify the transfer completion and resolve any remaining conflicts.

Reference

Google Workspace Admin Help: Transfer tool for unmanaged users

Access Admin Console: Log into your Google Workspace Admin Console.

Disable Guest Mode and Public Sessions: Navigate to Devices > Chrome > Settings. Disable Guest

Mode and Public Sessions to prevent unauthorized users from accessing the device.

Restrict Sign-In: Go to Device Settings > User & Browser Settings.

Configure Device Policy: Enable the policy "Restrict Sign-In to List of Users."

Add Employee Email: Add the specific employee’s email address to the list of allowed users. This

ensures only the specified employee can sign in to the device.

Reference

Google Support: Configure Chrome devices