AGWA Practice Questions

This is the most secure and manageable approach. By changing the default Marketplace setting to only allow specific applications, you create a deny-by-default posture. You can then build an 'allowlist' of vetted applications. This allowlist can be applied to the entire domain or targeted to specific OUs, like the 'Sales' OU in this case, ensuring only they have access to the approved CRM app.

Google Takeout is managed as a service within the Admin Console under 'Additional Google services'. Like other services, its availability can be controlled on a per-OU basis. The correct procedure is to navigate to this service, select the 'Students' OU, and set the service status to OFF. This will prevent users in that OU from accessing the Takeout page, while leaving it available for other OUs like 'Faculty'.

Google Drive for desktop has a built-in diagnostic mode for troubleshooting. The correct procedure is to have the user hold the Shift key while clicking the Settings gear in the application's menu. This reveals a hidden option, 'Create diagnostic logs', which packages all the necessary logs and performance data into a single zip file that can be easily attached to a support case.

Chrome Browser Cloud Management (CBCM) is the Google tool designed specifically for this purpose. By generating an enrollment token in the Admin Console and deploying it to the laptops (e.g., via a registry key or script), the browsers become managed entities. Once enrolled, they appear in a special OU in the Admin Console, where you can apply hundreds of browser-specific policies, including disabling incognito mode and force-installing extensions, regardless of the user signed in.

This is the correct, multi-layered approach. First, a custom retention rule should be set for Gmail to 'Retain for a specific period' (7 years) and then 'Purge the data'. This automates the standard lifecycle. For the exceptions, you create a 'matter' in Vault for each legal case and place a 'hold' on the relevant mailboxes or data. A hold always overrides any retention rule, ensuring the data is preserved indefinitely until the hold is released, at which point the 7-year purge rule would apply.

This scenario is a classic use case for Data Loss Prevention (DLP) rules. A Drive DLP rule can be configured to scan files for specific content using predefined detectors (like Tax Identification Numbers). The rule's actions can be set to block external sharing, display a custom warning to the user, and send an email alert to the compliance team, fulfilling all requirements. Vault is for retention/eDiscovery, trust rules manage sharing at a high level without content inspection, and content compliance is specific to Gmail.

The most direct and modern way to handle this is by using sharing policy exceptions based on groups, which overrides the OU's setting. You set the restrictive policy at the OU level (domain-only sharing) and then apply a more permissive policy specifically to the 'Sales-Managers' group. This avoids restructuring OUs, which can have wider implications. Target audiences are for suggesting shares, not enforcing permissions. Whitelisting domains is too restrictive if they need public sharing.

Suspending a user account is the correct action. It immediately blocks user sign-in access and stops new mail delivery. However, all existing data remains in place and is accessible to administrators and Google Vault for eDiscovery purposes. Deleting the account would permanently remove the data after a grace period. Archiving is a paid option that also preserves data but is designed for long-term storage, whereas suspension is the standard immediate action for terminated employees pending data review.

Dual delivery is configured in the Gmail 'Routing' settings. You create a new routing rule that applies to all inbound messages. In the rule's options, you select 'Also deliver to' and add a new recipient, which would be the mail host of the legacy Exchange server. This ensures a copy is sent to the on-premises server after it's delivered to the Gmail inbox. An inbound gateway is for processing mail coming from a specific gateway, not for routing outgoing copies.

Context-aware access policies are designed for this exact scenario. They allow administrators to create granular access control rules based on user identity, location (IP address), device security status, and other attributes. A policy restricting access to corporate IP addresses for a specific OU is a common implementation of context-aware access. 2SV would prompt for a second factor but not block based on IP. Session control manages what happens after login.