PCEA Practice Questions

The RestrictSigninToPattern policy is the ideal solution. It allows users to sign into web services like Gmail but restricts the primary browser sign-in (which controls sync) to accounts matching a specific pattern (the corporate domain). This prevents browser data like history, bookmarks, and passwords from being synced to a personal @gmail.com account, while not blocking access to Google services.

Network configurations like Wi-Fi and VPN are device-level settings because they apply to the device itself, regardless of which user is logged in. These settings are found under Devices > Chrome > Settings > Device, and then by navigating to the Networks section for the appropriate Organizational Unit.

The Chrome Enterprise Connector for VMware Workspace ONE (and other UEMs) allows administrators to manage Chrome browser policies using their existing device management platform. It bridges the gap, enabling policy configuration within the Workspace ONE console, which then syncs those policies to the Google Admin console for enforcement on managed browsers.

The ExtensionSettings policy is a powerful and flexible policy that can control various aspects of extensions. To block installations based on permissions, you would use this policy to set a default behavior (installation_mode: 'blocked') for any extension that requests the specified permission ('history'). This is more effective than manually blocklisting every such extension.

This is false. Chrome Browser Cloud Management, which allows centralized policy management for Chrome browsers across Windows, Mac, and Linux, is available at no cost. A paid Chrome Enterprise Upgrade license is required for managing ChromeOS devices, but not for managing the browser on other operating systems.

The Google Admin console provides a 'Capture Logs' command for managed ChromeOS devices. This feature allows an administrator to remotely trigger the device to collect a comprehensive set of system and user logs and upload them to the Admin console for analysis. This is the most direct and efficient method that does not require user interaction.

This is the most comprehensive and automated solution. 1) GCDS handles the automatic provisioning of users and, crucially, security groups from AD into Google Workspace, eliminating manual work. 2) Configuring SAML with Okta handles the authentication requirement. 3) Assigning Chrome policies to the synchronized Google Groups (not OUs) allows for dynamic policy application based on the user's role in AD, which is the most flexible and scalable approach.

Chrome Browser Cloud Management can integrate directly with Google Workspace. This allows the powerful content-aware DLP rules already defined in Workspace (such as detecting credit card numbers) to be extended to the Chrome browser, providing seamless enforcement without requiring a separate third-party solution. Blocking URLs is too broad, and Safe Browsing does not perform content inspection for DLP purposes.

The CrostiniSudoAccessAllowed policy specifically controls whether users can use the sudo command to gain root privileges within the Linux (Crostini) container. Setting this policy to 'false' effectively prevents privilege escalation while still allowing the Linux environment to function for other purposes.