Explanation: ✅ Option A (Correct)
Reasoning: GCDS deletes groups found in Google Workspace but not in the configured LDAP scope if a deletion policy is active. Setting the group deletion policy to “don’t delete Google groups not found in LDAP” ensures that manually managed Google Groups, which intentionally reside only in Google Workspace, are preserved during sync.

❌ Why the other choices are incorrect:

• Option B is incorrect: Using the Directory API post-sync is reactive, not preventative. The groups would likely already be deleted.
• Option C is incorrect: Matching base DNs is a general configuration step for ensuring proper scope, not a specific solution to prevent deletion of Google-only groups.
• Option D is incorrect: This setting pertains to user deletion policies, not group deletion, and is irrelevant to the problem scenario.

Explanation: ✅ Option C (Correct)
Reasoning: Creating a Shared Drive for the marketing team establishes a dedicated, secure space. Files placed here are automatically shared with the team members, simplifying collaboration and ensuring sharing is restricted only to the marketing department.

---

✅ Option E (Correct)
Reasoning: A target audience simplifies sharing by creating a pre-defined group (marketing team). Users can then easily select this audience when sharing Drive files, ensuring efficient and accurate sharing restricted to marketing members.

❌ Why the other choices are incorrect:

• Option A is incorrect: Sharing a shared drive organization-wide directly contradicts the requirement to not share with the entire company.
• Option B is incorrect: Restricting Drive sharing to "internal" typically means the entire organization, not specifically the marketing department, failing to meet the scope requirement.
• Option D is incorrect: While helpful for new documents, this option alone doesn’t provide a comprehensive solution for existing files or the overall "easy way to share items more appropriately" for team collaboration.

Explanation: ✅ Option B (Correct)
Reasoning: Creating a custom role allows for granular permissions, aligning with a broad, granular IT administration team and the principle of least privilege. This ensures the security team receives specific access to the Security Investigation Tool within the Security Center without unnecessary broader privileges.

❌ Why the other choices are incorrect:

• Option A is incorrect: The pre-built Security Admin role grants broader access to the entire Security Center and other security settings, which may exceed the least privilege needed for just the Investigation Tool.
• Option C is incorrect: Assigning the Super Admin role provides full control over the entire Google Workspace domain, violating the critical principle of least privilege and posing a significant security risk.
• Option D is incorrect: "Security settings privilege" is often distinct from specific tool access like the Security Investigation Tool, which is part of the broader Security Center functionality.

Explanation: ✅ Option A (Correct)
Reasoning: The "Data Protection" setting for iOS devices, specifically disabling "Allow users to copy data to personal apps," directly prevents content transfer from managed Google work apps to personal apps or unmanaged third-party apps, meeting the exfiltration requirement.

❌ Why the other choices are incorrect:

• Option B is incorrect: "Open Docs in Unmanaged Apps" controls file opening, not granular content copy/paste within apps.
• Option C is incorrect: Basic Mobile Management lacks the granular data exfiltration controls required for copy/paste prevention.
• Option D is incorrect: This setting also relates to opening files/items in unmanaged apps, not preventing content copy/paste from within a managed app.

Explanation: ✅ Option A (Correct)
Reasoning: Context-Aware Access is an advanced feature requiring specific Google Workspace editions like Enterprise Standard, Enterprise Plus, Education Standard/Plus, or Cloud Identity Premium. If a user lacks the necessary license, Context-Aware Access policies will not apply to them, potentially allowing unmanaged access.

---

✅ Option E (Correct)
Reasoning: Context-Aware Access relies on Endpoint Verification to collect device attributes (e.g., managed status, OS) from users’ desktops. If Endpoint Verification is not installed and functioning, the device cannot be properly evaluated against the policy, leading to incorrect access decisions.

❌ Why the other choices are incorrect:

• Option B is incorrect: Deleting and recreating a policy is a reactive, destructive troubleshooting step, not a preliminary check to diagnose the root cause of the current failure.
• Option C is incorrect: For desktops, Context-Aware Access primarily uses Endpoint Verification to gather device signals, not the "device policy application" (which is more relevant for mobile devices).
• Option D is incorrect: Google Workspace Business licenses do not include Context-Aware Access. Checking for a Business license won’t confirm policy applicability; higher-tier licenses like Enterprise (as in A) are required.

Explanation: ✅ Option D (Correct)
Reasoning: Delivering spoofed partner emails to inboxes with a custom warning allows users immediate access, reducing complaints. The warning maintains crucial security awareness for users, effectively balancing accessibility with environmental security.

❌ Why the other choices are incorrect:

• Option A is incorrect: Inbound Gateway routes mail, not a primary method to address spoofing protection for specific partner domains while preserving security warnings.
• Option B is incorrect: Delivering to spam still requires users to check folders, potentially causing delays and continued complaints, less effective than inbox delivery for reducing user friction.
• Option C is incorrect: An IP allow list bypasses various security checks, not just spoofing. This broadly lowers security and doesn’t provide a warning to users, which is important for awareness.

Explanation:

✅ Option A (Correct) Reasoning: During the user deletion process in the Google Admin console, the “Transfer” option for “data in other apps” (specifically Drive) allows an administrator to assign the deleted user’s entire My Drive content to another user. This action effectively transfers ownership of all files and folders to the specified manager, making the data visible only to them as the new owner.

 

❌ Why the other choices are incorrect:

• Option B is incorrect: Google Vault is for eDiscovery, compliance, and data retention purposes. It retains data but does not make the deleted user’s Drive documents directly accessible and usable by a specific manager within their active Google Drive interface.
• Option C is incorrect: Moving documents to a Shared Drive makes them accessible to all members of that Shared Drive, violating the requirement that the data should be visible only to the marketing manager. This method also requires additional manual steps or user interaction.
• Option D is incorrect: This option relies on the user’s availability and cooperation to perform the action, which is not an administrative solution. Furthermore, while the folder would be shared, the original ownership would remain with the user. If the user is deleted, shared items often become inaccessible.

 

Reference: https://support.google.com/a/answer/139241?hl=en#zippy=%2Ctransfer-ownership-of-files-and-folders

Explanation: ✅ Option A (Correct)
Reasoning: To review third-party apps authorized to access Google Workspace data, administrators navigate to "Security," then "API Controls," and specifically to "App Access Control." Within this section, "Manage Third Party App Access" provides the list and control mechanisms for these applications.

❌ Why the other choices are incorrect:

• Option B is incorrect: "Manage Google Services" controls which core Google services are available to users within the organization, not external third-party applications.
• Option C is incorrect: "Less Secure Apps" (LSA) refers to apps using less secure authentication. This is an outdated setting, primarily focused on individual user account access, not the comprehensive review of OAuth-authorized third-party Workspace applications.
• Option D is incorrect: "Settings" within "App Access Control" typically configures global policies and trust rules for apps, but does not directly present the list of currently authorized third-party apps for review.

Explanation: ✅ Option A (Correct)
Reasoning: Access Transparency Logs provide visibility into actions taken by Google staff when they access customer data. This includes interactions related to support cases, directly addressing the organization’s need for auditing Google support staff actions.

❌ Why the other choices are incorrect:

• Option B is incorrect: Login Audit Log tracks user sign-in activity within your organization, not actions by Google staff.
• Option C is incorrect: Rules Audit Log tracks changes to Google Workspace rules (e.g., routing, compliance), not Google staff access to data.
• Option D is incorrect: Admin Audit Log tracks actions performed by administrators within your organization, not by Google staff.

Explanation:

The correct answer is C. Enable Security Sandbox.

This feature is specifically engineered to handle the exact scenario described: sophisticated attacks that use embedded scripts or macros (like those in Microsoft Office or PDF files) to bypass traditional, signature-based antivirus scans.

Why Security Sandbox is the Solution

The Security Sandbox provides a “detonation” environment that offers a much higher level of protection than standard filtering.

Virtual Execution: Rather than just scanning the file’s code (static analysis), the Security Sandbox opens the attachment in a private, isolated virtual environment (dynamic analysis). It “executes” the macros just as a real user would to observe their behavior.

Behavioral Detection: If the macro attempts to perform malicious actions—such as modifying system files, downloading a second-stage payload from a suspicious server, or encrypting data—the Sandbox identifies it as a zero-day threat or unknown malware and blocks the email from reaching the user.

Macro-Specific Defense: Google specifically highlights that the Security Sandbox is the primary defense against malware propagated through embedded scripts (macros or .js files) that often evade “conventional” Gmail malware protection.

Explanation: ✅ Option A (Correct)
Reasoning: The Security Investigation Tool, with Drive Log Events, provides the precise granular control needed. Filtering by "Visibility Is External" directly identifies external shares, and "Actor Is user1@example.com" targets the specific user’s actions, fulfilling the audit requirements.

❌ Why the other choices are incorrect:

• Option B is incorrect: The Security API requires scripting/development and isn’t the primary GUI-based administrative method for a one-off audit. The Investigation Tool is more direct.
• Option C is incorrect: This describes a remediation action (changing access), not an audit method to determine which documents were inappropriately shared.
• Option D is incorrect: While the File Exposure Report lists external shares, the Investigation Tool offers a more granular and powerful way to query specific log events (like sharing actions) performed by a user, which is crucial for a detailed audit.

Explanation: ✅ Option C (Correct)
Reasoning: Adding the sender’s domain to an allow list (approved senders) in the Admin Console ensures that mail from these specific, known senders bypasses or is less rigorously subjected to spam filtering, directly addressing the problem of incorrect classification for trusted sources.

❌ Why the other choices are incorrect:

• Option A is incorrect: Modifying your internal domain’s SPF record is relevant for authenticating outgoing email from your domain, not for influencing how incoming emails from external senders are classified as spam by your system.
• Option B is incorrect: Making spam settings less aggressive is a broad measure that could potentially allow more legitimate spam into user inboxes, rather than specifically resolving the issue for known, trusted senders without compromising overall security.
• Option D is incorrect: Instructing a user to add senders to contacts is a user-level action, not an administrator-level solution to prevent systemic, repeated incorrect spam classification for all relevant users across the organization.

Explanation: ✅ Option B (Correct)
Reasoning: Context-Aware Access directly addresses the problem by allowing administrators to create policies that deny access to Google services based on granular conditions, including the user’s geographical location. This proactively prevents stolen credentials from being used outside authorized regions.

❌ Why the other choices are incorrect:

• Option A is incorrect: IP blocking is reactive and addresses specific known malicious IPs. It’s less effective for broad geo-restriction, as malicious actors can quickly change IPs, making it not a scalable defense-in-depth strategy for preventing any access from unauthorized countries.
• Option C is incorrect: Enforcing stronger passwords helps prevent credential theft, but once credentials are stolen, it doesn’t prevent their misuse from unauthorized locations. The problem statement explicitly states credentials have been stolen.
• Option D is incorrect: MDM geo-fencing is specific to managed mobile devices. The problem implies access to Google Workspace services generally, not limited to mobile devices, and Context-Aware Access provides broader application-level geo-restriction.

Explanation: ✅ Option C (Correct)
Reasoning: Configuration groups allow applying settings like data regions to a subset of users, irrespective of their OU structure. This ensures European data residency compliance without disrupting the existing business unit OUs. Other users’ data defaults to their closest Google data centers, optimizing performance for everyone.

❌ Why the other choices are incorrect:

• Option A is incorrect: Setting the top-level OU to "Europe" forces all user data to Europe. This degrades performance for non-European users (e.g., US), failing the "fastest end user experience" for the entire organization.
• Option B is incorrect: Modifying the existing OU structure by adding location-based OUs within a business-unit-based structure is complex and disruptive. Configuration groups provide a more flexible and less impactful solution.
• Option D is incorrect: While using groups, creating them for US and "dispersed" users with no specific regional preference (beyond Europe) adds unnecessary complexity. Google’s default data placement usually optimizes performance for users without an explicit data region.

Explanation: ✅ Option B (Correct)
Reasoning: Creating a secondary calendar under your account is the correct approach for a team-specific calendar. Granting "Make changes to events" access allows team members to add, edit, and delete their vacation entries, and crucially, enables all team members to view full event details, facilitating visualization of online status and multiple absences.

❌ Why the other choices are incorrect:

• Option A is incorrect: Calendar resources are designed for booking physical assets like rooms or equipment, not for tracking individual team member availability or vacation. "Auto-accept invitations" is irrelevant for users creating their own vacation events.
• Option C is incorrect: Similar to A, calendar resources are unsuitable for this purpose. "See only free/busy" access prevents team members from viewing event details (who is off, specific dates), making it impossible to visualize online status or identify multiple individuals on vacation.
• Option D is incorrect: While creating a secondary calendar is appropriate, "See only free/busy" access is insufficient. It prevents team members from adding their own time off (which requires "Make changes") and prohibits viewing event details necessary for visualizing team availability.

Explanation: ✅ Option B (Correct)
Reasoning: Visitor sharing allows secure file access for non-Google users via email verification and a PIN. It directly addresses sharing with external auditors lacking Workspace or consumer Google accounts, fulfilling the secure, controlled access requirement.

❌ Why the other choices are incorrect:

• Option A is incorrect: Trusted Domains (allowlist domains) facilitate sharing between Google Workspace organizations. It is not designed for sharing with individuals who do not possess any Google account.
• Option C is incorrect: Publishing a Sheet to the web makes content publicly viewable to anyone with the link, without any authentication. This method is not secure or restricted for specific external collaborators.
• Option D is incorrect: Attaching the file sends a static copy, losing Drive’s security, version control, and collaborative features. It is not a secure or efficient way to share a dynamic Google Sheet.

Explanation: ✅ Option C (Correct)
Reasoning: Implementing target audiences in Google Workspace allows administrators to define specific sharing boundaries and restrict the visibility of the "entire organization" sharing option. This prevents accidental oversharing by guiding users to appropriate, pre-defined internal audiences, especially for sensitive data.

❌ Why the other choices are incorrect:

• Option A is incorrect: While creating groups and educating users improves sharing, it doesn’t prevent the accidental selection of the "entire organization" option, which is the core problem.
• Option B is incorrect: Disabling all organization-wide sharing is overly restrictive and significantly hinders legitimate internal collaboration, making it impractical for most organizations.
• Option D is incorrect: Temporarily disabling Google Drive is a punitive measure, not a preventative or educational solution to help users share appropriately or prevent accidental oversharing.

Explanation: ✅ Option C (Correct)
Reasoning: Transferring ownership of Drive objects to another user moves the storage quota consumption from the original user to the new owner. This alleviates the original user’s quota debt without deleting any data.

---

✅ Option E (Correct)
Reasoning: Moving items to a Shared Drive transfers their ownership from individual users to the Shared Drive itself, which is owned by the organization. This frees up the individual user’s quota without data deletion.

❌ Why the other choices are incorrect:

• Option A is incorrect: Adding editors does not transfer storage quota debt. Quota is consumed only by the file’s owner.
• Option B is incorrect: This action involves deleting files from Drive, which explicitly contradicts the "without deleting data" requirement.
• Option D is incorrect: This action also involves deleting data, violating the specified constraint of the question.

Explanation: ✅ Option C (Correct)
Reasoning: Organizational Units (OUs) allow administrators to apply granular service settings to specific user groups. By moving the majority of users to an OU with all Workspace services disabled, their access is blocked without affecting the IT team or testers in another OU. This precisely meets the requirement for staged access.

❌ Why the other choices are incorrect:

• Option A is incorrect: Removing licenses would block access for all users, including the IT team and testers who need active access for configuration and testing.
• Option B is incorrect: Suspending users is more drastic than simply disabling service access. It affects the entire user account and might interfere with IdP synchronization, whereas OU service control is more targeted.
• Option D is incorrect: Context-Aware Access controls conditional access based on context (e.g., device, location). It’s not designed to disable or enable services at a group level; OU service settings are the appropriate administrative tool for this scenario.

Explanation: ✅ Option C (Correct)
Reasoning: Organizing users into OUs by company allows for precise control. Google Workspace custom directories enable defining visibility rules based on OUs, ensuring each company’s employees are visible only within their specific directory and hidden from the global directory.

❌ Why the other choices are incorrect:

• Option A is incorrect: Creating a new, isolated domain contradicts the requirement to add employees to the existing Google Workspace domain.
• Option B is incorrect: Disabling contact sharing entirely removes all directory visibility, preventing employees from being visible even within their own company’s directory.
• Option D is incorrect: While dynamic groups can manage visibility, OUs provide a more fundamental and robust hierarchical structure for applying broad management policies, including granular directory visibility settings, making C a more complete solution.

Explanation: ✅ Option C (Correct)
Reasoning: If the Password Sync service is not running on a domain controller, it cannot detect or transmit password changes from Active Directory to Google Workspace. Verifying the service status is the most fundamental and crucial first troubleshooting step when sync failures occur.

❌ Why the other choices are incorrect:

• Option A is incorrect: Reinstallation is a drastic measure, typically reserved for widespread, persistent issues or corruption, not a first step for a single user’s sync problem.
• Option B is incorrect: Reauthorizing the tool addresses token expiry or revoked access, which usually impacts all users. It’s less likely the initial cause for a single user’s missed sync before checking service status.
• Option D is incorrect: Resetting the password might force a new sync if the service is already running, but it doesn’t troubleshoot why the original change failed to sync. It bypasses the diagnostic process.

Explanation: ✅ Option D (Correct)
Reasoning: Google Vault is Google’s eDiscovery and information governance solution. It is specifically designed to apply legal holds, perform comprehensive searches across Google Workspace data (including Gmail and Drive), and export data in defensible formats, which is essential for fulfilling legal investigation requests.

❌ Why the other choices are incorrect:

• Option A is incorrect: The Security Investigation Tool primarily focuses on security events and logs, not comprehensive content retrieval for legal export. Email Log Search provides delivery logs, not the actual email content required for a legal investigation.
• Option B is incorrect: Manually searching Drive is incomplete and asking the user to forward emails is unreliable, non-compliant, and entirely unprofessional for a legal request, risking data omission or manipulation.
• Option C is incorrect: While technically possible, using APIs for data collection is a complex, custom development solution. It lacks the built-in legal hold, auditing, and defensibility features inherent in a dedicated eDiscovery tool like Google Vault.

Explanation: ✅ Option D (Correct)
Reasoning: Configuring an inbound gateway with your on-premises Exchange server IP addresses tells Google Workspace to trust mail originating from those servers, preventing legitimate internal emails from being flagged as spam or spoofing attempts by Google’s filters during a hybrid migration.

❌ Why the other choices are incorrect:

• Option A is incorrect: Training users is reactive and does not address the underlying configuration issue causing legitimate mail to be marked as spam.
• Option B is incorrect: There isn’t a direct "approved sender list" for entire domains; inbound gateway configuration is the correct method for trusting internal sources. It also doesn’t block external spoofing.
• Option C is incorrect: Forcing TLS encrypts mail in transit but does not address the issue of internal mail being marked as spam based on its origin or block spoofing attempts based on sender identity.

Explanation: ✅ Option C (Correct)
Reasoning: Removing client IDs and scopes from domain-wide delegation immediately revokes API access for applications, including many add-ons, that exploit this high-privilege method to access Workspace data without individual user consent. This directly addresses cutting off add-on access immediately and implicitly blocks future unauthorized domain-wide delegated apps while preserving user sign-in (SSO) for third-party sites.

❌ Why the other choices are incorrect:

• Option A is incorrect: Modifying Marketplace settings only prevents new user installations from the Marketplace. It does not revoke access for already installed add-ons or prevent non-Marketplace/domain-wide delegated apps from accessing data.
• Option B is incorrect: Setting all API services to "restricted access" is an overly broad action. It would severely disrupt many legitimate Workspace functions and approved third-party sign-ins (SSO), which the scenario explicitly approves.
• Option D is incorrect: Blocking each connected app’s access individually is a manual, time-consuming process. It does not provide the immediate, global cut-off of all add-ons access required by the scenario.

Explanation: ✅ Option A (Correct)
Reasoning: Context-Aware Access (CAA) allows administrators to define access levels based on IP ranges and apply them to specific apps like Google Drive. When the satellite office’s IP address changed, their access no longer matched the defined CAA policy, causing the "company policy" error for Drive, while other services remained unaffected.

❌ Why the other choices are incorrect:

• Option B is incorrect: "Whitelisted domains" in Drive and Docs sharing settings manage external sharing permissions, not internal user access to the Drive application itself. This would not cause a block for users trying to access Drive.
• Option C is incorrect: The Network Mask for SSO with 3rd Party IdPs is related to authentication origin. Since users can access Gmail and Calendar, the SSO configuration is likely functioning, and this setting wouldn’t selectively block Drive.
• Option D is incorrect: Registering IP ranges for Drive API access pertains to programmatic API usage by applications, not direct end-user access to Google Drive through web browsers or client applications.

Explanation: ✅ Option C (Correct)
Reasoning: The Security Investigation Tool in the Google Admin console allows administrators to search for specific email messages and view their full original headers. These headers include critical authentication details like SPF, DKIM, and DMARC results, which are essential for diagnosing delivery issues caused by misconfigured external sender records.

❌ Why the other choices are incorrect:

• Option A is incorrect: Postmaster Tools provides aggregated data on sender reputation and delivery rates to Gmail, not individual message headers for incoming emails to an organization.
• Option B is incorrect: While the Email Log Search tracks messages, it typically does not expose the full, raw message headers needed for deep authentication troubleshooting directly within its interface.
• Option D is incorrect: Performing an SPF record check confirms the record’s validity. However, it does not provide the specific message headers or Google Workspace’s authentication results for a particular failing email.

Explanation: ✅ Option A (Correct)
Reasoning: Creating a secondary domain allows distinct user accounts (e.g., andrea@mystartup.com and andrea@mycompany.com) within the same Google Workspace instance. This preserves original email addresses for the new employees and permits applying existing security policies without duplication by assigning users to appropriate Organizational Units (OUs).

❌ Why the other choices are incorrect:

• Option B is incorrect: An alias domain maps to existing users; it doesn’t allow creating separate accounts for identical usernames across different domains, violating the "different people" requirement. Users cannot have an alias domain as their primary email.
• Option C is incorrect: Creating a new Google Workspace instance complicates policy application and sharing; Google Workspace lacks native cross-domain trust for policy synchronization. This violates the "without duplication" requirement.
• Option D is incorrect: Creating users in mycompany.com or adding numbers violates preserving original startup email addresses. Gmail routing is a complex workaround, not a primary identity solution.

Explanation: ✅ Option C (Correct)
Reasoning: Even with correct user permissions, Work Insights requires its underlying API to be explicitly allowed in API controls. If the Work Insights API is restricted, the application cannot properly function or connect to its services, leading to an "error when accessing the application."

❌ Why the other choices are incorrect:

• Option A is incorrect: The HR group already has the necessary permission. Granting it to all employees is unnecessary and unrelated to the HR group’s access error.
• Option B is incorrect: While Work Insights needs to be turned ON, an API restriction is a distinct and common cause for access errors, even if the service itself is generally enabled.
• Option D is incorrect: BigQuery Export for reports is for data export, not for direct user access to the Work Insights application itself. This is irrelevant to the reported error.

Explanation: ✅ Option D (Correct)
Reasoning: Creating a group and applying a specific sharing policy to it allows granular control. This method permits the identified subset of finance and HR users to share externally while maintaining the strict "no external sharing" policy for the rest of the finance OU, ensuring security and compliance.

❌ Why the other choices are incorrect:

• Option A is incorrect: Downloading and attaching documents bypasses all Google Drive security and sharing policies, lacks version control, audit trails, and revocation capabilities, making it insecure and unmanageable.
• Option B is incorrect: Moving all finance users to the HR OU broadly changes permissions for the entire finance team, not just a subset, violating the security requirement of restricting external sharing for the majority.
• Option C is incorrect: Enabling Visitor Sharing for the entire finance OU directly violates the explicit requirement that external content sharing is prohibited for the entire finance team, compromising security.

Explanation: ✅ Option B (Correct)
Reasoning: Creating a hold in Google Vault is crucial. It overrides retention policies, preventing the user’s mail from being permanently deleted after 180 days, thus preserving all relevant data for the investigation without the user’s awareness.

---

✅ Option E (Correct)
Reasoning: A matter in Google Vault is an investigative workspace. Creating one and sharing it grants the litigation team secure, auditable access to search and review the user’s mail data within the scope of the matter, without compromising the user’s account or alerting them.

❌ Why the other choices are incorrect:

• Option A is incorrect: Moving a user to a new OU and setting a custom retention policy applies to future data, doesn’t immediately preserve existing data from the 180-day policy, and doesn’t provide direct investigative access.
• Option C is incorrect: Resetting the user’s password and sharing it would immediately alert the user, violating the "without the user’s awareness" requirement and is not the proper e-discovery method.
• Option D is incorrect: Copying user data might be incomplete, could leave traces, and doesn’t guarantee the original mailbox is preserved from the retention policy; Vault provides a more robust and legally defensible solution.

Explanation:

The correct answer is C. Configure the security sandbox feature on the sales team organizational unit.

This feature is specifically designed to detect sophisticated, previously unknown malware (zero-day attacks) in attachments by executing them in a safe, isolated environment before they reach the user’s inbox.

 

 

Why the Security Sandbox is the Best Solution

The Security Sandbox provides the strongest protection without the “blunt instrument” approach of blocking or stripping all files.

Virtual Execution: It opens attachments in a “sandbox” (a virtual machine) to see how they behave. If a file tries to encrypt data or contact a malicious server, it is flagged as malware.

 

 

Minimal Disruption: Unlike a quarantine, which requires an admin to manually check every file, the sandbox works automatically. It may delay email delivery by a minute or two for deep scanning, but it doesn’t stop the flow of legitimate business documents.

 

 

Targeted Application: You can enable this specifically for the Sales OU, ensuring that the team most at risk gets the extra protection while other departments continue with standard filtering.

Explanation: ✅ Option D (Correct)
Reasoning: Creating a configuration group (or security group) with specific users and applying a Drive sharing setting to that group is the precise method to grant an exception for external sharing, overriding the default organizational restriction for only those members.

❌ Why the other choices are incorrect:

• Option A is incorrect: A target audience primarily controls visibility of internal resources (e.g., Sites, Drive items) and is not used to enable or disable external sharing policies for users.
• Option B is incorrect: Enabling external sharing for entire organizational units would allow all members of those OUs to share externally, which contradicts the requirement for specific approved members.
• Option C is incorrect: Allowlisting domains restricts where sharing can occur, but doesn’t enable sharing for specific users when the default organizational policy prohibits it. It’s a secondary control.

Explanation: ✅ Option A (Correct)
Reasoning: The serial number is the unique and mandatory identifier required when uploading devices via CSV to the company-owned inventory in Google Workspace, serving as the primary key for device identification.

❌ Why the other choices are incorrect:

• Option B is incorrect: While serial number is needed, specifying ‘Device OS’ is not a required field for the initial device upload via CSV.
• Option C is incorrect: The asset tag is an optional field; the serial number is the mandatory identifier for adding devices via CSV upload.
• Option D is incorrect: Neither Device OS nor asset tag are the essential unique identifiers for bulk adding devices; the serial number is required.

Explanation: ✅ Option A (Correct)
Reasoning: Exporting a HAR file from Chrome’s Developer Tools captures all network requests, responses, and timing information. This crucial data allows Google support to analyze the client-server interaction, identifying the specific request that received the 500 server error and its context. This is the standard method for troubleshooting web application errors.

❌ Why the other choices are incorrect:

• Option B is incorrect: Admin reports provide domain-wide usage statistics and security insights, not specific client-side network logs for a single user’s browser error.
• Option C is incorrect: chrome://net-export creates NetLog files, which are detailed internal Chrome network event logs. While comprehensive, a HAR file is typically more targeted and easier to analyze for web application HTTP 500 errors.
• Option D is incorrect: Chrome’s Task Manager lists running processes and resource consumption. It provides no network activity or error details relevant to a 500 server error.

Explanation: ✅ Option D (Correct)
Reasoning: The ‘Trusted Domains’ feature (external sharing allowlist) in Google Workspace specifically allows administrators to define a list of approved external domains for sharing, blocking all others. This directly fulfills the CISO’s mandate to prohibit general external sharing while enabling sharing exclusively with the acquired companies.

❌ Why the other choices are incorrect:

• Option A is incorrect: Restricting sharing to the IT group only is too narrow, failing to enable necessary collaboration with the acquired companies across the organization.
• Option B is incorrect: While DLP can prevent data exfiltration, the ‘Trusted Domains’ setting is the direct and intended control for explicitly allowing external sharing with specific domains.
• Option C is incorrect: Sharing individual files externally from shared drives does not enforce domain-specific restrictions, still allowing sharing with any external entity beyond the acquired companies.

Explanation: ✅ Option C (Correct)
Reasoning: Placing data on ‘hold’ in Google Vault, within a ‘matter,’ is the critical first step. This prevents permanent deletion of all relevant user data, including items the user has already deleted, ensuring evidence is preserved for the investigation.

❌ Why the other choices are incorrect:

• Option A is incorrect: Deleting the user’s account would permanently erase potential evidence, severely hindering or outright preventing the investigation.
• Option B is incorrect: Transferring data is for transitioning user files to another active user, not for preserving all potentially deleted evidence for an investigation.
• Option D is incorrect: Exporting data is an analysis step after data has been secured. The first step must be preservation via a legal hold to ensure all relevant, including deleted, data is captured before export.

Explanation: ✅ Option D (Correct)
Reasoning: Deploying an additional GCDS instance on a separate server directly addresses the requirement to "deploy a second instance" and apply the "same strategy" (one GCDS per LDAP source) for the newly acquired organization’s synchronization.

---

✅ Option C (Correct)
Reasoning: When multiple GCDS instances sync to the same Google Workspace, configuring proper exclusion rules is critical. This prevents one GCDS instance from inadvertently suspending or deleting users managed by another instance, ensuring a stable and successful integration.

❌ Why the other choices are incorrect:

• Option A is incorrect: Providing current GCDS with credentials for another LDAP contradicts the goal of deploying a second instance and complicates managing two distinct organizations from a single GCDS.
• Option B is incorrect: Adding sync rules to the current GCDS instance goes against deploying a second instance and can lead to complex, error-prone configurations for separate user bases.
• Option E is incorrect: There is no specific "multiple LDAP version" of GCDS. While GCDS can manage multiple LDAP configurations, this option is imprecise and doesn’t align with the requirement to deploy a second dedicated instance.

Explanation: ✅ Option B (Correct)
Reasoning: Creating a Google Vault matter is the standard initial step for eDiscovery. Vault allows searching across multiple users within a single matter and exporting the data, including Gmail, in an MBOX format, which fulfills the legal department’s request. The IT team performs the export since legal lacks Vault admin rights.

❌ Why the other choices are incorrect:

• Option A is incorrect: Creating individual Vault matters for each user is inefficient for a query spanning multiple users. Sharing matters with legal admins doesn’t grant them the ability to perform an MBOX export if they lack Vault administrator privileges.
• Option C is incorrect: The Investigation Tool is primarily for security incident response, email tracing, and auditing logs, not for comprehensive eDiscovery exports of user mailbox data into MBOX files for legal purposes.
• Option D is incorrect: Searching within the Gmail interface is for individual users. There is no administrative function within Gmail itself to perform a multi-user MBOX export for eDiscovery. This functionality resides in Google Vault.

Explanation: ✅ Option A (Correct)
Reasoning: Creating a dedicated Organizational Unit (OU) for the consultant allows you to apply specific, restrictive contact sharing policies only to them. This ensures their contact visibility is isolated from default company-wide settings, fulfilling the request for restricted access.

---

✅ Option B (Correct)
Reasoning: To allow the consultant to view only marketing team contacts, a Google Group must be created containing these specific individuals. This group then serves as the defined list of contacts that will be made visible through the custom contact sharing settings applied to the consultant’s OU.

❌ Why the other choices are incorrect:

• Option C is incorrect: Applying an ‘owner’ role to a group gives management permissions within that group, not control over which contacts a user can generally view across the domain.
• Option D is incorrect: Placing the consultant directly in the marketing OU without further custom policies might grant broader access than intended or inherit default settings, failing to restrict contact visibility as requested. An isolated OU is better for restriction.
• Option E is incorrect: Administrator privilege is a prerequisite, not a step to perform the task. The "Contacts Settings Message" is a cosmetic message and does not control contact visibility.

Explanation: ✅ Option D (Correct)
Reasoning: Google Cloud Directory Sync (GCDS) includes a "deletion threshold" setting. Configuring a limit for the maximum number of deletions proactively halts a synchronization if the detected deletions exceed this threshold, preventing unintended widespread removals in your Workspace environment.

❌ Why the other choices are incorrect:

• Option A is incorrect: A simulated sync (dry run) shows what would happen, but doesn’t proactively prevent a subsequent live sync from applying deletions. It’s a preview, not a safeguard that stops the actual deletion process.
• Option B is incorrect: GCDS doesn’t offer a general configuration to specify a minimum or maximum number of objects to synchronize as a mechanism to prevent mass deletions. This isn’t a relevant feature for this purpose.
• Option C is incorrect: Where GCDS is run from (config manager vs. command line) does not provide a safeguard against mass deletions. This option doesn’t prevent deletions if the LDAP source has changed significantly.

Explanation: ✅ Option B (Correct)
Reasoning: The Domain Shared Contacts API is designed to centrally add contact information for external or non-Workspace users into your domain’s global directory, making it visible to all current users. This solution avoids provisioning full accounts (no extra cost), enables rich contact search, and can be implemented before the actual user migration.

❌ Why the other choices are incorrect:

• Option A is incorrect: Bulk-uploading contact info via CSV directly "into the Google Directory" is generally for managing attributes of existing Workspace users or requires specific shared contact CSV uploads, which B covers more precisely. It doesn’t clearly address non-Workspace users globally.
• Option C is incorrect: Provisioning and licensing Google Workspace accounts for the acquired company’s users immediately incurs significant additional expenditure, violating the "without additional expenditure" constraint.
• Option D is incorrect: Distributing a file for end-users to add contacts to their personal lists is inefficient, relies on individual action, and does not provide a centralized, globally accessible directory for all users.

Explanation: ✅ Option D (Correct)
Reasoning: Creating a custom role with granular permissions for Google Vault matters, holds, searches, and exports directly enables an administrator to effectively monitor and manage security investigations, fulfilling the specific requirement.

❌ Why the other choices are incorrect:

• Option A is incorrect: Assigning ‘Services Admin’ to a Super Admin is redundant and does not grant the specific, granular investigation monitoring capabilities required within Vault.
• Option B is incorrect: "All the Google Vault privileges" is vague; the requirement is for specific, granular control over investigation components (matters, holds, searches, exports).
• Option C is incorrect: Validating existing access is a prerequisite check, not the proactive step needed to create or assign a role with the specific permissions to increase visibility.

Explanation: ✅ Option D (Correct)
Reasoning: Listing the product’s IP addresses as an Inbound Gateway tells Gmail to expect all incoming mail from these servers. This prevents Gmail from flagging the gateway’s high volume as a spam attack and allows it to properly extract and evaluate the original sender’s IP from message headers for accurate spam filtering.

❌ Why the other choices are incorrect:

• Option A is incorrect: "Approved sender" or IP allowlisting might bypass some spam checks for specific senders but doesn’t properly handle an intermediary mail server’s volume or original sender identification as effectively as an Inbound Gateway.
• Option B is incorrect: Similar to A, simply allowlisting IPs doesn’t configure Gmail to understand that this is an intermediary gateway through which all your domain’s mail flows, missing the comprehensive handling of an Inbound Gateway.
• Option C is incorrect: Adding IPs to your organization’s SPF record is for outbound mail authentication, informing other mail servers that these IPs are authorized to send mail on behalf of your domain. It is not for configuring how Gmail receives inbound mail from an intermediary filter.

Explanation: ✅ Option C (Correct)
Reasoning: Contributors can add and edit files within the shared drive. Critically, this role prevents users from removing or deleting files, directly addressing the requirement "cannot remove or delete files." While they cannot move existing files from My Drive, they can add new ones, satisfying primary needs without deletion capability.

❌ Why the other choices are incorrect:

• Option A is incorrect: Content Managers can add, edit, and move files, but they also have the ability to delete files, which violates the strict requirement that users "cannot remove or delete files."
• Option B is incorrect: "Editor" is not a standard role within Google Shared Drives. Shared drive roles are Viewer, Commenter, Contributor, Content manager, and Manager.
• Option D is incorrect: Managers have the highest level of access in a shared drive, including the ability to delete files and manage members and settings, directly contradicting the requirement to prevent file deletion.

Explanation: ✅ Option B (Correct)
Reasoning: When Secure Transport (TLS) Compliance is configured to "Require TLS" and an incoming message fails to meet this requirement, Google Workspace rejects the message. It will not be delivered to the end user’s inbox, spam, or any other folder.

❌ Why the other choices are incorrect:

• Option A is incorrect: TLS compliance failure results in message rejection, not delivery to spam. Spam filtering is a different security layer.
• Option C is incorrect: The sending server receives the failure notification. The intended recipient never receives the message, nor are they notified about a message that was never accepted by their mail system.
• Option D is incorrect: A warning banner appears on delivered messages. Since the message is rejected due to TLS compliance, it is never delivered, precluding any banner.