Google PROFESSIONAL-CHROMEOS-ADMINISTRATOR Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CHROMEOS-ADMINISTRATOR Online Questions & Answers

• Question 101:

  You have been asked to explain the built-in security features of ChromeOS. What i3 the benefit of having verified boot enabled on a ChromeOS device?

  A. It ensures that the OS is uncompromised
  B. It allows updates to happen in the background
  C. Running both operating systems on one device at the same time makes It twice as powerful
  D. It installs the known safe backup OS every time the device is slatted up.
  A. It ensures that the OS is uncompromised

  ---

  Explanation

  Verified Boot in ChromeOS is a security mechanism that checks the integrity of the operating system during startup. If it detects any unauthorized modifications or compromises, it can initiaterecovery processes to restore the OS to a known

  good state, ensuring that the device boots up with a secure and untampered operating system. Option B is incorrectbecause background updates are a separate feature. Option C is incorrectbecause dual-boot is not related to Verified Boot.

  Option D is incorrectbecause Verified Boot doesn't install a backup OS but verifies the existing one.

  Verified Boot:https://www.chromium.org/chromium-os/chromiumos-design-docs/verified- boot/

• Question 102:

  At a specific location in your organization, users cannot log in to their ChromeOS devices. The ChromeOS Administrator has also noticed that devices have not synced in the past 24 hours. You have updated policies in the Admin console for your fleet of ChromeOS devices, but the devices are not getting the updated policies. What is a probable change in the environment that can cause these issues?

  A. Your network administrator has blocked all network traffic to Google services.
  B. Your root Certificate Authority expired.
  C. A different location enrolled a large number of new devices.
  D. Your organization's licenses have recently expired.
  A. Your network administrator has blocked all network traffic to Google services.

  ---

  Explanation

  If ChromeOS devices cannot log in and are not syncing with the Admin console, it is likely thatnetwork traffic to Google services has been blocked. ChromeOS devices require access to Google servers for authentication and policy

  synchronization.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle ChromeOS Troubleshooting Guide, which notes that blocking traffic to essential Google services can result in login and sync failures.

  "Ensure that the network configuration allows access to essential Google services. Blocking such services can prevent device login and policy synchronization."

  Blocking traffic to Google servers disrupts the device's ability to authenticate users and receive updates from the Admin console, leading to connectivity issues.

  Objectives:

  Troubleshoot network-related login issues.

  Ensure uninterrupted access to Google services for ChromeOS devices.

  References:

  Google ChromeOS Troubleshooting Guide

• Question 103:

  Which feature of the Google Admin console allows you to restrict devices from remembering user passwords?

  A. Password Manager
  B. Security Token Removal
  C. Enrollment Permissions
  D. WebAuthn
  A. Password Manager

  ---

  Explanation

  ThePassword Managerfeature in the Google Admin console allows administrators to manage whether users can save and auto-fill passwords on ChromeOS devices. Disabling Password Manager prevents Chrome from remembering

  passwords, thus enhancing security by requiring users to enter credentials manually.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle Admin Console Password Policy Guide, which outlines how to manage password saving and auto-fill settings.

  "Admins can disable the Chrome Password Manager through the Admin console to ensure that user passwords are not saved locally on the device."

  This setting is crucial in high-security environments where saving passwords locally might pose a risk. Disabling Password Manager helps maintain stricter security protocols.

  Objectives:

  Enforce secure password management on ChromeOS devices.

  Disable auto-fill and password saving.

  References:

  Google Admin Console Password Policy Guide

• Question 104:

  A customer has a mission-critical workload running on ChromeOS and needs devices configured to reduce ChromeOS changes. How can an admin reduce the risk of an unexpected change in an OS update affecting the customer's entire ChromeOS device domain while maintaining security and minimizing admin workload?

  A. Force auto reboot after update
  B. Enable variations
  C. Move to a Long-term Support channel
  D. Add an update rollout plan
  D. Add an update rollout plan

  ---

  Explanation

  Update rollout plans in the Google Admin console allow administrators to gradually roll out ChromeOS updates to a subset of devices first. This allows for testing in a controlled environment before deploying to the entire fleet, reducing the risk of unexpected issues impacting all devices. Steps to add an update rollout plan: Access Google Admin Console: Sign in with your administrator credentials. Navigate to Device Management: Go to Devices > Chrome > Settings > Updates. Create Rollout Plan: Click on "Add an update rollout plan." Select Devices: Choose the specific devices or organizational units (OUs) to include in the initial rollout. Set Timeline: Define the start and end dates for the rollout. Save and Apply: Save the plan and apply it to the selected devices.

• Question 105:

  Your customer is deploying ChromeOS devices in their environment and requires those ChromeOS devices to adhere to web filtering via TLS (or SSL) inspection. What recommendations should you make to your customer in setting up the requirements for ChromeOS devices?

  A. Configure a hostname allowlist, set up a TLS (or SSL) certificate, then verify TLS (or SSL) inspection is working
  B. ChromeOS devices are preconfigured to adhere to company TLS (or SSL) inspection by default
  C. Configure a transparent proxy, set up your allowlist to use 'google.com', then verify TLS (or SSL) inspection is working
  D. Reach out to Google Workspace Security and Compliance for tailored configurations
  A. Configure a hostname allowlist, set up a TLS (or SSL) certificate, then verify TLS (or SSL) inspection is working

  ---

  Explanation

  To enable web filtering with TLS (or SSL) inspection on ChromeOS devices, configure a hostname allowlistand set up aTLS (or SSL) certificate. Verifying that TLS inspection is working ensures that HTTPS traffic can be inspected without

  causing certificate errors.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle ChromeOS Security Configuration Guide , which advises configuring hostnames and certificates to enable secure web filtering.

  "To perform SSL inspection on ChromeOS devices, configure a hostname allowlist and install the necessary SSL certificates. Verify that the inspection is functioning correctly."

  Without proper configuration, SSL inspection can lead to certificate errors or blocked traffic. Setting up the allowlist and certificates correctly is crucial for maintaining secure and compliant web access.

  Objectives:

  Implement secure web filtering on ChromeOS.

  Configure TLS inspection to prevent certificate issues.

  References:

  Google ChromeOS Security Configuration Guide

• Question 106:

  Your organization's security protocols require you to ensure that any unattended devices log the user out after 24 hours. You have 1000 ChromeOS devices to manage. How would you Implement this with the least amount of admin effort?

  A. Enable the 'User and Browser Settings" and update 'Maximum user session length* to any time up to 24 hours
  B. Create a corporate policy stating (he users are to manually sign out after the end of every shift
  C. You can remotely access each device and sign out of the user account using Chrome Remote Desktop
  D. Force-install a custom app to each device in question that notifies the user that they need to sign out of their device after 24 hours
  A. Enable the 'User and Browser Settings" and update 'Maximum user session length* to any time up to 24 hours

  ---

  Explanation

  This is the most efficient method as it applies the setting to all devices within the organizational unit (OU) through a single policy change in the Admin console. The other options are less efficient: Corporate policy:Relies on user compliance

  and is difficult to enforce. Chrome Remote Desktop:Requires manual intervention for each device. Custom app:Adds complexity and potential security risks.

  References:

  Set up Chrome browser on managed devices: https://support.google.com/chrome/a/answer/3523633?hl=en

• Question 107:

  When setting up a Chrome Enterprise trial, what is a benefit of choosing to verify the domain?

  A. Identity management
  B. Application management
  C. Network management
  D. Device management
  A. Identity management

  ---

  Explanation

  When you verify your domain during a Chrome Enterprise trial setup, you establish ownership and control over the domain within Google's systems. This is a crucial step in identity management as it allows you to: Manage user accounts: Create, edit, and delete user accounts within the domain, ensuring control over who can access company resources. Apply security policies: Enforce security policies like password requirements, two- factor authentication, and access controls for users within the domain. Single Sign-On (SSO): Enable seamless and secure single sign-on for users across various Google services and other integrated applications. By verifying the domain, you essentially gain centralized control over user identities and their access to resources, which is a core aspect of identity management.

• Question 108:

  You have been tasked to deploy shared devices using Managed Guest Sessions. Your IT policy requires blocking access to "google.com" at the parent organization. How would you prevent users from accessing "google.com" for all Managed Guest Sessions at the parent organization?

  A. Add "google.com" to "allow insecure content on these sites"
  B. Add "google.com" to "disallowed URLs in content settings"
  C. Add "google.com" to "the blocked URL exceptions"
  D. Add "google.com" to "the list of blocked URLs"
  D. Add "google.com" to "the list of blocked URLs"

  ---

  Explanation

  To block access to a specific website across all managed guest sessions, you need to add the site to the"list of blocked URLs". This ensures that regardless of the session type, users cannot access the specified site.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle ChromeOS Managed Guest Session Guide, which explains that adding URLs to the blocked list restricts access across all sessions.

  "To enforce web filtering policies during Managed Guest Sessions, add the URL to the blocked list in the Admin console under User and Browser Settings."

  By configuring the blocked URL list, you enforce consistent access policies even when devices are used in guest mode.

  Objectives:

  Implement web filtering for Managed Guest Sessions. Enforce consistent security policies across sessions.

  References:

  Google ChromeOS Managed Guest Session Guide

• Question 109:

  Where in the security settings should an admin configure login integration with Okta in the Admin console?

  A. SSO with third-party IdPs
  B. Domain-wide authentication
  C. SSO with first-party as SAML IdP
  D. Multi-Factor Authentication
  A. SSO with third-party IdPs

  ---

  Explanation

  To integrate ChromeOS login withOkta, a third-party identity provider, you must configure the settings under"SSO with third-party IdPs"in the Google Admin console. Okta acts as a SAML-based identity provider, and this setting allows

  ChromeOS devices to authenticate users using Okta credentials.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle Workspace Identity and Access Management Guide, which outlines how to set up SSO with third-party IdPs like Okta.

  "To configure Single Sign-On (SSO) for ChromeOS devices using Okta, navigate to the Admin console > Security > Set up single sign-on (SSO) with third-party identity providers."

  This configuration allows seamless authentication using Okta, centralizing user login management. It also ensures that all ChromeOS devices within the organization use the same login credentials provided by Okta.

  Objectives:

  Implement SSO with third-party IdPs.

  Integrate ChromeOS with Okta.

  References:

  Google Workspace Identity and Access Management Guide

• Question 110:

  What are two methods for signing in to a Chrome OS device? Choose 2 answers

  A. SMS code sent to mobile phone
  B. Single sign-on
  C. Google Friend Connect
  D. Facebook Connect
  B. Single sign-on
  D. Facebook Connect

  ---

  Explanation

  Single sign-on (SSO):This allows users to sign in to their Chrome OS device using their organizational credentials. This is particularly useful in enterprise or educational settings where users already have an existing account. Facebook

  Connect:This allows users to sign in to their Chrome OS device using their Facebook credentials. This can be convenient for users who are already logged into Facebook on another device.

  Options A and C are incorrect:

  SMS code sent to mobile phone:This is not a standard sign-in method for Chrome OS devices.

  Google Friend Connect:This was a social networking service that has been discontinued.