Google PROFESSIONAL-CHROMEOS-ADMINISTRATOR Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CHROMEOS-ADMINISTRATOR Online Questions & Answers

• Question 71:

  You are tasked with adding a security key to a single user account. Where should you navigate to?

  A. Security > Password Management
  B. Security > 2-step Verification
  C. Users > Select User > Security
  D. Users > Select User > Password
  B. Security > 2-step Verification

  ---

  Explanation

  To add a security key to a user account, navigate toSecurity > 2-step Verificationin the Google Admin console. Security keys are part of the two-factor authentication (2FA) setup, enhancing account protection by requiring physical key-based

  verification.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle Workspace Security Guide, which outlines how to add a security key via the 2-step verification settings.

  "To add a security key, go to Security settings, select 2-step Verification, and follow the prompts to register a physical security key."

  Security keys provide strong, phishing-resistant two-factor authentication, making them ideal for securing sensitive accounts.

  Objectives:

  Implement secure authentication methods for users.

  Manage 2-step verification settings.

  References:

  Google Workspace Security Guide

• Question 72:

  After enabling a managed guest session on an OU, an admin receives a request to skip the initial load screen at the beginning of the session for these devices. Which policy setting allows the admin to control this behavior?

  A. Auto-launch session
  B. Maximum user session length
  C. Guest mode
  D. Custom terms of service
  A. Auto-launch session

  ---

  Explanation

  TheAuto-launch sessionsetting allows the admin to configure managed guest sessions to start automatically without displaying the initial load screen. This setting is beneficial in kiosk environments or shared device setups where users do not

  need to see introductory information.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle ChromeOS Managed Guest Session Configuration Guide, which states that enabling auto-launch bypasses the initial screen.

  "Enable Auto-launch session for managed guest sessions to automatically start without displaying the initial screen."

  Auto-launch is particularly useful for devices used in public settings or for specific tasks, as it reduces startup time and enhances user experience.

  Objectives:

  Automate the start of managed guest sessions.

  Improve usability in kiosk and shared environments.

  References:

  Google ChromeOS Managed Guest Session Configuration Guide

• Question 73:

  You have been tasked with selecting a 3rd party IdP to allow logging into ChromeOS devices. Your ChromeOS devices are displaying an "Unable to sign in to Google" message. How should you troubleshoot this?

  A. Check Multi-Factor Authentication for the user account in the Google Admin console.
  B. Ensure the identity provider is using an SAML compliant connection.
  C. Apply the SSO certificate to the ChromeOS device.
  D. Disable the SSO connection in the Google Admin console.
  B. Ensure the identity provider is using an SAML compliant connection.

  ---

  Explanation

  The error message "Unable to sign in to Google" typically indicates an issue with the SAML configuration. ChromeOS devices require the identity provider (IdP) to be SAML-compliant to function properly. Checking the SAML connection

  ensures that the IdP is properly configured to authenticate users when they log in.

  Verified Answer from Official Source:

  The correct answer is verified based on theGoogle Workspace Identity and Access Management Guide, which specifies that ChromeOS requires a SAML-compliant IdP for successful authentication.

  "When setting up Single Sign-On (SSO) for ChromeOS devices, it is essential that the third-party IdP uses a SAML-compliant connection to ensure compatibility and prevent login errors."

  If the IdP is not SAML-compliant, users will encounter login issues because ChromeOS devices rely on this protocol for authentication. Verifying and correcting the SAML configuration resolves the issue.

  Objectives:

  Implement third-party IdP for ChromeOS authentication.

  Troubleshoot login issues related to SAML.

  References:

  Google Workspace Admin Help - SSO Setup for ChromeOS

• Question 74:

  After deploying your Android VPN client, you want to enforce always-on VPN. Where is this configured?

  A. Network settings - Always-on VPN
  B. User settings - Always-on VPN
  C. Device settings - Always-on VPN
  D. via JSON configuration with the deployed application
  D. via JSON configuration with the deployed application

  ---

  Explanation

  To enforcealways-on VPNon ChromeOS, you need to useJSON configurationwithin the deployed VPN application settings. This method allows you to configure the VPN client to stay connected at all times, which is crucial for maintaining

  secure connections, especially in enterprise environments.

  Verified Answer from Official Source:

  The correct answer is verified from theChromeOS VPN Configuration Guide, which specifies that JSON files are used to configure advanced VPN settings, including the always-on feature.

  "To enforce an always-on VPN, configure the JSON settings file within the VPN client deployment. This setting ensures that the VPN remains active whenever the device is online."

  Using JSON configuration provides granular control over VPN settings and ensures the VPN remains active, reducing security risks associated with open network connections.

  Objectives:

  Implement secure VPN configurations on ChromeOS. Enforce always-on VPN to protect data transmission.

  References:

  ChromeOS VPN Configuration Guide

• Question 75:

  How do you validate Chrome policies on a managed device?

  A. Go to the admin console and look up the policies
  B. Download device logs
  C. In the browser, go to chrome://policy to confirm that the device is receiving both user and device policy
  D. In the browser, go to policy://chrome to confirm that the device is receiving both user and device policy
  C. In the browser, go to chrome://policy to confirm that the device is receiving both user and device policy

  ---

  Explanation

  To check which policies are applied to a ChromeOS device, navigate tochrome://policyin the Chrome browser. This page displays a list of all policies applied to the device, including both user-specific and device-specific policies. This is the

  most accurate way to verify that the device is receiving the correct policies from the Google Admin console.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle Chrome Enterprise Policy Guide, which recommends using thechrome://policyURL to review current policy settings on a device.

  "To see the policies applied to a ChromeOS device, open Chrome and go to chrome://policy. This page lists both user and device policies that are currently enforced."

  This method allows administrators to validate the application of policies directly on the device, confirming that updates from the Admin console have been successfully applied.

  Objectives:

  Validate policy application on managed ChromeOS devices. Use chrome://policy to troubleshoot policy issues.

  References:

  Google Chrome Enterprise Policy Guide

• Question 76:

  Your customer is deploying ChromeOS devices in their environment and requires those ChromeOS devices to adhere to web filtering via TLS (or SSL) Inspection. What recommendations should you make to your customer in setting up the requirements for ChromeOS devices?

  A. Configure a hostname allowlist, set up a TLS (or SSL) certificate, then verify TLS (or SSL) inspection is working
  B. Reach out lo Google Workspace Security and Compliance for tailored configurations for your customer
  C. Configure a transparent proxy, set up your allowlist to use * google com. then verify TLS (or SSL) inspection is working
  D. ChromeOS devices are preconfigured to adhere to company TLS (or SSL) inspection by default and can therefore be deployed with no additional configuration
  A. Configure a hostname allowlist, set up a TLS (or SSL) certificate, then verify TLS (or SSL) inspection is working

  ---

  Explanation

  To set up TLS (or SSL) inspection for web filtering on ChromeOS devices, you need to follow these steps: Configure Hostname Allowlist: Create an allowlist of hostnames (e.g., *.google.com, *[invalid URL removed]) that should bypass TLS inspection. This ensures that essential services like Google services and your own domain can function properly. Set up TLS Certificate: Obtain the required TLS/SSL certificate from your web filter provider and install it on your web filter. ChromeOS devices need this certificate to establish a secure connection with the web filter for TLS inspection. Verify TLS Inspection: Once the configuration is in place, test and verify that TLS inspection is working as expected. This involves checking if the web filter can correctly intercept and decrypt HTTPS traffic for websites not on the allowlist. Why other options are not correct: Option B: While reaching out to Google Workspace Security and Compliance can be helpful, it's not the primary step in setting up TLS inspection. The configuration needs to be done on the web filter and ChromeOS devices. Option C: Transparent proxies are generally not recommended for ChromeOS devices as they can interfere with certain functionalities. While it might work with an allowlist for Google domains, it's not the best practice. Option D: ChromeOS devices do not come preconfigured to adhere to company TLS inspection. This configuration needs to be set up explicitly by the administrator.

  References: About TLS (or SSL) inspection on ChromeOS devices: https://support.google.com/chrome/a/answer/3504942 Verify TLS (or SSL) inspection works: https://support.google.com/chrome/a/answer/3504943

• Question 77:

  You have been asked to explain the built-in security features of ChromeOS. What is the benefit of having verified boot enabled on a ChromeOS device?

  A. It allows updates to happen in the background
  B. Running both operating systems on one device at the same time makes it twice as powerful
  C. It ensures that the OS is uncompromised
  D. It installs the known safe backup OS every time the device is started up
  C. It ensures that the OS is uncompromised

  ---

  Explanation

  Verified Bootis a core security feature of ChromeOS that ensures the operating system has not been tampered with. During startup, Verified Boot checks the integrity of the OS, and if it detects any unauthorized changes, it will attempt to

  repair the system by switching to a verified, stable version.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle ChromeOS Security Guide, which details the function of Verified Boot in maintaining OS integrity.

  "Verified Boot ensures that the firmware and OS on ChromeOS devices are intact and have not been modified or compromised."

  This feature is crucial for protecting against malware or unauthorized modifications, thereby maintaining a secure and stable operating environment.

  Objectives:

  Maintain OS integrity through verified boot processes. Protect ChromeOS devices from tampering and malware.

  References:

  Google ChromeOS Security Guide

• Question 78:

  To allow remote users to securely connect to an internal network, the organization you're supporting is using a VPN. The organization would like you to configure the ChromeOS devices so that the Android VPN clients deployed are automatically configured with the correct hostname. How should you configure this in the Admin Console according to Google best practice?

  A. Download the Android app on a ChromeOS device, add the hostname manually then re- upload the app in the organization's private Google Play Store and deploy it lo all ChromeOS devices
  B. Contact the VPN provider and ask them to provide you with a custom installable client with the correct configuration pre-configured Then deploy that installable
  C. Add a managed configuration using JSON to the Android app
  D. Upload a JSON file with the configuration into the Google Play Store
  C. Add a managed configuration using JSON to the Android app

  ---

  Explanation

  This is the most efficient and scalable way to automatically configure Android VPN clients on ChromeOS devices with the correct hostname: Obtain Configuration: Get the required VPN configuration details (hostname, authentication methods, etc.) from the VPN provider or your organization's network administrator. This configuration is typically in JSON format. Create Managed Configuration: In the Google Admin console, navigate to Devices > Chrome > Settings > Android Apps > Managed Configurations. Select the VPN App: Choose the specific Android VPN app you want to configure. Add JSON Configuration: Paste the JSON configuration into the provided field. Ensure the configuration is valid and accurate. Save and Deploy: Save the managed configuration and apply it to the desired organizational units (OUs) containing the ChromeOS devices. This method allows you to centrally manage VPN configurations for Android apps on ChromeOS devices, ensuring consistency and reducing the manual effort required from users.

• Question 79:

  At a specific location in your organization, users cannot log in to their ChromeOS devices. The ChromeOS Administrator has also noticed that devices have not synced in the past 24 hours. You have updated policies In the Admin console for your fleet of ChromeOS devices, but the devices are not getting the updated policies. What is a probable change in the environment that can cause these issues?

  A. A different location enrolled a large number of new devices
  B. Your network administrator has blocked all network traffic to Google services
  C. Your root Certificate Authority expired
  D. Your organization's licenses have recently expired
  B. Your network administrator has blocked all network traffic to Google services

  ---

  Explanation

  Blocking all network traffic to Google services would prevent ChromeOS devices from communicating with Google servers. This would lead to several issues: Login failures:ChromeOS devices require access to Google services for user authentication and login. Sync failures:ChromeOS relies on Google services to sync user data, settings, and policies. Policy updates not received:ChromeOS devices fetch policy updates from Google servers, so blocking access would prevent them from getting updates. Why other options are less likely:

  A. New devices enrolled:While enrolling new devices might cause some temporary network congestion, it wouldn't typically block all communication with Google services.

  C. Root CA expiration:This would affect secure connections to websites, but not necessarily prevent all communication with Google services.

  D. Expired licenses:Expired licenses would restrict access to some features but wouldn't prevent basic login and sync functionality.

• Question 80:

  You have found a possible security issue with an app that your users are using. The severity of this issue requires you to quickly see who is using this app. You have enabled the Chrome Reporting setting. What is the most efficient way to see what users are using the app?

  A. Under "Reports" -> "Token", download the entire results and place those results into a Google Sheet. Search for the app and note who is using it.
  B. Under "Security" -> "Access" and "Data Control" -> "API Controls", select "Manage third- party apps access". After the list of connected apps appears, you can now search for the app in question.
  C. Under "Devices" -> "Chrome" -> "Reports", use the "Apps and Extension" report to show all used apps in your domain. Click the app in question to get the list of devices that are using the app.
  D. Under "Devices" -> "Chrome" -> "Devices" you can manually check each device. Select the device in question, click "Remote Desktop" and audit the device.
  C. Under "Devices" -> "Chrome" -> "Reports", use the "Apps and Extension" report to show all used apps in your domain. Click the app in question to get the list of devices that are using the app.

  ---

  Explanation

  The most efficient way to find users who are using a specific app is to navigate toDevices > Chrome > Reportsand utilize the"Apps and Extension"report. This report lists all apps being used within the domain and allows you to filter the results

  to find the specific app and see associated devices.

  Verified Answer from Official Source:

  The correct answer is verified from theGoogle Admin Console Reporting Guide, which highlights using the Apps and Extensions report for tracking app usage.

  "To identify users of a specific app, go to Devices > Chrome > Reports and select 'Apps and Extensions' to generate a list of devices using the specified application."

  This method is the quickest and most organized way to gather usage data, especially when time-sensitive security issues arise.

  Objectives:

  Track app usage efficiently.

  Identify devices using potentially compromised apps.

  References:

  Google Admin Console Reporting Guide