I85PREP
⌘ K
ChromeOS Administrator study materials
ChromeOS Administrator study resources

ChromeOS Administrator practice questions

One question at a time. Build your ChromeOS Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ChromeOS fundamentals and device provisioning

A school wants every newly enrolled student Chromebook to receive the same Wi-Fi network, homepage, and screen-lock settings automatically at first sign-in. Which mechanism is designed for this enrollment-time configuration?

  1. An admin console user policy applied to the student's Google Workspace account
  2. A forced re-enrollment setting combined with a device reset
  3. A device-level OU policy applied before the device is enrolled Correct answer.
  4. A Chrome Enterprise Connector profile pushed from the local network

Explanation

Device policies applied through the organizational unit tree are evaluated when the device enrolls, so settings such as networks and startup behavior land before the user ever signs in. User policies follow the signed-in account and therefore cannot guarantee configuration at first boot.

Question 2ChromeOS fundamentals and device provisioning

What is the primary purpose of Zero-Touch Enrollment in a ChromeOS fleet?

  1. Encrypting the local user profile with a hardware-bound key
  2. Allowing users to enroll personally owned devices without an administrator
  3. Pre-provisioning devices with an enrollment token so they enroll automatically when first powered on and connected Correct answer.
  4. Converting managed devices into unmanaged devices on demand

Explanation

Zero-Touch Enrollment uses a pre-registered device identifier and enrollment token so the device enrolls itself into the correct organizational unit on first boot without manual keystrokes. This reduces handling time and human error during large deployments.

Question 3ChromeOS fundamentals and device provisioning

An administrator deprovisions a device using the "Deprovision and disable" option. What is the resulting state of that device?

  1. It returns to unenrolled state but can be enrolled again by any user
  2. It remains enrolled but loses all policies until it is powerwashed
  3. It is removed from management and blocked from re-enrolling until the administrator restores it Correct answer.
  4. It is wiped and automatically re-enrolled into the root organizational unit

Explanation

The disable variant both removes management and places the device on a blocklist so it cannot re-enroll until an administrator reverses the action. This protects against a stolen or retired device being brought back into the fleet.

Question 4ChromeOS fundamentals and device provisioning

Which statement correctly describes how ChromeOS device policies and user policies interact when both are configured?

  1. Device policies and user policies are merged, with device-level restrictions generally taking precedence when they conflict Correct answer.
  2. Device policies are ignored after the first sign-in
  3. Only user policies apply once a user signs in
  4. User policies always override device policies for the same setting

Explanation

ChromeOS applies both device and user policy scopes, and where the same capability is restricted at the device level that restriction generally prevails. Understanding this precedence prevents administrators from assuming a user OU setting will loosen a device-level lock.

Question 5ChromeOS fundamentals and device provisioning

A fleet administrator wants to confirm which ChromeOS devices are currently enrolled and see their last-reported activity. Where is this information found?

  1. The ChromeOS Devices page in the Admin console Correct answer.
  2. The Google Workspace user profile page
  3. The Google Cloud IAM policy console
  4. The Chrome Web Store developer dashboard

Explanation

The Admin console lists enrolled ChromeOS devices with details such as serial number, organizational unit, and last sync time. This inventory is the starting point for fleet audits and troubleshooting.

Question 6ChromeOS fundamentals and device provisioning

Which enrollment method requires the device to be physically connected to a network and manually signed in with a Google Workspace account during setup?

  1. Forced re-enrollment after a powerwash
  2. Zero-Touch Enrollment
  3. Manual enrollment during out-of-box setup Correct answer.
  4. Auto-enrollment via a pre-provisioned token

Explanation

Manual enrollment happens when a person completes the out-of-box experience and signs in with an authorized account, which registers the device to the domain. It is the fallback method when pre-provisioning is not available.

Question 7ChromeOS fundamentals and device provisioning

An administrator needs to move a subset of enrolled Chromebooks into a stricter organizational unit without re-enrolling them. What is the correct action?

  1. Change the user OU and let the device inherit it automatically
  2. Delete the devices and re-add them with a new enrollment token
  3. Select the devices in the Admin console and change their organizational unit Correct answer.
  4. Powerwash each device and re-enroll it into the new OU

Explanation

Device organizational unit membership is an attribute managed from the Admin console, and moving a device causes the policies of the destination OU to apply on the next policy refresh. No re-enrollment or data wipe is required.

Question 8ChromeOS fundamentals and device provisioning

What does a ChromeOS device's enrollment token accomplish during pre-provisioning?

  1. It signs the device's firmware updates
  2. It defines the screen-lock timeout for end users
  3. It encrypts the device's local storage
  4. It authorizes the device to join a specific customer domain and organizational unit Correct answer.

Explanation

The enrollment token ties a pre-registered device to the correct customer and places it in the intended organizational unit at enrollment. It is a provisioning credential, not a security or policy setting.

Question 9ChromeOS fundamentals and device provisioning

A device shows as "Deprovisioned" in the Admin console. What does this status indicate about the device's relationship to the domain?

  1. It is enrolled in a different domain and pending transfer
  2. It has been removed from management and no longer receives domain policies Correct answer.
  3. It is still managed but temporarily offline
  4. It is enrolled but awaiting a policy refresh

Explanation

Deprovisioning removes the enrollment record so the device stops receiving organizational policies and no longer appears as a managed asset. The device typically returns to an unenrolled state unless it was also disabled.

Question 10ChromeOS fundamentals and device provisioning

Which ChromeOS feature allows an administrator to define a set of policies once and reuse them across many organizational units?

  1. Policy inheritance from parent organizational units Correct answer.
  2. Chrome Enterprise Connector profiles
  3. User-installed extension policies
  4. Per-device local policy files

Explanation

Organizational units form a hierarchy, and child units inherit settings from their parents unless explicitly overridden. This lets administrators define common baselines once and specialize only where needed.

Question 11ChromeOS fundamentals and device provisioning

An administrator wants new Chromebooks to skip the manual network selection screen during setup and instead use a preconfigured network. Which configuration supports this?

  1. Enabling developer mode on each device
  2. Setting a device policy for network configuration applied at enrollment Correct answer.
  3. Requiring users to enroll with a personal Google account
  4. Disabling verified boot in the Admin console

Explanation

Device-level network policies can supply preconfigured Wi-Fi settings so the out-of-box flow can connect automatically. This is a common component of a zero-touch deployment.

Question 12ChromeOS fundamentals and device provisioning

Which action is required before a device can be pre-provisioned through Zero-Touch Enrollment with a hardware partner?

  1. The device must be powerwashed at least once
  2. The device must be placed in developer mode
  3. The device must be signed in with an administrator account on first boot
  4. The device serial number and enrollment token must be registered to the customer's domain Correct answer.

Explanation

Pre-provisioning depends on the device identifier being associated with the customer and an enrollment token before shipping. Without that registration the device cannot auto-enroll to the intended domain.

Question 13ChromeOS fundamentals and device provisioning

What happens to locally stored user data when a managed Chromebook is powerwashed?

  1. It is transferred to the administrator's account
  2. It is migrated automatically to the device's TPM
  3. It is removed, and any cloud-synced data must be re-downloaded after sign-in Correct answer.
  4. It is preserved and restored after re-enrollment

Explanation

A powerwash returns the device to its factory state and erases local user data. Data stored in cloud services is unaffected and becomes available again after the user signs in.

Question 14ChromeOS fundamentals and device provisioning

An administrator sets "Forced re-enrollment" to "Force re-enrollment" for an organizational unit. What is the effect when a device in that OU is powerwashed?

  1. The device retains its enrollment without any re-enrollment step
  2. The device becomes unmanaged and can enroll anywhere
  3. The device is automatically deprovisioned and disabled
  4. The device must re-enroll into the same domain before it can be used Correct answer.

Explanation

Forced re-enrollment ensures that after a wipe the device can only complete setup by enrolling back into the same domain. This deters attempts to escape management by powerwashing.

Question 15ChromeOS fundamentals and device provisioning

Which statement about the ChromeOS release channels is accurate for a fleet administrator?

  1. All devices must remain on the Stable channel
  2. Stable, Beta, and Long Term Support channels can be pinned per organizational unit Correct answer.
  3. Long Term Support is only available for unmanaged devices
  4. Channels are selected by end users and cannot be managed

Explanation

Administrators can pin the release channel and version per organizational unit so that test groups receive Beta while production stays on Stable or Long Term Support. This supports staged rollouts and validation before wide deployment.

Question 16ChromeOS fundamentals and device provisioning

A company wants to evaluate a new ChromeOS milestone on a small pilot group before rolling it out to all staff. Which approach fits best?

  1. Disable auto-updates for the entire fleet
  2. Pin the pilot OU to the Beta channel and keep the production OU on Stable Correct answer.
  3. Set every device to the Long Term Support channel
  4. Move all devices to the Beta channel and monitor for issues

Explanation

Channel and version pinning per organizational unit lets a pilot group absorb a new milestone while production remains on a validated release. This limits blast radius if the new version causes regressions.

Question 17ChromeOS fundamentals and device provisioning

Which component verifies the integrity of ChromeOS firmware and operating system at boot?

  1. Verified boot using cryptographic signatures Correct answer.
  2. The device's Wi-Fi configuration profile
  3. The user's Google Account password
  4. The Chrome Web Store review process

Explanation

Verified boot checks signatures of firmware and system partitions at startup and can fall back to a known-good image if tampering is detected. This is a core part of ChromeOS's defense against persistent compromise.

Question 18ChromeOS fundamentals and device provisioning

An administrator is troubleshooting a device that will not enroll, receiving an error that the device is already owned by another domain. What is the most likely cause?

  1. The device's TPM has been cleared by the user
  2. The device's Wi-Fi password is incorrect
  3. The device has an outdated ChromeOS version
  4. The device was previously enrolled to a different domain and was not properly deprovisioned Correct answer.

Explanation

ChromeOS records domain ownership at enrollment, so a device still registered to another domain cannot enroll elsewhere until that record is released. The previous owner must deprovision the device or the transfer must be arranged.

Question 19ChromeOS fundamentals and device provisioning

What is the role of the TPM in a managed ChromeOS device?

  1. It stores cryptographic keys that protect local data and support device identity Correct answer.
  2. It manages the device's Wi-Fi roaming behavior
  3. It provides the graphical user interface for the login screen
  4. It hosts the Admin console web application

Explanation

The TPM is a hardware security chip that seals keys used for local data encryption and supports attestation of device identity. It underpins several ChromeOS security guarantees.

Question 20ChromeOS fundamentals and device provisioning

An organization must ensure that only approved ChromeOS devices, identified by their enterprise enrollment, can access corporate resources. Which capability supports device identity attestation?

  1. Guest mode browsing
  2. Chrome sync for bookmarks
  3. Incognito windows
  4. Verified Access using TPM-backed attestation Correct answer.

Explanation

Verified Access uses TPM-backed attestation to report whether a device is enrolled, managed, and in a trustworthy state, which access proxies can then evaluate. It ties resource access to verified device identity rather than user credentials alone.

Question 21ChromeOS fundamentals and device provisioning

Which setting determines whether users can enroll their own devices into the organization?

  1. The device's screen brightness policy
  2. The enrollment controls configured for the domain and organizational unit Correct answer.
  3. The Chrome Web Store publishing permissions
  4. The user's Gmail signature

Explanation

Enrollment permissions are governed by domain-level and OU-level settings that determine which devices and users may enroll. Administrators use these controls to keep personal hardware out of the managed fleet.

Question 22ChromeOS fundamentals and device provisioning

A fleet uses a parent OU with baseline policies and several child OUs for departments. A child OU changes one setting that the parent also defines. What is the result?

  1. Both values apply simultaneously and cause an enrollment failure
  2. The parent OU's value overrides the child for all settings
  3. The child OU's value applies, and other inherited settings remain in effect Correct answer.
  4. The device becomes unmanaged until the conflict is resolved

Explanation

Policy inheritance lets a child override only the specific settings it defines while continuing to inherit everything else from its parent. This supports layered configuration without duplicating the full baseline.

Question 23ChromeOS fundamentals and device provisioning

Which practice best supports a large deployment where devices arrive at multiple sites and must enroll without IT staff present?

  1. Disable enrollment controls so any device can join
  2. Pre-register devices for zero-touch enrollment with site-specific organizational units Correct answer.
  3. Issue administrator credentials to site staff for manual enrollment
  4. Require each site to powerwash devices before use

Explanation

Pre-registering devices to the correct organizational unit enables automatic enrollment at each site without IT presence. It also ensures each site receives the right policies from first boot.

Question 24ChromeOS fundamentals and device provisioning

What does the "last sync" timestamp on a ChromeOS device record indicate?

  1. The last time the device checked in with Google's management service Correct answer.
  2. The last time the device's firmware was updated
  3. The last time a user changed their password
  4. The last time the device was powerwashed

Explanation

The last sync timestamp reflects the most recent policy check-in with the management service, which helps administrators spot devices that are offline or no longer reporting. It is a health signal for fleet monitoring.

Question 25ChromeOS fundamentals and device provisioning

An administrator wants to retire a set of devices and ensure they cannot re-enroll into the domain. Which deprovisioning choice accomplishes this?

  1. Deprovision only
  2. Powerwash and leave enrolled
  3. Move the devices to the root organizational unit
  4. Deprovision and disable Correct answer.

Explanation

Choosing the disable option removes the devices from management and blocks them from re-enrolling until an administrator reverses the block. This is the appropriate choice for retired or lost hardware.

Question 26ChromeOS fundamentals and device provisioning

Which ChromeOS enrollment path lets an organization register devices with Google before they are ever powered on, so the hardware is tied to the domain at first boot?

  1. Zero-touch enrollment through a hardware partner Correct answer.
  2. Manual enterprise enrollment at the sign-in screen
  3. Guest-mode setup followed by a domain join
  4. Self-enrollment by the end user with a company email

Explanation

Zero-touch enrollment relies on a pre-registration step in which the device serial number is uploaded to the Admin console through a reseller or partner before delivery, so the device checks in and enrolls automatically on first boot. Manual and self-enrollment both require a human to complete the enrollment screen. Guest mode never creates a managed device record.

Question 27ChromeOS fundamentals and device provisioning

A Chromebook is being enrolled and the administrator must choose which organizational unit it lands in during the enrollment flow. Where is that placement decided?

  1. On the device itself, in the enrollment screen, by the person performing enrollment Correct answer.
  2. In the Admin console only, after the device appears in the fleet list
  3. Automatically by Google, based on the device serial number
  4. By the ChromeOS update server during the first policy fetch

Explanation

During manual enrollment the person completing the flow selects the organizational unit from the units that the enrolling account is permitted to place devices into. Serial numbers do not carry a unit assignment, and the device only appears in the Admin console after enrollment completes. Policy fetch happens after the device is already placed.

Question 28ChromeOS fundamentals and device provisioning

Which statement describes how ChromeOS device policies reach an enrolled Chromebook?

  1. Policies are baked into the recovery image at manufacture and never change.
  2. Policies are pushed by the Admin console over the device's management connection and applied on sync. Correct answer.
  3. Policies are stored on the user's Google Drive and read at sign-in.
  4. Policies are delivered only when the user opens the Chrome settings page.

Explanation

Enrolled devices maintain a management channel to Google, and the Admin console settings for the device's organizational unit are delivered as policies that the device applies when it syncs. The recovery image contains the operating system, not tenant-specific policy. User Drive storage and the settings page are unrelated to policy delivery.

Question 29ChromeOS fundamentals and device provisioning

An administrator wants to know which ChromeOS devices are still running an end-of-life milestone so they can plan replacements. Which Admin console view provides that information?

  1. The user list filtered by last sign-in date
  2. The ChromeOS devices list, where each device shows its current platform version and auto-update expiration Correct answer.
  3. The printing servers configuration page
  4. The Chrome browser bookmarks report

Explanation

The ChromeOS devices inventory in the Admin console reports each device's platform version and the auto-update expiration date derived from its milestone, which is how fleets identify units nearing end of life. User sign-in data and unrelated configuration pages do not carry platform version or AUE information.

Question 30ChromeOS fundamentals and device provisioning

What is the purpose of the ChromeOS device re-enrollment setting that requires devices to check in with a validated enterprise state before granting access?

  1. It restricts the device to a single Wi-Fi network for its lifetime.
  2. It encrypts the local user profile with a hardware-bound key.
  3. It prevents a wiped or tampered device from silently rejoining the domain without a valid management record. Correct answer.
  4. It forces every user to complete two-step verification at sign-in.

Explanation

Forced re-enrollment ties a device to its management record so that after a powerwash or reset the device must prove it still belongs to the domain before it can enroll again. It is a control against devices being removed from management and reused. It does not encrypt profiles, enforce user two-step verification, or pin a network.

Question 31ChromeOS fundamentals and device provisioning

An administrator needs to identify which organizational unit a specific Chromebook belongs to without physically handling the device. What is the most direct approach in the Admin console?

  1. Query the Chrome Web Store for the device's installed extensions
  2. Open the user's Gmail settings and look for a device label
  3. Check the Google Workspace billing invoice for the device
  4. Search the ChromeOS devices list by serial number or asset ID and read the organizational unit column Correct answer.

Explanation

The ChromeOS devices inventory supports searching by identifiers such as serial number or asset ID, and each result displays the organizational unit the device is currently placed in. The other locations do not hold device-to-unit mapping information.

Question 32ChromeOS fundamentals and device provisioning

Which ChromeOS boot behavior is enforced by verified boot when firmware or the operating system has been modified?

  1. The device refuses to boot the altered image and offers recovery. Correct answer.
  2. The device disables the keyboard until an administrator unlocks it.
  3. The device boots normally but logs a warning to the Admin console.
  4. The device silently reverts to the previous user's profile.

Explanation

Verified boot uses cryptographic signatures checked at each stage; if a component fails verification the device will not continue into the altered image and instead prompts for recovery. The design goal is to prevent tampered code from running at all, not merely to log it. Profile restoration and input locking are unrelated behaviors.

Question 33ChromeOS fundamentals and device provisioning

A district receives 400 new Chromebooks and wants them enrolled into the correct school organizational unit with no technician touching each device. Which combination makes this possible?

  1. A single shared administrator account used at every device
  2. Zero-touch pre-registration with a default organizational unit set per order, plus network access at the school Correct answer.
  3. Guest sessions that are later converted to managed accounts
  4. Manual enrollment performed by each student on first login

Explanation

Zero-touch enrollment lets the reseller pre-register serial numbers and assign a default organizational unit, so devices enroll themselves the first time they see a network. This removes per-device technician work. Student-driven manual enrollment, guest sessions, and shared admin credentials either require hands-on steps or violate sound account practice.

Question 34ChromeOS fundamentals and device provisioning

Which ChromeOS setting controls whether a user signing in with a company account on an unmanaged device is prompted to enroll that device into the organization?

  1. The ChromeOS auto-update pin policy
  2. The device's power management policy
  3. The enrollment controls in the Admin console that govern whether users may enroll their own devices Correct answer.
  4. The content pack settings for the user's organizational unit

Explanation

Enrollment permissions are governed by Admin console settings that determine whether users are allowed to enroll devices themselves and under what conditions. Power management, content packs, and update pinning affect device behavior after enrollment but do not gate the enrollment action.

Question 35ChromeOS fundamentals and device provisioning

An administrator powerwashes a managed Chromebook while forced re-enrollment is enabled. What is the expected outcome at the next setup?

  1. The device enrolls into any domain the next user chooses.
  2. The device becomes permanently unusable and must be scrapped.
  3. The device is required to re-enroll into its original domain before normal use. Correct answer.
  4. The device boots into developer mode automatically.

Explanation

With forced re-enrollment in place, the management record persists through a powerwash, so the device must check in and re-enroll with its original domain rather than being free to join another. The device remains usable; it is simply bound to its owning organization. Developer mode is not enabled by a powerwash.

Question 36ChromeOS fundamentals and device provisioning

Which ChromeOS feature lets an administrator stage a device so that it is already assigned to an organizational unit and user before the recipient ever opens the lid?

  1. Pre-provisioning, in which the device is enrolled and configured ahead of delivery Correct answer.
  2. Chrome Sync with a personal account
  3. Guest browsing with a saved session
  4. Developer mode sideloading

Explanation

Pre-provisioning enrolls the device and applies its organizational unit and policies before it reaches the end user, so the first boot goes straight to a ready state. Developer mode, guest browsing, and personal Chrome Sync do not create a preconfigured managed device.

Question 37ChromeOS fundamentals and device provisioning

An administrator must ensure that a batch of devices can only be enrolled by accounts in a specific organizational unit, not by any company user. Which approach fits?

  1. Turn off Chrome Sync for the whole domain
  2. Require all users to use guest mode
  3. Restrict enrollment permissions so only the intended accounts can enroll devices, and place devices in the correct unit during enrollment Correct answer.
  4. Disable the Admin console for all users except super admins

Explanation

Enrollment eligibility is controlled by enrollment permissions scoped to accounts and organizational units, and the enrolling account chooses the destination unit. Limiting who may enroll and where devices land keeps the batch under the intended unit. Disabling the console, turning off Sync, or forcing guest mode does not govern enrollment.

Question 38ChromeOS fundamentals and device provisioning

What distinguishes a device's organizational unit from a group in the Admin console when applying ChromeOS policies?

  1. Groups apply settings hierarchically, while organizational units only target email
  2. Organizational units apply only to users, while groups apply only to devices
  3. Organizational units apply settings hierarchically to devices and users, while groups are used mainly for targeting and permission assignment Correct answer.
  4. They are interchangeable and differ only in name

Explanation

Organizational units form a hierarchy in which child units inherit parent settings unless overridden, and they are the primary structure for applying ChromeOS policies. Groups are collections used for targeting, licensing, and permission assignment rather than hierarchical policy inheritance.

Question 39ChromeOS fundamentals and device provisioning

A device is stuck on the enrollment screen and reports that it cannot reach the management service. Which cause should an administrator investigate first?

  1. The device has too many installed extensions
  2. The device's storage is full of user files
  3. Network filtering or proxy configuration is blocking the Google management endpoints Correct answer.
  4. The user has not set a Chrome theme

Explanation

Enrollment depends on reaching Google's management endpoints, so a proxy, firewall, or content filter that blocks those hosts will stall the flow. Storage, extension count, and cosmetic settings do not prevent the device from contacting the management service.

Question 40ChromeOS fundamentals and device provisioning

Which statement about a ChromeOS device's asset ID and location fields in the Admin console is accurate?

  1. They are read-only values generated by Google at manufacture.
  2. They are required for enrollment to succeed.
  3. They are administrator-maintained metadata used to track physical inventory. Correct answer.
  4. They are overwritten each time the device syncs.

Explanation

Asset ID and location are optional fields that administrators populate to match their own inventory systems, such as tagging a device to a cart or building. They are not generated by Google, not required for enrollment, and not reset by syncs.

Question 41ChromeOS fundamentals and device provisioning

An administrator wants devices in a computer lab to be shared by many students, with no user data retained between sessions. Which configuration supports this?

  1. Disabling verified boot on the lab organizational unit
  2. Assigning each student a separate device serial number
  3. Enabling ephemeral mode so user data is discarded at sign-out Correct answer.
  4. Enabling developer mode for all lab devices

Explanation

Ephemeral mode, sometimes called transient or stateless mode, discards the local user profile at sign-out so shared devices retain nothing between users. Developer mode and disabling verified boot weaken security rather than protecting shared use, and serial numbers are fixed hardware identifiers.

Question 42ChromeOS fundamentals and device provisioning

What happens to a managed Chromebook's device-level policy when the device is moved from a parent organizational unit to a child unit that overrides one setting?

  1. All parent settings are discarded and only child settings apply
  2. The child unit's override applies while inherited parent settings continue for everything else Correct answer.
  3. The device must be re-enrolled before the change takes effect
  4. The device keeps the parent setting until it is powerwashed

Explanation

Organizational units inherit settings from their parents, and a child override changes only the specific setting it defines. The rest of the inherited configuration remains in force, and the change propagates on the next policy sync without re-enrollment.

Question 43ChromeOS fundamentals and device provisioning

An administrator needs to confirm that a newly enrolled device has received the latest policy configuration. Which signal in the Admin console is most relevant?

  1. The device's screen resolution
  2. The device's last policy sync timestamp Correct answer.
  3. The device's battery health percentage
  4. The number of Chrome tabs open on the device

Explanation

The last policy sync timestamp shows when the device most recently checked in and applied its configuration, which is the direct evidence that new policy has been received. Screen resolution, open tabs, and battery health describe hardware or usage state, not policy delivery.

Question 44ChromeOS fundamentals and device provisioning

Which action removes a device from management while leaving it usable for a new owner outside the organization?

  1. Moving the device to a child organizational unit
  2. Powerwashing the device while forced re-enrollment is enabled
  3. Deprovisioning the device and selecting a reason that does not retain the enterprise record Correct answer.
  4. Disabling Chrome Sync for the device's user

Explanation

Deprovisioning releases the enterprise management record; choosing a reason that does not keep the record lets the device be enrolled elsewhere or used unmanaged. A powerwash with forced re-enrollment keeps the device bound to the domain, and moving units or changing Sync settings does not release ownership.

Question 45ChromeOS fundamentals and device provisioning

A fleet administrator must decide between the stable channel and the long-term support channel for devices used in high-stakes testing. Which consideration is most relevant?

  1. The stable channel is only available on unmanaged devices
  2. Long-term support keeps a fixed feature set with security fixes for a longer period, reducing mid-term change risk Correct answer.
  3. The stable channel never receives security updates
  4. Long-term support devices cannot be enrolled in a domain

Explanation

The long-term support channel holds a milestone for an extended period while still delivering security fixes, which suits environments that need predictability across a testing window. The stable channel does receive updates and is fully supported for managed fleets, and enrollment is independent of channel choice.

Question 46ChromeOS fundamentals and device provisioning

An administrator wants a pilot group of devices to receive a new ChromeOS milestone before the rest of the fleet, while keeping the majority on the current version. Which control accomplishes this?

  1. Disabling auto-updates for the entire domain
  2. Setting a version pin or rollout control scoped to the pilot organizational unit Correct answer.
  3. Powerwashing the pilot devices
  4. Moving the pilot devices to guest mode

Explanation

Version pinning and controlled rollout settings applied to a specific organizational unit let a subset of devices move to a new milestone while other units stay put. Powerwashing does not change the version received, and disabling updates domain-wide blocks the pilot as well.

Question 47ChromeOS fundamentals and device provisioning

Which ChromeOS hardware component stores device-bound secrets used to protect enrollment identity and encrypted user data?

  1. The audio codec
  2. The display controller
  3. The SD card reader
  4. The Trusted Platform Module Correct answer.

Explanation

The Trusted Platform Module holds device-specific cryptographic keys and measurements that support verified boot and protect enrollment identity and encrypted data. Display, storage reader, and audio components do not provide sealed key storage.

Question 48ChromeOS fundamentals and device provisioning

An administrator must ensure that devices returned from a lease are wiped of user data and cannot be reused by the leasing company without the organization's consent. Which sequence is appropriate?

  1. Deprovision the device with a reason that retains the enterprise record, then powerwash before shipping Correct answer.
  2. Disable the devices' Wi-Fi policy and ship them
  3. Powerwash only, leaving the enterprise record intact
  4. Move the devices to a child organizational unit and ship them

Explanation

Retaining the enterprise record while deprovisioning keeps the hardware bound to the organization, and a powerwash removes local user data before the device leaves custody. A powerwash alone leaves the record intact but the sequence matters for data removal, while unit moves and network policy changes do nothing for either goal.

Question 49ChromeOS fundamentals and device provisioning

Which statement best explains why an organization would enable verified access together with device enrollment for access to internal web applications?

  1. It ties access to a verified, managed device identity in addition to user credentials Correct answer.
  2. It blocks all access from unmanaged networks
  3. It replaces the need for user passwords entirely
  4. It encrypts the internal application's database

Explanation

Verified access combines user identity with an assertion that the request comes from a managed, verified device, so access decisions consider both factors. It supplements rather than replaces user authentication, and it does not encrypt backend databases or control network topology.

Question 50ChromeOS fundamentals and device provisioning

An administrator wants to confirm that a device is actually managed before troubleshooting a policy that appears not to apply. Which device state is the clearest indicator?

  1. The device appears in the ChromeOS devices list with an active enrollment status Correct answer.
  2. The user reports that the wallpaper changed
  3. The device has a serial number printed on the case
  4. The device shows a full battery in the Admin console

Explanation

A device record with an active enrollment status in the ChromeOS devices list confirms the device is managed and eligible to receive policy. Battery level, cosmetic changes, and printed serial numbers do not demonstrate enrollment.