Security, Reporting, and Troubleshooting
What this domain tests
This domain tests the ChromeOS security model, remote device actions, Admin console reporting and audit logs, and a structured troubleshooting approach for enrollment, policy, and sign-in problems. Expect questions that require choosing the right evidence source and the least disruptive fix.
Core rules
- ChromeOS security relies on verified boot, a read-only root filesystem, TPM-backed protection, sandboxing, Safe Browsing, and automatic updates. Developer mode weakens verified boot and should be blocked where policy allows.
- Remote actions include disable, deprovision, wipe, and restart where supported. Lost mode helps locate or secure a device. Choose the least destructive action that solves the problem.
- Reporting includes device inventory, Chrome version reporting, extension reporting, and Admin audit logs. Audit logs record admin actions, not every user action, and reporting can lag.
- Troubleshooting starts with scope: user versus device policy, OU inheritance, and group targeting. On-device policy pages show effective values; system logs and the device timeline provide enrollment and network evidence.
- Wipe removes local user data; deprovision removes the management record. Deprovisioning does not substitute for a wipe when data must be erased.
- Confirm whether the issue is authentication, authorization, policy, network, or hardware before applying a fix.
Worked example
A user reports that an extension is blocked. The admin checks the user's OU, the extension allowlist, the force-install policy, and the effective policy on the device. The extension ID is missing from the allowlist, and a child OU has a stricter blocklist than the parent. The admin adds the ID to the allowlist and resolves the child override. Why it works: the investigation follows policy scope and inheritance instead of guessing, and the device confirms the effective result.
Traps that cost marks
- Expecting audit logs or reports to be instant and complete for every user action.
- Using wipe when deprovision is intended, or deprovision when data must be erased.
- Forgetting that developer mode affects verified boot.
- Checking only the parent OU and missing a child override.
- Treating a sign-in failure as a policy problem without checking identity or network evidence.
- Applying a destructive remote action before confirming scope.