GCP Workspace Admin flashcards
GCP Workspace Admin · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Primary email uniqueness
- A user's primary email must be unique across the entire Workspace domain. Aliases and nicknames must also be unique within their domain scope.
- Suspended vs deleted user
- Suspension blocks sign-in while keeping data, licenses, and mailbox intact. Deletion removes the account and frees the username for reuse.
- Organizational unit tree
- OUs form a single-parent hierarchy. Each user belongs to one OU, and child OUs inherit parent settings unless explicitly overridden.
- Custom admin role
- A role built from granular privileges rather than a predefined set. Assignments can be scoped to a single OU to limit blast radius.
- Directory API user insert
- Creating a user requires primaryEmail plus name.givenName and name.familyName. Omitting the password forces a password change at first sign-in.
- Group nesting and policy
- Groups can contain other groups. Nested membership counts for most policy evaluation, but license assignment behavior may differ per product.
- Gmail routing rule order
- Routing rules evaluate in priority order and the first matching rule applies. Rules can also use address lists or recipient map entries.
- Content compliance vs routing
- Content compliance inspects message body and attachments against expressions. Routing rules direct delivery and do not inspect content the same way.
- Calendar external sharing cap
- Calendar sharing defaults are set per OU. The maximum external sharing level caps what individual users can grant to external parties.
- Drive domain allowlist
- A list of external domains permitted for Drive sharing. Files can only be shared externally with domains on the allowlist when the restriction is enabled.
- Service status overridden
- Per-OU service state is On, Off, or Overridden. Overridden means the child OU's value differs from the parent's inherited setting.
- Drive ownership transfer
- Transferring file ownership requires the new owner to have an active license and available storage. Files from suspended users can still be transferred.
- Groups join and view controls
- Group settings independently control who can view membership, who can post, and who can join. Each control can target different audiences.
- Vault retention rule
- Retention rules are configured per service and set how long data is kept. A default rule covers all users; custom rules can target OUs or groups.
- Vault hold vs retention
- A hold preserves data beyond the retention period and prevents purge. Holds can be scoped by OU, group, or specific accounts within a matter.
- Vault export scope
- Exports are matter-scoped and limited to the data types selected in the matter. Output goes to Cloud Storage or a download link.
- Data regions coverage
- Data regions control where covered data at rest is stored for select services. Coverage is service-specific and not all Workspace data is included.
- Drive DLP rule action
- DLP rules scan content using predefined or custom detectors. Actions include warn, block, or audit, and scope determines internal versus external coverage.
- Audit log retention default
- Admin, Drive, and Login audit logs are retained six months by default. Export to BigQuery or Cloud Storage extends retention beyond that window.
- Client-side encryption
- CSE encrypts content before it reaches Google. Key access is managed by the customer's external key service, not by Google.
- 2SV enforcement cascade
- 2-Step Verification enforcement is set per OU. Once enforced, users must enroll at next sign-in, and enforcement cascades to child OUs.
- Context-Aware Access levels
- Access levels are built from device, IP, and user attributes. Attaching a level to an app gates sign-in based on those conditions.
- OAuth app allowlisting
- API controls block unconfigured third-party apps. Trusted apps are added to an allowlist, and unconfigured apps can be set to blocked.
- Legacy protocol toggles
- Less secure app access is deprecated. IMAP, POP, and SMTP AUTH are instead controlled by per-OU protocol toggles in Gmail settings.
- Password policy scope
- Password length, reuse, expiration, and strength settings apply per OU. Common baselines require at least 8 characters, often 12 or more.
- Chrome browser enrollment
- Enrolled browsers report to the Admin console under Devices. Enrollment uses a Cloud Management token or policy, and policies apply per OU.
- Advanced mobile management
- This tier enables device approval, Android work-profile separation, and remote wipe of corporate data on BYOD devices.
- Endpoint verification extension
- The extension reports device inventory such as OS, serial, and encryption status. Some Context-Aware Access levels require it.
- BYOD remote wipe scope
- On BYOD devices, remote wipe removes only Workspace-managed data. A full device wipe is available only for company-owned devices.
- Device approval control
- Device approval blocks unapproved devices from accessing Workspace data. Admins approve devices manually or through policy.
- Sign-in troubleshooting order
- Check account status, then password and 2SV, then OU service status, then login challenges or access levels to isolate the cause.
- Email Log Search tool
- This tool traces a message's delivery path, including routing rules and spam or quarantine outcomes, to diagnose mail delivery failures.