Professional Chrome Enterprise Administrator Free Sample Questions
Description
Covers Chrome policy and release management, built-in security and data protection, device enrollment and user provisioning, Chrome Enterprise Core and MDM integration, and extensions.
19 free sample questions220 in the full practice test
Security and Compliance · Data Loss Prevention (DLP) Integration
A financial services company is using Chrome Browser Cloud Management to enforce policies. A security audit requires that any attempt to upload files containing credit card numbers from a managed Chrome browser to a non-approved web service be blocked and logged. The company already uses Google Workspace and has its DLP rules configured there. What is the most direct way to meet this requirement?
Answer and explanation
Correct answer: D
Chrome Browser Cloud Management can integrate directly with Google Workspace. This allows the powerful content-aware DLP rules already defined in Workspace (such as detecting credit card numbers) to be extended to the Chrome browser, providing seamless enforcement without requiring a separate third-party solution. Blocking URLs is too broad, and Safe Browsing does not perform content inspection for DLP purposes.
Q2Question 2
Intermediate
Extensions and Applications Management · Linux Apps on ChromeOS
A university is deploying Linux apps via Crostini on managed ChromeOS devices for its computer science department. The administrator needs to prevent students from using the sudo command to gain root access within the Linux container, but still allow them to install a predefined list of packages. Which policy should the administrator configure in the Google Admin console?
Answer and explanation
Correct answer: A
The CrostiniSudoAccessAllowed policy specifically controls whether users can use the sudo command to gain root privileges within the Linux (Crostini) container. Setting this policy to 'false' effectively prevents privilege escalation while still allowing the Linux environment to function for other purposes.
Q3Question 3
Intermediate
Integration and Authentication · SAML Setup
An organization uses a third-party Identity Provider (IdP) that supports SAML 2.0 for single sign-on (SSO). An administrator needs to configure managed Chrome browsers to use this IdP for all Google services. They have already configured SSO in the Google Admin console. What additional Chrome policy must be configured to ensure that users are always redirected to the third-party IdP login page and cannot use a standard Google account login?
Answer and explanation
Correct answer: D
The BrowserSignin policy (specifically setting it to 'Force users to sign-in to use the browser') combined with the domain-level SAML SSO configuration ensures that users are required to authenticate via the configured third-party IdP before they can use the browser. This prevents bypassing the SSO flow by using a personal Google account or browsing as a guest.
Q4Question 4
Beginner
Integration and Authentication · Proxy Configuration
A company is transitioning to ChromeOS Flex for a large number of older desktops. The network team requires that these devices use a specific PAC (Proxy Auto-Config) file hosted at http://proxy.internal/config.pac for internet access. The administrator needs to apply this setting to all ChromeOS Flex devices in a specific Organizational Unit. Which policy setting should be used?
Answer and explanation
Correct answer: B
To enforce the use of a specific PAC file, the administrator must select the 'Use a proxy auto-config (PAC) file' option within the Proxy mode settings and then enter the URL of the PAC file. This ensures all devices in the target OU will fetch and apply the proxy rules from that specific location.
Q5Question 5
AdvancedMultiple answers
Extensions and Applications Management · Private Extensions
An administrator manages a fleet of corporate-owned Windows laptops with managed Chrome browsers. A custom-built, in-house extension is required for all users. The extension files (.crx and manifest) are hosted on an internal web server. Which TWO policies must be configured to force-install this extension and ensure it updates correctly from the internal server? (Select TWO)
Answer and explanation
Correct answers: A, C
This policy is used to force-install extensions. The value must include the extension's ID and the URL pointing to its update manifest XML file on the internal server.
This policy must be configured to allowlist the URL of the internal server where the extension's .crx file is hosted. Without this, Chrome will not trust the source and will block the installation, even if it's in the forcelist.
True or False: The 'Extended Stable' release channel for Chrome receives feature updates at a slower pace than the 'Stable' channel, but receives security updates at the same rapid pace.
Answer and explanation
Correct answer: A
This is true. The Extended Stable channel is designed for enterprises that need more time to manage updates. It receives new features on a slower, 8-week cycle, but critical security fixes are backported and delivered as they become available, typically every 2 weeks, just like the regular Stable channel.
Q7Question 7
Advanced
Device and User Management · Kiosk Mode Configuration
Case Study:
A global retail company, ShopFast, is deploying 5,000 ChromeOS devices to its stores to be used as point-of-sale (POS) terminals. These devices must be heavily restricted for security and operational consistency.
Current Situation: The IT team has successfully enrolled all devices into the Google Admin console and placed them in a dedicated 'POS Terminals' Organizational Unit (OU). The devices connect to a dedicated, secured Wi-Fi network in each store. The primary application is a Progressive Web App (PWA) that handles all sales transactions.
Requirements:
The devices must boot directly into the PWA and run it in fullscreen mode.
Users must not be able to exit the PWA or access any other part of ChromeOS.
The devices must automatically log in to a predefined guest session; no employee should need to enter credentials on the device itself.
After 15 minutes of inactivity, the session must be terminated and a new session started to ensure data privacy between transactions.
Which configuration in the Google Admin console will meet all these requirements for the 'POS Terminals' OU?
Answer and explanation
Correct answer: C
This is the correct and most complete solution. Configuring the device to run as a single-app Kiosk meets the requirements of booting directly into the PWA and preventing users from exiting. Setting the Kiosk app to be the specific PWA ensures it runs fullscreen. The auto-login feature is inherent to Kiosk mode. The requirement for session termination after inactivity is met by configuring the 'Idle session timeout' action within the Kiosk settings, which logs out and restarts the session.
An administrator is troubleshooting an issue where a specific policy, URLBlocklist, is not applying to a user's managed Chrome browser on their Windows machine. The administrator has verified the user and the browser are in the correct OU where the policy is set. Using chrome://policy, the administrator sees the policy listed, but its source is 'Platform' and not 'Cloud'. What is the most likely cause of this issue?
Answer and explanation
Correct answer: B
When chrome://policy shows the source as 'Platform', it indicates the policy is being set by the underlying operating system's management framework, which for a domain-joined Windows machine is typically Active Directory Group Policy (GPO). Platform policies (like GPO) have a higher precedence than policies delivered from Chrome Browser Cloud Management ('Cloud'). The administrator must find and remove the conflicting GPO.
Q9Question 9
Beginner
Chrome Enterprise Core and Cloud Management · Enrollment Tokens
A new Chrome Enterprise Administrator is setting up Chrome Browser Cloud Management for the first time. To enroll browsers, they must generate a token. What is the validity period of a newly generated enrollment token?
Answer and explanation
Correct answer: C
Enrollment tokens for Chrome Browser Cloud Management do not have an automatic expiration date. They remain valid and can be used to enroll an unlimited number of browsers until an administrator explicitly revokes the token in the Google Admin console. This is a key security consideration for managing token lifecycle.
Register free for 10 more questions
Or unlock all 220 PCEA questions with explanations, timed mode and flashcards.
