Google ChromeOS Administrator Practice Exams
Last updated on Oct 21,2026- Exam Code: ChromeOS Administrator
- Exam Name: Professional ChromeOS Administrator
- Certification Provider: Google
- Latest update: Oct 21,2026
Question #11
A customer deploys a large number of ChromeOS devices and would like to start the process of turning on Zero-Touch Enrollment (ZTE) to streamline their deployment process.
As an administrator, what would be required to enable ZTE?
- A . Grant partner admin access
- B . identify OU to place devices during enrollment
- C . Create a zero-touch token
- D . Create a pre-provisioning token
Correct Answer: B
B
Explanation:
Zero-touch enrollment (ZTE) automates the device enrollment process when users first power on their ChromeOS devices. Before you can enable ZTE, you need to determine the organizational unit (OU) where the devices should be placed during enrollment. This is crucial because different OUs can have different policies and configurations applied to them.
Plan Your OU Structure: If you haven’t already, create a well-organized OU structure in your Google Admin console that reflects your organization’s hierarchy and device management needs.
Select the Target OU: Choose the specific OU where you want the ZTE-enrolled devices to reside. Consider factors like department, location, or device type when making your decision. Once you’ve identified the appropriate OU, you can proceed with creating a zero-touch enrollment token and associating it with that OU. This will ensure that newly enrolled devices are automatically placed in the correct OU and inherit the desired policies.
B
Explanation:
Zero-touch enrollment (ZTE) automates the device enrollment process when users first power on their ChromeOS devices. Before you can enable ZTE, you need to determine the organizational unit (OU) where the devices should be placed during enrollment. This is crucial because different OUs can have different policies and configurations applied to them.
Plan Your OU Structure: If you haven’t already, create a well-organized OU structure in your Google Admin console that reflects your organization’s hierarchy and device management needs.
Select the Target OU: Choose the specific OU where you want the ZTE-enrolled devices to reside. Consider factors like department, location, or device type when making your decision. Once you’ve identified the appropriate OU, you can proceed with creating a zero-touch enrollment token and associating it with that OU. This will ensure that newly enrolled devices are automatically placed in the correct OU and inherit the desired policies.
Question #12
In line with Google’s best practice recommendations, you need to configure an OU of devices to run on an early release of ChromeOS so that users can test new features and verify functionality.
Which policy option should you choose?
- A . LTS
- B . Canary
- C . Beta
- D . Stable
Correct Answer: C
C
Explanation:
ChromeOS offers different release channels with varying levels of stability and feature availability:
Stable: The most stable and widely used channel, suitable for general deployment.
Beta: Contains newer features and improvements, but with some potential for instability. Ideal for testing in a controlled environment.
Dev: More frequent updates with experimental features, less stable than Beta.
Canary: The least stable channel, updated daily with bleeding-edge features.
To test new features while maintaining reasonable stability, the Beta channel is the recommended choice.
C
Explanation:
ChromeOS offers different release channels with varying levels of stability and feature availability:
Stable: The most stable and widely used channel, suitable for general deployment.
Beta: Contains newer features and improvements, but with some potential for instability. Ideal for testing in a controlled environment.
Dev: More frequent updates with experimental features, less stable than Beta.
Canary: The least stable channel, updated daily with bleeding-edge features.
To test new features while maintaining reasonable stability, the Beta channel is the recommended choice.
Question #13
You have been asked to explain the built-in security features of ChromeOS.
What i3 the benefit of having verified boot enabled on a ChromeOS device?
- A . It ensures that the OS is uncompromised
- B . It allows updates to happen in the background
- C . Running both operating systems on one device at the same time makes It twice as powerful
- D . It installs the known safe backup OS every time the device is slatted up.
Correct Answer: A
A
Explanation:
Verified Boot in ChromeOS is a security mechanism that checks the integrity of the operating system during startup. If it detects any unauthorized modifications or compromises, it can initiate recovery processes to restore the OS to a known good state, ensuring that the device boots up with a secure and untampered operating system.
Option B is incorrect because background updates are a separate feature.
Option C is incorrect because dual-boot is not related to Verified Boot.
Option D is incorrect because Verified Boot doesn’t install a backup OS but verifies the existing one.
Reference: Verified Boot: https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot/
A
Explanation:
Verified Boot in ChromeOS is a security mechanism that checks the integrity of the operating system during startup. If it detects any unauthorized modifications or compromises, it can initiate recovery processes to restore the OS to a known good state, ensuring that the device boots up with a secure and untampered operating system.
Option B is incorrect because background updates are a separate feature.
Option C is incorrect because dual-boot is not related to Verified Boot.
Option D is incorrect because Verified Boot doesn’t install a backup OS but verifies the existing one.
Reference: Verified Boot: https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot/
Question #14
You are tasked with converting hundreds of Windows & Mac machines across multiple locations to ChromeOS Flex and enrolling them into the Admin console. The available network bandwidth Is limited at many of the locations and the devices are not currently managed with any endpoint management system.
Which two operations are required to perform the task? Choose 2 answers
- A . Create a dedicated enrollment account tor each location and place them into the OUs you want the devices enrolled into then enable the ‘Place ChromeOS device in user organization" policy and enroll the devices using the respective enrollment account for each location
- B . Install the Recovery Tool extension on all devices that are to be converted and follow the step-by-step installer to convert each device directly without the need of USB drives
- C . Use PXE boot to load the ChromeOS Flex image onto devices and have them automatically convert across all locations after they’re restarted
- D . Contact an authorized Zero-Touch Enrollment (ZTE) reseller and share the serial numbers of the devices you’re converting and the
domain you’re enrolling them into to have them pre-provisioned into the Admin console - E . Distribute USB flash drives with the ChromeOS Flex image to the different locations and ask local personnel or a services partner to manually convert each device
Correct Answer: A, E
A, E
Explanation:
Create Dedicated Enrollment Accounts: Create separate enrollment accounts for each location, placing them in the respective OUs where the converted devices should be enrolled. Enable Policy: Turn on the "Place ChromeOS device in user organization" policy. This ensures devices are automatically enrolled into the correct OU based on the enrollment account used.
Enroll Devices: Use the dedicated enrollment account for each location to enroll the converted devices. This allows for organized management based on location. Option E:
Distribute USB Drives: Prepare USB flash drives with the ChromeOS Flex image and distribute them to the different locations.
Manual Conversion: Instruct local personnel or a service partner to manually convert each device using the provided USB drives. This method is suitable when network bandwidth is limited and doesn’t rely on existing endpoint management infrastructure.
Reasons for not choosing other options:
Option B: The Recovery Tool is primarily used for creating recovery media for ChromeOS devices, not converting other operating systems.
Option C: PXE boot is a network-based installation method, not ideal for locations with limited bandwidth.
Option D: While zero-touch enrollment (ZTE) streamlines enrollment, it requires pre-provisioning devices with the vendor or reseller, which might not be feasible in this scenario.
By combining options A and E, you can efficiently convert and enroll devices in multiple locations with limited network resources and no existing management systems.
A, E
Explanation:
Create Dedicated Enrollment Accounts: Create separate enrollment accounts for each location, placing them in the respective OUs where the converted devices should be enrolled. Enable Policy: Turn on the "Place ChromeOS device in user organization" policy. This ensures devices are automatically enrolled into the correct OU based on the enrollment account used.
Enroll Devices: Use the dedicated enrollment account for each location to enroll the converted devices. This allows for organized management based on location. Option E:
Distribute USB Drives: Prepare USB flash drives with the ChromeOS Flex image and distribute them to the different locations.
Manual Conversion: Instruct local personnel or a service partner to manually convert each device using the provided USB drives. This method is suitable when network bandwidth is limited and doesn’t rely on existing endpoint management infrastructure.
Reasons for not choosing other options:
Option B: The Recovery Tool is primarily used for creating recovery media for ChromeOS devices, not converting other operating systems.
Option C: PXE boot is a network-based installation method, not ideal for locations with limited bandwidth.
Option D: While zero-touch enrollment (ZTE) streamlines enrollment, it requires pre-provisioning devices with the vendor or reseller, which might not be feasible in this scenario.
By combining options A and E, you can efficiently convert and enroll devices in multiple locations with limited network resources and no existing management systems.
Question #15
A user reports that their Chrome device has been stolen.
What should the administrator do?
- A . Use the Google Admin console to turn on the stolen Chromebook’s webcam
- B . Use the Google Android Device Manager to locate the Chromebook
- C . Set the stolen Chromebook lo disabled mode to prevent user sign-ins
- D . Remotely wipe user data from the Chromebook
Correct Answer: C
C
Explanation:
When a Chrome device is reported stolen, the administrator should immediately take action to protect the data and prevent unauthorized access. The most effective step is to disable the device through the Google Admin console. This will prevent anyone from signing in to the device, rendering it unusable.
Here’s how to disable a stolen Chrome device:
Sign in to Google Admin console: Use your administrator credentials.
Navigate to Devices: Go to Devices > Chrome > Devices.
Locate the Device: Find the stolen device using its serial number or other identifying information.
Disable the Device: Click on the device and select "Disable."
This will disable the device and prevent anyone from signing in, even if they try to reset the device.
C
Explanation:
When a Chrome device is reported stolen, the administrator should immediately take action to protect the data and prevent unauthorized access. The most effective step is to disable the device through the Google Admin console. This will prevent anyone from signing in to the device, rendering it unusable.
Here’s how to disable a stolen Chrome device:
Sign in to Google Admin console: Use your administrator credentials.
Navigate to Devices: Go to Devices > Chrome > Devices.
Locate the Device: Find the stolen device using its serial number or other identifying information.
Disable the Device: Click on the device and select "Disable."
This will disable the device and prevent anyone from signing in, even if they try to reset the device.
Question #16
An admin wants to use a custom extension to install a client certificate on a ChromeOS device so that
it can connect to the corporate WI-FI.
Which step Is necessary to accomplish this?
- A . Install on the device via guest mode
- B . Distribute through the Chrome Web Store
- C . Force-install to the device
- D . Encode the certificate in DER-encoded format
Correct Answer: C
C
Explanation:
To install a client certificate on a ChromeOS device for corporate Wi-Fi connectivity, it’s necessary to force-install the custom extension containing the certificate. This ensures the extension is installed and activated on the device, enabling it to use the certificate for authentication. Here’s how it works: Custom Extension: The admin creates or obtains a custom extension that includes the client certificate.
Force-Installation: Using the Google Admin console, the admin configures a policy to force-install the extension on ChromeOS devices within the organization.
Device Activation: Once the device receives the policy, the extension is automatically installed and activated, even if the user doesn’t manually add it.
Wi-Fi Authentication: The installed extension allows the device to use the client certificate for authentication when connecting to the corporate Wi-Fi network.
Option A is incorrect because guest mode installations are not persistent and won’t apply the certificate to the device’s Wi-Fi settings.
Option B is incorrect because distributing through the Chrome Web Store is not necessary for a custom extension intended for internal use.
Option D is incorrect because while the certificate encoding is important, it’s not the primary step for
enabling Wi-Fi authentication.
Reference: About ChromeOS device management: https://support.google.com/chrome/a/answer/1289314?hl=en pen_spark
C
Explanation:
To install a client certificate on a ChromeOS device for corporate Wi-Fi connectivity, it’s necessary to force-install the custom extension containing the certificate. This ensures the extension is installed and activated on the device, enabling it to use the certificate for authentication. Here’s how it works: Custom Extension: The admin creates or obtains a custom extension that includes the client certificate.
Force-Installation: Using the Google Admin console, the admin configures a policy to force-install the extension on ChromeOS devices within the organization.
Device Activation: Once the device receives the policy, the extension is automatically installed and activated, even if the user doesn’t manually add it.
Wi-Fi Authentication: The installed extension allows the device to use the client certificate for authentication when connecting to the corporate Wi-Fi network.
Option A is incorrect because guest mode installations are not persistent and won’t apply the certificate to the device’s Wi-Fi settings.
Option B is incorrect because distributing through the Chrome Web Store is not necessary for a custom extension intended for internal use.
Option D is incorrect because while the certificate encoding is important, it’s not the primary step for
enabling Wi-Fi authentication.
Reference: About ChromeOS device management: https://support.google.com/chrome/a/answer/1289314?hl=en pen_spark
Question #17
To allow remote users to securely connect to an internal network, the organization you’re supporting is using a VPN. The organization would like you to configure the ChromeOS devices so that the Android VPN clients deployed are automatically configured with the correct hostname.
How should you configure this in the Admin Console according to Google best practice?
- A . Download the Android app on a ChromeOS device, add the hostname manually then re-upload the app in the organization’s private Google Play Store and deploy it lo all ChromeOS devices
- B . Contact the VPN provider and ask them to provide you with a custom installable client with the correct configuration pre-configured Then deploy that installable
- C . Add a managed configuration using JSON to the Android app
- D . Upload a JSON file with the configuration into the Google Play Store
Correct Answer: C
C
Explanation:
This is the most efficient and scalable way to automatically configure Android VPN clients on
ChromeOS devices with the correct hostname:
Obtain Configuration: Get the required VPN configuration details (hostname, authentication methods, etc.) from the VPN provider or your organization’s network administrator. This configuration is typically in JSON format.
Create Managed Configuration: In the Google Admin console, navigate to Devices > Chrome > Settings > Android Apps > Managed Configurations.
Select the VPN App: Choose the specific Android VPN app you want to configure.
Add JSON Configuration: Paste the JSON configuration into the provided field. Ensure the configuration is valid and accurate.
Save and Deploy: Save the managed configuration and apply it to the desired organizational units (OUs) containing the ChromeOS devices.
This method allows you to centrally manage VPN configurations for Android apps on ChromeOS devices, ensuring consistency and reducing the manual effort required from users.
C
Explanation:
This is the most efficient and scalable way to automatically configure Android VPN clients on
ChromeOS devices with the correct hostname:
Obtain Configuration: Get the required VPN configuration details (hostname, authentication methods, etc.) from the VPN provider or your organization’s network administrator. This configuration is typically in JSON format.
Create Managed Configuration: In the Google Admin console, navigate to Devices > Chrome > Settings > Android Apps > Managed Configurations.
Select the VPN App: Choose the specific Android VPN app you want to configure.
Add JSON Configuration: Paste the JSON configuration into the provided field. Ensure the configuration is valid and accurate.
Save and Deploy: Save the managed configuration and apply it to the desired organizational units (OUs) containing the ChromeOS devices.
This method allows you to centrally manage VPN configurations for Android apps on ChromeOS devices, ensuring consistency and reducing the manual effort required from users.
Question #18
Your customer is deploying ChromeOS devices in their environment and requires those ChromeOS devices to adhere to web filtering via TLS (or SSL) Inspection.
What recommendations should you make to your customer in setting up the requirements for ChromeOS devices?
- A . Configure a hostname allowlist, set up a TLS (or SSL) certificate, then verify TLS (or SSL) inspection is working
- B . Reach out lo Google Workspace Security and Compliance for tailored configurations for your customer
- C . Configure a transparent proxy, set up your allowlist to use * google com. then verify TLS (or SSL) inspection is working
- D . ChromeOS devices are preconfigured to adhere to company TLS (or SSL) inspection by default and can therefore be deployed with no additional configuration
Correct Answer: A
A
Explanation:
To set up TLS (or SSL) inspection for web filtering on ChromeOS devices, you need to follow these steps:
Configure Hostname Allowlist: Create an allowlist of hostnames (e.g., *.google.com, *[invalid URL removed]) that should bypass TLS inspection. This ensures that essential services like Google services and your own domain can function properly.
Set up TLS Certificate: Obtain the required TLS/SSL certificate from your web filter provider and install it on your web filter. ChromeOS devices need this certificate to establish a secure connection with the web filter for TLS inspection.
Verify TLS Inspection: Once the configuration is in place, test and verify that TLS inspection is working
as expected. This involves checking if the web filter can correctly intercept and decrypt HTTPS traffic
for websites not on the allowlist.
Why other options are not correct:
Option B: While reaching out to Google Workspace Security and Compliance can be helpful, it’s not the primary step in setting up TLS inspection. The configuration needs to be done on the web filter and ChromeOS devices.
Option C: Transparent proxies are generally not recommended for ChromeOS devices as they can interfere with certain functionalities. While it might work with an allowlist for Google domains, it’s not the best practice.
Option D: ChromeOS devices do not come preconfigured to adhere to company TLS inspection. This configuration needs to be set up explicitly by the administrator.
Reference: About TLS (or SSL) inspection on ChromeOS
devices: https://support.google.com/chrome/a/answer/3504942
Verify TLS (or SSL) inspection works: https://support.google.com/chrome/a/answer/3504943
A
Explanation:
To set up TLS (or SSL) inspection for web filtering on ChromeOS devices, you need to follow these steps:
Configure Hostname Allowlist: Create an allowlist of hostnames (e.g., *.google.com, *[invalid URL removed]) that should bypass TLS inspection. This ensures that essential services like Google services and your own domain can function properly.
Set up TLS Certificate: Obtain the required TLS/SSL certificate from your web filter provider and install it on your web filter. ChromeOS devices need this certificate to establish a secure connection with the web filter for TLS inspection.
Verify TLS Inspection: Once the configuration is in place, test and verify that TLS inspection is working
as expected. This involves checking if the web filter can correctly intercept and decrypt HTTPS traffic
for websites not on the allowlist.
Why other options are not correct:
Option B: While reaching out to Google Workspace Security and Compliance can be helpful, it’s not the primary step in setting up TLS inspection. The configuration needs to be done on the web filter and ChromeOS devices.
Option C: Transparent proxies are generally not recommended for ChromeOS devices as they can interfere with certain functionalities. While it might work with an allowlist for Google domains, it’s not the best practice.
Option D: ChromeOS devices do not come preconfigured to adhere to company TLS inspection. This configuration needs to be set up explicitly by the administrator.
Reference: About TLS (or SSL) inspection on ChromeOS
devices: https://support.google.com/chrome/a/answer/3504942
Verify TLS (or SSL) inspection works: https://support.google.com/chrome/a/answer/3504943
Question #19
You have a number of applications that you rely upon. You want to ensure that your applications continue to run smoothly with each new version of Chrome.
What should you do?
- A . Ask users to provide feedback on the applications within a week of a new Chrome release
- B . Advise them to take no action All applications are automatically supported on the latest version of Chrome
- C . Always install the latest version of those applications when they become available so they are always compatible with the latest version of Chrome
- D . Implement a QA strategy and put their IT group and 5% of users on the beta channel of ChromeOS so they can find and report bugs early for upcoming Chrome releases
Correct Answer: D
D
Explanation:
Option D is the most proactive and comprehensive approach to ensure application compatibility with new Chrome versions.
Here’s why:
QA Strategy: Implementing a formal Quality Assurance (QA) process allows for systematic testing of applications on new Chrome versions before they are released to all users. This helps identify and address compatibility issues early on.
Beta Channel Testing: Enrolling a subset of users (e.g., IT group and 5% of users) in the beta channel gives them access to pre-release versions of ChromeOS. This allows them to test applications in a real-world environment and report any bugs or issues before the stable release.
Early Bug Reporting: By identifying and reporting bugs early, you provide developers with valuable feedback and time to fix issues before the official release. This ensures a smoother transition for all
users when the new Chrome version is deployed.
Why other options are incorrect:
A: User feedback is valuable, but it’s reactive and may not catch all issues before they impact a larger user base.
B: Assuming all applications are automatically compatible is risky and can lead to unexpected problems.
C: While keeping applications updated is good practice, it doesn’t guarantee compatibility with new Chrome versions, as changes in Chrome itself can cause issues.
D
Explanation:
Option D is the most proactive and comprehensive approach to ensure application compatibility with new Chrome versions.
Here’s why:
QA Strategy: Implementing a formal Quality Assurance (QA) process allows for systematic testing of applications on new Chrome versions before they are released to all users. This helps identify and address compatibility issues early on.
Beta Channel Testing: Enrolling a subset of users (e.g., IT group and 5% of users) in the beta channel gives them access to pre-release versions of ChromeOS. This allows them to test applications in a real-world environment and report any bugs or issues before the stable release.
Early Bug Reporting: By identifying and reporting bugs early, you provide developers with valuable feedback and time to fix issues before the official release. This ensures a smoother transition for all
users when the new Chrome version is deployed.
Why other options are incorrect:
A: User feedback is valuable, but it’s reactive and may not catch all issues before they impact a larger user base.
B: Assuming all applications are automatically compatible is risky and can lead to unexpected problems.
C: While keeping applications updated is good practice, it doesn’t guarantee compatibility with new Chrome versions, as changes in Chrome itself can cause issues.
Question #20
An admin is setting up third-party SSO for their organization as the super admin. When they test with their account, they do not see the SSO screen.
What is causing this behavior?
- A . SSO settings are misconfigured
- B . The account is in the wrong OrgUnit
- C . Third-party SSO is not enabled
- D . Super admin bypassed the thud-patty
Correct Answer: D
D
Explanation:
Super administrators in Google Workspace have special privileges that allow them to bypass certain security features, including third-party SSO. This is to ensure that they can always access the Admin console for troubleshooting or critical changes, even if the SSO system is malfunctioning. Therefore, when a super admin tests third-party SSO, they won’t be prompted with the SSO login screen, but will directly access the console using their Google credentials.
D
Explanation:
Super administrators in Google Workspace have special privileges that allow them to bypass certain security features, including third-party SSO. This is to ensure that they can always access the Admin console for troubleshooting or critical changes, even if the SSO system is malfunctioning. Therefore, when a super admin tests third-party SSO, they won’t be prompted with the SSO login screen, but will directly access the console using their Google credentials.