PCOA Sample Questions & Answers

Requesting device logs is the most effective first step for diagnosis. The logs, specifically the chrome_user_log, contain detailed information about system performance, disk usage statistics, and potential errors from applications or extensions that might be consuming excessive space (e.g., through caching). This allows the admin to identify the root cause without wiping the user's profile.

This is true. Deprovisioning a device removes it from management and returns its Chrome Enterprise Upgrade (or Education/Nonprofit Upgrade) license to the available pool. This allows the license to be reused for a new or different device. This is the standard procedure for retiring or replacing hardware.

While ChromeOS Flex benefits from many ChromeOS security features like sandboxing and read-only OS, it cannot implement the full Verified Boot process. This is because Verified Boot on native ChromeOS devices relies on firmware and the Google Security Chip (or equivalent TPM integration), which are not present on the diverse range of third-party hardware that Flex runs on. The bootloader of the original device remains unlocked.

Policies in the Google Admin console are inherited from parent OUs to child OUs. However, a policy set on a child OU will always override the setting inherited from its parent. In this case, the only way for Marketing users to have camera access is if the policy was specifically changed from 'Inherit' to 'Allow' (or the equivalent setting) directly on their OU.

Zero-Touch Enrollment is a partnership between the customer, Google, and the device reseller/OEM. The administrator generates the token, which acts as an authorization key, and provides it to the partner. The partner then uploads a list of the device hardware IDs to Google's database and associates them with the customer's domain using the token. This flags the devices for automatic enrollment.

This option correctly addresses all requirements. Single-App Kiosk mode locks the kiosk devices to the specified web app. The inactivity timeout handles data wiping. For the POS devices, force-installing the Android app while blocking all others prevents unauthorized installations. Blocking external storage and configuring the specific WPA2-Enterprise network with a device certificate (implied by EAP-TLS) meets the security and connectivity needs.

This follows the principle of least privilege. Creating a custom admin role allows the administrator to grant only the specific permissions required for the help desk's job function (e.g., Reboot, Clear Profile, Get Logs) without granting more powerful and potentially destructive permissions like Wipe Device (Reset) or the ability to modify policies. Built-in roles are often too broad for such specific needs.

Context-Aware Access is a Google Workspace feature that allows administrators to create granular access control policies for apps based on user identity and context, such as location (IP address), device security status, and OS. To meet this requirement, an administrator would create an access level based on the corporate IP address range and then apply a policy that requires this access level for logging into ChromeOS.

This policy directly controls whether users can enable and use the Linux development environment (Crostini) on their ChromeOS devices. If disallowed, the option will be blocked.

Sideloading is the process of installing an Android application from an APK file instead of the Google Play Store. This is essential for developers testing their own apps. If this policy is disallowed, the developer will be blocked from installing their test APK.

Navigating to chrome://policy in the Chrome browser on a device provides a detailed view of all policies currently in effect for that session. It shows the policy name, its source (e.g., from the cloud), its value, and whether it applies at the machine or user level. It is an essential local troubleshooting tool for verifying policy application.