PCEA Sample Questions & Answers

This policy is used to force-install extensions. The value must include the extension's ID and the URL pointing to its update manifest XML file on the internal server.

This policy must be configured to allowlist the URL of the internal server where the extension's .crx file is hosted. Without this, Chrome will not trust the source and will block the installation, even if it's in the forcelist.

This is true. The Extended Stable channel is designed for enterprises that need more time to manage updates. It receives new features on a slower, 8-week cycle, but critical security fixes are backported and delivered as they become available, typically every 2 weeks, just like the regular Stable channel.

This is the correct and most complete solution. Configuring the device to run as a single-app Kiosk meets the requirements of booting directly into the PWA and preventing users from exiting. Setting the Kiosk app to be the specific PWA ensures it runs fullscreen. The auto-login feature is inherent to Kiosk mode. The requirement for session termination after inactivity is met by configuring the 'Idle session timeout' action within the Kiosk settings, which logs out and restarts the session.

When chrome://policy shows the source as 'Platform', it indicates the policy is being set by the underlying operating system's management framework, which for a domain-joined Windows machine is typically Active Directory Group Policy (GPO). Platform policies (like GPO) have a higher precedence than policies delivered from Chrome Browser Cloud Management ('Cloud'). The administrator must find and remove the conflicting GPO.

Enrollment tokens for Chrome Browser Cloud Management do not have an automatic expiration date. They remain valid and can be used to enroll an unlimited number of browsers until an administrator explicitly revokes the token in the Google Admin console. This is a key security consideration for managing token lifecycle.

The Beta channel provides users with a preview of new features and updates about a month before they are released to the Stable channel. It is updated more frequently than Stable and is the best choice for getting early access to fixes and features, accepting a higher risk of instability. Dev and Canary are even faster but are generally not recommended for broad production use.

The 'User data' policy, when set to 'Erase all local user data', enables ephemeral mode. In this mode, a user can sign in and use the device normally, but their entire local profile (including files, browser history, and settings) is completely wiped from the device upon signing out, ensuring no data is left behind for the next user.

The core of the Advanced Protection Program is the enforcement of phishing-resistant authentication, which requires the use of physical or phone-based security keys.

To prevent malicious code, the program restricts app installations to a curated list from whitelisted stores, primarily the Chrome Web Store and platform-native stores.

The program significantly limits which third-party applications can request access to sensitive user data like Gmail and Drive, blocking most except for a few trusted apps.

The RestrictSigninToPattern policy is the ideal solution. It allows users to sign into web services like Gmail but restricts the primary browser sign-in (which controls sync) to accounts matching a specific pattern (the corporate domain). This prevents browser data like history, bookmarks, and passwords from being synced to a personal @gmail.com account, while not blocking access to Google services.