How to Configure Granular Vault Access for Audit Roles?

PWA By islever Editorial Last updated Aug 29, 2026

Short answer

D Set up three different Admin roles with specific privileges that match the audit team’s responsibilities. Assign these Admin roles to the respective users.

Question

Your organization has upgraded to a Google Workspace edition with Vault and has hired a new audit team. You are configuring access for this audit team with these privileges: • Chief legal executive - reporting privileges • Legal audit manager - full Vault privileges • Data reviewer - searching privileges. You must enable access for these three roles. What should you do?

Set up Google Vault service as On for these specific users.
Assign Google Vault licenses to these users that allow all privileges required for access.
Set up an Admin role with minimal Vault privileges and assign the role to all Vault users. Approve additional privileges that are requested through a formal approval process.
Set up three different Admin roles with specific privileges that match the audit team’s responsibilities. Assign these Admin roles to the respective users. Correct Answer

Key Takeaways

This question tests your knowledge of Google Workspace RBAC and Vault permission tiers, with the common trap being the assumption that a single license or broad admin role can safely handle all audit responsibilities.

Configuring Google Vault requires implementing role-based access control to assign precise permission levels based on specific job functions. The community unanimously agrees that creating distinct administrative roles for each audit position is the most secure and compliant approach.

Common mistake: Option B is frequently selected because candidates confuse feature licensing with administrative permissions, not realizing that purchasing a Vault license does not automatically grant users the ability to perform searches, generate reports, or manage full Vault settings.

Expert Analysis

Why the Answer Is Correct

Assigning three separate admin roles directly maps to the principle of least privilege, ensuring each auditor only accesses the exact Vault capabilities they require. Google Workspace allows administrators to create custom roles with granular permissions, such as restricting the data reviewer to search-only access while granting the legal audit manager full control. This separation of duties maintains strict compliance standards and simplifies audit trails.

Why the Other Options Are Wrong

Option A incorrectly suggests toggling Vault availability, which only enables or disables the service globally rather than controlling individual user permissions. Option B fails because licenses activate features but do not define administrative access levels, leaving security gaps if broad permissions are applied. Option C proposes a workaround involving manual approvals, which contradicts Google's recommended automated RBAC model and introduces unnecessary operational friction for a fixed audit team structure.

Community Comment Notes

The community overwhelmingly supports option D, emphasizing that role separation is essential for maintaining secure audit environments. As noted in comment [1], creating distinct admin roles aligned with specific responsibilities ensures appropriate access levels without over-provisioning. Comments [2] and [3] reinforce this consensus, confirming that examiners consistently reward answers that demonstrate strict adherence to enterprise security best practices.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always prioritize options that implement the principle of least privilege through granular role assignments rather than broad access grants. When preparing for the PWA exam, memorize the default permission scopes for specialized tools like Vault and remember that licenses never equal administrative rights.

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

apb98 👍 1 Answered D

D. Creating distinct admin roles that match the specific responsibilities and privileges required by each member of the audit team ensures that each user has the appropriate level of access.
mostafa97 👍 1

D IS GOOD
dija123 👍 1 Answered D

D is ok

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to PWA Study Guide