Google Associate Google Workspace Administrator 1-10

The Collaborative Inbox feature of Google Groups lets you assign incoming email to agents as conversations and track their status, so requests can be handled evenly across agents.
Setting posting permissions to “Anyone on the web” allows external customers who are not group members to send email directly to the group.
Delegated access (B) is not suitable as an intake channel for external customers, and a group with only “Public” posting permissions (C) does not include the Collaborative Inbox task-management capabilities.
Distributing the login credentials of a shared account (D) is undesirable from a security standpoint.
Because this can be achieved with existing features alone and incurs no additional cost, it is also highly cost-effective.
Use a group as a Collaborative Inbox – Google Workspace Help

To meet litigation hold requirements, you create a hold in Google Vault.
A hold takes precedence over retention rules and preserves the data of the target users and data sources (Gmail, Drive, Chat, etc.) indefinitely, even if a user performs a delete operation.
Retention rules (C) focus on Gmail and Drive and cannot meet the requirement in terms of preserving Chat or enforcing prevention of deletion.
An Archived User license (B) and exporting the data (D) are also not appropriate, because they do not integrally guarantee both deletion prevention and indefinite preservation.
Create and manage holds – Google Vault Help

An Archived User license costs less than a regular Workspace license and keeps a departed employee’s data retained, searchable, and exportable in Google Vault.
This lets you meet the two-year data retention requirement while keeping costs down.
Deleting the account (A) risks losing the data in Vault, and keeping a full license while suspending the account (B) is more expensive.
Simply moving users to an OU and disabling access (C) still leaves the accounts billable, failing the cost-minimization requirement.
Archive a former employee’s account – Google Workspace Help

Combining a specific OU with a group to enable a service is Google’s recommended, most flexible method of access control.
After turning the service on for the marketing OU, you create a group containing only the web design staff who need access and turn the service on for that group as well.
OU-based control alone makes it difficult to address individual users across departments, and moving users to a sub-OU (C) disrupts the intended organizational structure.
Enabling it at the top level (B) exposes it to users outside the target scope, and using a deny group (A) makes administration cumbersome.
Turn a service on or off – Google Workspace Help

With a Drive data loss prevention (DLP) rule, you can use the predefined credit card number detector to automatically block external sharing of matching files.
By setting the action to “Block external sharing” and also enabling “Log event,” you simultaneously satisfy the requirement to record sharing incidents.
Gmail rules (B) apply to email attachments and do not address preventing sharing within Drive.
A third-party product (C) is an unnecessary option, and automatic deletion (D) does not align with the goal of preventing accidental sharing.
Prevent data leaks with Workspace data loss prevention (DLP) – Google Workspace Help

Email Log Search (ELS) is a core tool that traces the delivery path of email and pinpoints issues such as non-delivery or bounces.
In addition, verifying that the MX (mail exchange) records correctly point to Google’s mail servers lets you efficiently isolate the root cause of undelivered mail.
Checking spam folders (C) and investigating log events (D) are also useful measures, but to identify the root cause of mail not being received, you should first prioritize ELS and MX record verification.
Track messages with Email Log Search – Google Workspace Help

Setting “Access to groups from outside this organization” to “Private” prevents users from joining external Google Groups while leaving internal group usage intact.
This setting blocks only external access and does not affect group operations within the organization, which matches the requirement.
Turning off Google Groups itself (B) also stops internal usage, and making individual changes via the Directory API (C) is operationally cumbersome.
Changing the default viewing permission (D) does not address controlling participation in external groups.
Set organization-wide policies for using groups – Google Workspace Help

The requirement is for a team with only basic coding knowledge to build custom apps in-house, which suits a no-code/low-code development platform.
AppSheet is Google’s no-code development platform that lets you build mobile and web apps based on data sources such as spreadsheets and forms.
Gemini (A) centers on generative-AI assistance and is not intended for building business apps themselves.
Google Forms (B) is limited in functionality, and Apps Script (D) requires coding knowledge, so neither fits the requirement.
Manage AppSheet for your organization – Google Workspace Help

Context-Aware Access is a mechanism that allows or blocks access based on “context” such as the user’s location, device, role, and the app being used.
It best matches the requirement to limit access to only permitted systems based on location and role.
DLP (A) is mainly for controlling data sharing, VPN (B) for protecting the communication path, and two-factor authentication (C) for verifying identity, none of which is itself conditional access control based on location and role.
Overview of Context-Aware Access – Google Workspace Help

The Admin console audit log (the Audit and investigation page) provides detailed information about device and application activity.
You can review, across the board, which devices accessed corporate data and which applications were used, making it the best fit for investigating a data breach.
The Reports section (C) offers only an aggregated overview, and the user accounts section (D) centers on checking individual settings.
For more advanced investigation you can also use the security investigation tool, but for the verification purpose of this question, analyzing the audit log is appropriate.
Run a search on the Audit and investigation page – Google Workspace Help