2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free Google Associate Google Workspace Administrator Practice Questions

27 free Google Associate Google Workspace Administrator practice questions from the CertStash pack of 108, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 27 free here, all 108 in the pack, and each step includes the one before it.

Get all 108 questions (US$39) · Download the first 10 as a PDF

Question 1

The current data storage limit for the sales organizational unit (OU) at your company is set at 10GB per user. A subset of sales representatives in that OU need 100GB of storage across shared services. You need to increase the storage for only the subset of sales representatives by using the least disruptive approach and the fewest configuration steps. What should you do?

  1. Move the subset of users to a sub-OU, and assign a 100GB storage limit to that sub-OU.
  2. Instruct the subset of users to store their documents in a Shared Drive with a 100GB limit.
  3. Change the storage limit of the sales OU to 100GB.
  4. Create a configuration group, and add the subset of users to that group. Set the group storage limit to 100GB.
Show answer and explanation

Correct answer: D. Create a configuration group, and add the subset of users to that group. Set the group storage limit to 100GB.

Google Workspace lets you apply storage limits to configuration groups as well as to organisational units. Adding the subset of sales representatives to a group and setting a 100GB limit on it changes only their quota, without moving users or altering the OU structure.

Why the other options are wrong

  • A. Moving users into a new sub-OU is more disruptive, since other OU-based policies and settings may change for them.
  • B. Shared drive storage counts against the organisation's pool and does not raise the users' own storage limit.
  • C. Raising the whole sales OU to 100GB would increase storage for every user in it, not just the subset.

Question 2

Your company’s security team should be able to investigate unauthorized external file sharing. You need to ensure that the security team can use the security investigation tool and you must follow the principle of least privilege. What should you do?

  1. Grant the super admin role to a delegate from the security team.
  2. Create a pre-built reporting role. Assign the role to the security team alias.
  3. Share the Drive audit log with the security team.
  4. Create a custom admin role with security center privileges. Assign the role to the individual security team members.
Show answer and explanation

Correct answer: D. Create a custom admin role with security center privileges. Assign the role to the individual security team members.

Creating a custom admin role with specific security center privileges and assigning it to individual security team members follows the principle of least privilege by granting only the necessary permissions for investigation work. This approach avoids over-privileging the team with a super admin role and provides targeted access to security investigation tools without unnecessary capabilities.

Why the other options are wrong

  • A. Granting super admin role provides far more access than needed and violates the principle of least privilege.
  • B. Pre-built reporting roles typically provide read-only reporting access and may not include the interactive security investigation tool capabilities required.
  • C. Sharing audit logs alone does not grant access to the security investigation tool itself, which requires specific admin privileges.

Question 3

Users at your company are reporting that they are not receiving some emails in their corporate Gmail account. You have checked the Google Workspace Status Dashboard and you found no service disruptions. You need to identify the root cause of the problem and resolve the mail delivery issues. What should you do? (Choose two.)

  1. Use Email Log Search (ELS) to identify specific delivery failures.
  2. Verify whether the organization’s Mail Exchange (MX) records are correctly configured.
  3. Check the users’ spam folders to determine whether emails are being misdirected.
  4. Investigate the Gmail log events for error messages or unusual patterns.
  5. Check the senders’ IP addresses in the inbound mail gateway.
Show answer and explanation

Correct answer: A, B. Use Email Log Search (ELS) to identify specific delivery failures; Verify whether the organization’s Mail Exchange (MX) records are correctly configured.

Email Log Search identifies specific delivery failures and bounce reasons, providing direct evidence of mail delivery problems. Verifying MX records ensures the organization's mail server routing is correctly configured for external mail reception. Together, these two diagnostic tools address both the Google Workspace side (ELS) and the infrastructure configuration side (MX records) needed to identify root causes of missing emails.

Why the other options are wrong

  • C. Checking spam folders diagnoses user-side filtering issues but does not identify systemic delivery failures at the server level.
  • D. Gmail log events may not contain the same detailed mail delivery failure information as Email Log Search, which is specifically designed for this purpose.
  • E. Checking sender IP addresses at the inbound gateway is reactive troubleshooting for potential blocks but not a primary diagnostic step when the Status Dashboard shows no disruptions.

Question 4

You are designing a group structure for your company that will be used to grant access to a specific shared drive. You need this solution to automatically add and remove employees based on their job role. What should you do?

  1. Create a security group. Add all employees with the desired job role. Grant the security group access to the shared drive.
  2. Create a distribution list. Add all employees with the desired job role. Grant the distribution list access to the shared drive.
  3. Create a dynamic group. Set the membership criteria to the desired job role. Grant the dynamic group access to the shared drive.
  4. Create a configuration group. Add users on an exception basis. Grant the configuration group access to the shared drive.
Show answer and explanation

Correct answer: C. Create a dynamic group. Set the membership criteria to the desired job role. Grant the dynamic group access to the shared drive.

Dynamic groups automatically add and remove members based on configured criteria such as job role, eliminating the need for manual membership management. When organizational data changes, such as when an employee changes roles, the dynamic group membership updates automatically, ensuring consistent access control without administrative intervention.

Why the other options are wrong

  • A. Security groups require manual addition and removal of members, which does not automate the process based on job role changes.
  • B. Distribution lists are designed for email communication, not access control, and still require manual membership updates.
  • D. Configuration groups require manual exception-based management and do not provide automatic membership based on job role criteria.

Question 5

An executive at your organization asked you to give their executive administrator access to their Workspace account. You need to ensure that this executive administrator can manage emails in the executive’s account. You need to maintain security and privacy of the executive’s account. What should you do?

  1. Assist the executive in setting up email forwarding to their executive administrator.
  2. Instruct the executive to share their password with their executive administrator.
  3. Create a Google Group, and add all executive administrators. Enable delegated access to the Group.
  4. Grant delegated access to the executive’s Gmail account, and assign access to their executive administrator in Gmail settings.
Show answer and explanation

Correct answer: D. Grant delegated access to the executive’s Gmail account, and assign access to their executive administrator in Gmail settings.

Delegated access in Gmail settings allows the executive administrator to manage the executive's emails securely without requiring password sharing. This feature provides controlled access within Google Workspace's security framework, maintaining account security and privacy by avoiding credential sharing while enabling the necessary administrative functions.

Why the other options are wrong

  • A. Email forwarding does not allow the administrator to manage emails in the executive's account; it only sends copies elsewhere.
  • B. Sharing passwords is a critical security violation that compromises account integrity and audit trails.
  • C. Google Groups with delegated access is not the correct mechanism for individual Gmail account delegation; delegation is configured directly in Gmail settings.

Question 6

Your organization is concerned about unauthorized access attempts. You want to implement a security measure that makes users change their password if there are twenty or more failed login attempts within one hour. You want to use the most effective and efficient approach. What should you do?

  1. Set up a Chrome action rule to restrict users from defined ChromeOS actions after twenty failed password attempts.
  2. Create an activity rule for user log events, define a time period and threshold, and select an Action for the rule to force a password change.
  3. Create an activity rule for live-state data sources that meets the required time period and threshold to identify users who need to change their password.
  4. Enable email alerts to notify users that they need to change their password.
Show answer and explanation

Correct answer: B. Create an activity rule for user log events, define a time period and threshold, and select an Action for the rule to force a password change.

Activity rules for user log events allow you to define a specific time period (one hour) and threshold (20+ failed login attempts), then trigger an automatic action (force password change). This is the most direct and efficient approach for this security requirement in Google Workspace administration.

Why the other options are wrong

  • A. Chrome action rules control ChromeOS device actions, not password policy enforcement.
  • C. Live-state data sources monitor current device/account state but are not designed to trigger password changes based on login attempt thresholds.
  • D. Email alerts are reactive and don't automatically enforce the password change requirement.

Question 7

An employee using a Workspace Enterprise Standard license was terminated from your organization. You need to ensure that the former employee no longer has access to their Workspace account and preserve access to the former employee’s documents for the manager and the team. You want to minimize license cost. What should you do?

  1. Delete the former employee’s Workspace account.
  2. Suspend former employee’s Workspace account.
  3. Reset the password of the former employee and keep their Workspace license active.
  4. Switch the license type of the former employee’s Workspace account to an Archived User license.
Show answer and explanation

Correct answer: D. Switch the license type of the former employee’s Workspace account to an Archived User license.

Converting the former employee's license to an Archived User license prevents account access while preserving document access for managers and the team at the lowest cost. Archived User licenses are significantly cheaper than standard licenses, meeting the cost minimization requirement.

Why the other options are wrong

  • A. Deleting the account removes access to the former employee's documents, preventing the team from accessing them.
  • B. Suspending keeps the Enterprise Standard license active, which costs more than an Archived User license.
  • C. Keeping an active Enterprise Standard license is costly and doesn't prevent access.

Question 8

Your organization's employees frequently collaborate with external clients and vendors by using Google Meet. There are active instances of unsupervised meetings within your organization that do not have a host, and unsupervised meetings that continue after an event has completed. You want to end all meetings that are being used inappropriately as quickly as possible. What should you do?

  1. End all unsupervised meetings by using the Google Meet APIs.
  2. Enable Host Management for Google Meet, and train internal host employees how to end meetings for everyone.
  3. Turn off Google Meet in the Admin console for your organization. Turn Google Meet back on after two minutes.
  4. Identify and end all unsupervised meetings by using the security investigation tool.
Show answer and explanation

Correct answer: D. Identify and end all unsupervised meetings by using the security investigation tool.

The security investigation tool allows administrators to identify and end unsupervised meetings directly, providing immediate action on inappropriate meeting activity. This is the quickest way to address ongoing misuse without disrupting legitimate services or requiring training.

Why the other options are wrong

  • A. Using Google Meet APIs requires development work and is more complex than using built-in security tools.
  • B. Host Management requires training and relies on employees to enforce policies, which is slower than direct administrative intervention.
  • C. Turning off Meet entirely is excessive and disrupts legitimate collaboration, and the two-minute window doesn't address the current unsupervised meetings.

Question 9

Your organization uses live-streaming to host large Google Meet meetings. You need to limit the participation to affiliated Google Workspace domains by using the Admin console. What should you do?

  1. Add the Trusted Workspace domain names in the Stream dialog box.
  2. Turn off live streaming to Youtube.
  3. Add participants to an organizational unit (OU). Turn on live streaming.
  4. Turn on in-house live streaming. Invite users from affiliated domains.
Show answer and explanation

Correct answer: A. Add the Trusted Workspace domain names in the Stream dialog box.

Adding trusted Workspace domain names in the Stream dialog box is the Admin console method to limit live-streaming participation to affiliated domains only. This setting controls who can access live streams from your organization.

Why the other options are wrong

  • B. Turning off YouTube live streaming removes the capability entirely rather than restricting it to affiliated domains.
  • C. Adding participants to an OU does not restrict live-stream access to specific domains.
  • D. Manually inviting users is not a scalable configuration method and doesn't use the Admin console controls.

Question 10

You are configuring email for your company’s Google Workspace account. The company wants to prevent certain types of files from being sent or received as email attachments in the simplest and most cost-effective way. What should you do?

  1. Adjust the maximum message size limit to prevent large files from being sent or received.
  2. Enable the Security Sandbox in Gmail to automatically quarantine emails with suspicious attachments.
  3. Scan all incoming and outgoing emails for malicious attachments by using an industry standard third-party email security solution.
  4. Configure an attachment compliance rule in Gmail settings to block specific file types.
Show answer and explanation

Correct answer: D. Configure an attachment compliance rule in Gmail settings to block specific file types.

Configuring an attachment compliance rule in Gmail settings is the simplest and most cost-effective native solution to block specific file types from being sent or received. This is built into Google Workspace and requires no additional tools or expenses.

Why the other options are wrong

  • A. Maximum message size limits prevent large files but don't block specific file types like executables or scripts.
  • B. Security Sandbox quarantines suspicious attachments but doesn't proactively block specific file types by policy.
  • C. Third-party email security solutions add cost and complexity beyond what is needed for simple file-type blocking.

What people say about the full Associate Google Workspace Administrator pack 5.0 from 2

Cert Stash sent an update for the Google Workspace Admin guide right after the syllabus changed. That quick heads-up gave me confidence I was studying the latest version and not missing any new exam objectives.
JMaddoxAssociate Google Workspace Administrator
I had a limited amount of time but these dumps offered quick and effective preparation. The content helped me concentrate on the most important aspects and was straightforward. wasted no time in passing!
Domenic EatonAssociate Google Workspace Administrator

Question 11

You work at a large organization that prohibits employees from using Google Sites. However, a task force comprised of three people from five different departments has recently been formed to work on a project assigned by the Office of the CIO. You need to allow the users in this task force to temporarily use Google Sites. You want to use the least disruptive and most efficient approach. What should you do?

  1. Turn Google Sites access on for each of the 15 users in the task force.
  2. Create a configuration group for the task force’s 15 users. Grant Google Sites access to the group.
  3. Place the 15 task force users into a new organizational unit (OU). Turn on Google Sites access for the OU.
  4. Create an access group for the task force’s 15 users. Grant Google Sites access to the group.
Show answer and explanation

Correct answer: B. Create a configuration group for the task force’s 15 users. Grant Google Sites access to the group.

Creating a configuration group for the task force is the most efficient and least disruptive approach. A configuration group allows centralized management of the 15 users' Google Sites access without affecting any other users or requiring organizational structure changes. When the task force completes its work, the group can simply be deleted or modified, removing access cleanly. Option A requires individual management of 15 users. Option C requires creating a new OU, which introduces organizational complexity and affects all policies applied to that OU. Option D references an access group which is not a standard Google Workspace concept for this purpose.

Why the other options are wrong

  • A. Managing 15 individual user accounts is inefficient and difficult to track or remove access from when the task force ends.
  • C. Creating a new OU is disruptive because it applies all OU-level policies to the 15 users, potentially affecting more than just Google Sites access.
  • D. Access groups are not the standard mechanism in Google Workspace for controlling application access; configuration groups serve this purpose.

Question 12

Your organization is about to conduct its biannual risk assessment. You need to help identify security risks by quickly reviewing all security settings for Gmail, Drive, and Calendar. What should you do?

  1. In the reporting section of the Admin console, review the Gmail, Drive, and Calendar reports.
  2. In the alert center, review all of the alerts.
  3. In each individual organizational unit (OU), review the security settings.
  4. In the Google Admin console, review the security health page.
Show answer and explanation

Correct answer: D. In the Google Admin console, review the security health page.

The Security Health page in the Google Admin console is specifically designed to provide a comprehensive overview of security settings across Gmail, Drive, Calendar, and other services in a single view. This is the fastest and most efficient way to review all security settings for a biannual risk assessment. Option A uses reports which show usage data rather than security configuration. Option B reviews alerts which are reactive rather than proactive assessment. Option C requires checking each OU individually, which is inefficient.

Why the other options are wrong

  • A. Reporting sections show usage and activity data, not security settings or configurations.
  • B. Alert Center shows triggered alerts, not a comprehensive security settings review needed for risk assessment.
  • C. Reviewing each OU individually is inefficient and does not provide a centralized security overview.

Question 13

Your organization acquired a small agency. You need to create user accounts for these new employees. The new users must be able to use their new organization’s email address and their email address with the sub-agency domain name. What should you do?

  1. Redirect the acquired domain to Google’s MX records and add the account as a “send as” address.
  2. Set up the acquired agency as a secondary domain from the Manage domains page.
  3. Set up the acquired agency as a user alias domain from the Manage domains page.
  4. Set up the acquired agency as a secondary domain and swap it to the primary domain.
Show answer and explanation

Correct answer: C. Set up the acquired agency as a user alias domain from the Manage domains page.

An alias domain allows users to have email addresses on both the primary organization domain and the sub-agency domain simultaneously. This enables new employees to use both their new organization email and their sub-agency domain email address without requiring multiple accounts.

Why the other options are wrong

  • A. Redirecting MX records and using send-as addresses allows sending from another domain but doesn't create native addresses on the acquired domain.
  • B. A secondary domain requires users to have separate accounts or manually manage multiple identities, not unified dual addressing.
  • D. Swapping the primary domain would disrupt the original organization's email service, which is not the requirement.

Question 14

Your organization requires enhanced privacy and security when sending messages to banks and other financial institutions. Your organization uses Gmail, but the banks use various other email providers. You need to maximize privacy and limit access to messages sent and received between your organization and the banks. What should you do?

  1. Set up Transport Layer Security (TLS) compliance for inbound and outbound messages with a list of the banks’ email domains. Validate the TLS connections.
  2. Configure Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) authentication for your email domains.
  3. Enable Protect against unauthenticated emails in Gmail Safety.
  4. Enable confidential mode for Gmail. Instruct employees to use confidential mode when sending messages to the banks.
Show answer and explanation

Correct answer: A. Set up Transport Layer Security (TLS) compliance for inbound and outbound messages with a list of the banks’ email domains. Validate the TLS connections.

Transport Layer Security (TLS) compliance settings ensure that messages to and from specific financial institutions are encrypted in transit and that connections are validated. This provides the maximum privacy and security for communications with banks by enforcing encrypted connections and validating that the receiving mail servers use legitimate TLS certificates. Setting this specifically for the banks' email domains maximizes protection while limiting access to those critical communications.

Why the other options are wrong

  • B. SPF and DKIM authenticate messages but do not provide the message-level encryption needed for privacy.
  • C. Gmail Safety settings protect against unauthenticated emails but do not provide the same level of encryption and validation as TLS enforcement.
  • D. Confidential mode is useful but relies on individual user behavior and does not enforce organization-wide encrypted transport.

Question 15

You are managing the buildings and resources for your organization. You need to create several conference rooms with a capacity of 10 people each, equipped with a whiteboard and projector, and wheelchair accessible. You want to ensure the process is efficient. What should you do?

  1. Automate room creation by using a third-party app from the Google Workspace Marketplace.
  2. Create a CSV file and add all resources. Write a script using the Workspace API to reference the CSV file and create all the resources.
  3. Create each conference room individually in the Google Admin console. Add the features for each room.
  4. Use the Google Admin console to bulk upload the rooms. Create a resource with the specified features and apply the features to that resource.
Show answer and explanation

Correct answer: D. Use the Google Admin console to bulk upload the rooms. Create a resource with the specified features and apply the features to that resource.

Using the Google Admin console bulk upload feature is the most efficient built-in method for creating multiple conference rooms with the same features. You create a resource definition with all required features (capacity 10, whiteboard, projector, wheelchair accessible) once, then bulk upload a CSV file that applies these features to multiple rooms simultaneously. This is faster and more maintainable than scripting. Option A relies on third-party apps that may lack full integration. Option B requires custom scripting which is more complex than the native bulk upload feature. Option C requires manual individual creation, which is inefficient.

Why the other options are wrong

  • A. Third-party marketplace apps add external dependencies and may not have complete feature parity with native admin console capabilities.
  • B. Custom scripting via API is more complex and requires maintenance compared to the native bulk upload feature in the Admin console.
  • C. Individual room creation in the console is manually intensive and impractical for several rooms with identical features.

Question 16

Your organization is implementing a new customer support process that uses Gmail. You need to create a cost-effective solution that allows external customers to send support request emails to the customer support team. The requests must be evenly distributed among the customer support agents. What should you do?

  1. Create a Google Group, enable collaborative inbox settings, set posting permissions to “Anyone on the web”, and add the customer support agents as group members.
  2. Use delegated access for a specific email address that represents the customer support group, and add the customer support team as delegates for that email address.
  3. Create a Google Group, add the support agents to the group, and set the posting permissions to “Public.”
  4. Set up an inbox for the customer support team. Provide the login credentials to the customer support team.
Show answer and explanation

Correct answer: A. Create a Google Group, enable collaborative inbox settings, set posting permissions to “Anyone on the web”, and add the customer support agents as group members.

A Google Group with collaborative inbox settings allows external customers to send emails to a shared address, and the collaborative inbox feature automatically distributes incoming messages evenly among the support agents listed as members. Posting permissions set to 'Anyone on the web' enables external customer email submission. This is cost-effective and provides exactly the load-balancing behavior required. Option B requires manual delegation setup and doesn't provide automatic distribution. Option C uses public posting but lacks the collaborative inbox distribution mechanism. Option D requires sharing login credentials, which is a security risk.

Why the other options are wrong

  • B. Delegated access requires manual message handling and doesn't automatically distribute requests evenly among agents.
  • C. While public groups allow external posting, this option doesn't mention collaborative inbox settings needed for even distribution of messages.
  • D. Sharing login credentials is a security risk and makes it impossible to track which agent handled which request or maintain individual accountability.

Question 17

External sharing at your company is only permitted for the sales and marketing department. Engineering is not allowed to share externally. You need to configure the sharing settings to comply with this policy. What should you do?

  1. Use a data loss prevention (DLP) solution to control external sharing based on user groups.
  2. Create separate shared drives for each department with different external sharing settings.
  3. Create organizational units (OUs) for each department. Configure different external sharing settings for each OU.
  4. Configure Drive trust rules to restrict the engineering department from sharing externally.
Show answer and explanation

Correct answer: C. Create organizational units (OUs) for each department. Configure different external sharing settings for each OU.

Creating organizational units for each department and configuring different external sharing settings per OU is the standard Google Workspace approach for department-level policy differentiation. This allows the sales and marketing OU to have external sharing enabled while the engineering OU has it disabled, directly implementing the business policy. Option A uses DLP which is designed for content-based rules rather than role-based access control. Option B with separate shared drives creates management overhead without leveraging OU-level policy controls. Option D references trust rules which do not exist as a native Google feature.

Why the other options are wrong

  • A. DLP solutions control content-based sharing rules, not user group membership-based access permissions.
  • B. While separate shared drives could work, managing policies through OUs is more efficient and leverages native admin controls.
  • D. Drive trust rules are not a standard Google Workspace feature for controlling external sharing permissions by department.

Question 18

Your organization has enabled Google Groups for Business to let employees create and manage their own email distribution lists and web forums. You need to ensure that users cannot join external Google Groups with their Google Workspace accounts without interrupting internal group usage. What should you do?

  1. Set the setting for Google Groups for Business called Accessing groups from outside this organization to Private.
  2. In Additional Google Services, turn Google Groups OFF at the root organizational unit.
  3. Use the Directory API to change the settings of user-created groups to disable features that allow external users to access, view, or post on groups.
  4. Set the setting for Google Groups for Business called Default for permission to view conversations to All organization users.
Show answer and explanation

Correct answer: A. Set the setting for Google Groups for Business called Accessing groups from outside this organization to Private.

The 'Accessing groups from outside this organization' setting controls whether Google Workspace users can join external Google Groups. Setting this to Private prevents users from accessing groups outside the organization while still allowing them to create and use internal Google Groups for Business. This directly addresses the requirement to restrict external group participation without disrupting internal group usage. Option B disables Google Groups entirely, eliminating internal usage. Option C using Directory API is overly complex for a simple policy setting. Option D controls conversation visibility, not external group access.

Why the other options are wrong

  • B. Turning off Google Groups entirely eliminates all employee group functionality, disrupting internal group usage.
  • C. Using the Directory API to individually modify user-created groups is unnecessarily complex when an organizational policy setting exists.
  • D. The conversation visibility setting controls who can view existing group conversations, not whether users can join external groups.

Question 19

Your compliance team has observed that employees at your organization are frequently resetting their passwords and is concerned about account hijacking. You need to create a solution to notify the compliance team whenever a user updates or resets their password. What should you do?

  1. Create and enforce a new password policy for all users in your organization.
  2. Move all compliance team members into a separate organizational unit (OU). Create and enforce a new password policy for the members of this OU.
  3. Create an activity rule that is triggered by the User’s password changed event. Add compliance team members as email recipients.
  4. Create a new alert by using user log events. Check that the challenge type is “Password”, and add the compliance team as email recipients.
Show answer and explanation

Correct answer: C. Create an activity rule that is triggered by the User’s password changed event. Add compliance team members as email recipients.

Option C is correct because Google Workspace provides activity rules that can be triggered by specific user events, including password changes. Creating an activity rule triggered by 'User's password changed' event and adding compliance team members as email recipients will automatically notify them whenever a password is updated or reset, enabling real-time account security monitoring.

Why the other options are wrong

  • A. A general password policy addresses password strength but does not create notifications for password changes.
  • B. Moving users to a separate OU and creating policies there does not generate notifications about password changes.
  • D. User log events with 'Password' challenge type are for authentication attempts, not for password reset/change events.

Question 20

You work for a healthcare provider that uses an external medical billing company to manage patient records and invoices. Your organization’s employees need to share patient documents with the billing company’s employees for processing. You need to configure access so the medical billing company’s employees can view and edit the documents, but they cannot delete the documents. What should you do?

  1. Create a shared drive that is managed by your organization’s employees. Grant Contributor access to the billing company’s staff.
  2. Create a shared drive. Grant Content Manager access to your organization’s employees and the billing company.
  3. Create a group, and add the employees from your organization and the billing company. Create a shared folder on Google Drive. Grant Editor access to the group
  4. Restrict access for the medical billing company’s employees by using Data Loss Prevention (DLP) policies.
Show answer and explanation

Correct answer: A. Create a shared drive that is managed by your organization’s employees. Grant Contributor access to the billing company’s staff.

Option A is correct because Contributor access in Google Workspace allows users to view and edit documents but prevents them from deleting items or changing sharing settings. Creating a shared drive managed by the organization ensures proper governance, while granting Contributor access to the external billing company's employees provides the exact permission level needed: view and edit without delete capability.

Why the other options are wrong

  • B. Content Manager access would allow deletion of documents, which violates the requirement.
  • C. Editor access would also allow deletion of documents, which violates the requirement.
  • D. DLP policies are for preventing data loss through external sharing, not for managing granular file-level permissions like preventing deletion.

Question 21

The legal department at your organization is working on a time-critical merger and acquisition (M&A) deal. They urgently require access to specific email communications from an employee who is currently on leave. The organization’s current retention policy is set to indefinite. You need to retrieve the required emails for the legal department in a manner that ensures data privacy. What should you do?

  1. Instruct the IT department to directly access and forward the relevant emails to the legal department.
  2. Temporarily grant the legal department access to the employee’s email account with a restricted scope that is limited to the M&A-related emails.
  3. Ask a colleague with delegate access to the employee's mailbox to identify and forward the relevant emails to the legal department.
  4. Use Google Vault to create a matter specific to the M&A deal. Search for relevant emails within the employee's mailbox. Export and share relevant emails with your legal department.
Show answer and explanation

Correct answer: D. Use Google Vault to create a matter specific to the M&A deal. Search for relevant emails within the employee's mailbox. Export and share relevant emails with your legal department.

Google Vault provides the proper legal and privacy-preserving mechanism for this situation. Creating a matter for the M&A deal, searching the employee's mailbox for relevant communications, and exporting results ensures proper chain of custody, audit trails, and data governance. This approach protects both the employee's privacy and the organization's legal interests far better than direct account access.

Why the other options are wrong

  • A. Direct IT access to forward emails bypasses proper data governance and audit controls, creating legal liability.
  • B. Temporarily granting direct account access is unnecessary and creates privacy and security risks when Vault provides proper controls.
  • C. Using delegate access bypasses audit trails and proper discovery procedures, compromising legal defensibility.

Question 22

A team of temporary employees left your organization after completing a shared project. Per company policy, you need to disable their Google Workspace accounts while preserving all project data and related communications in Google Vault for a minimum of two years. You want to comply with this policy while minimizing cost. What should you do?

  1. Purchase and assign Archived User licenses to the former employees.
  2. Transfer the former employees’ files and data to active user accounts. Delete the former employees’ Workspace accounts.
  3. Purchase additional user licenses and suspend the former employees’ accounts.
  4. Move the former employees to their own organizational unit (OU) and disable access to Google services for that OU.
Show answer and explanation

Correct answer: A. Purchase and assign Archived User licenses to the former employees.

Archived User licenses are specifically designed for this scenario: they disable active services while preserving data for legal discovery and compliance at a lower cost than regular licenses. The data remains accessible in Google Vault for the required two-year retention period while account access is effectively disabled, meeting both the policy requirement and cost minimization goal.

Why the other options are wrong

  • B. Deleting accounts risks data loss and violates the retention requirement regardless of prior file transfer.
  • C. Suspending accounts still requires full user licenses, not providing cost savings.
  • D. Disabling OU access does not disable individual accounts or preserve data in a discoverable manner for Vault.

Question 23

You are migrating your organization’s email to Google Workspace. Your organization uses the terramearth.com email domain. You need to configure Google Workspace to receive emails sent to terramearth.com. What should you do?

  1. Add terramearth.com as a primary, secondary, or alias domain in Google Workspace. Update the Mail Exchange (MX) records with your domain registrar to direct mail flow to Google’s mail servers.
  2. Establish a Transport Layer Security (TLS) connection between your company’s existing mail servers and Google’s mail servers
  3. Configure an email address in Google Workspace to capture emails sent to unverified domains, including terramearth.com.
  4. Create a domain alias for terramearth.com in Google Workspace. Configure email forwarding to redirect emails to the new Google Workspace accounts.
Show answer and explanation

Correct answer: A. Add terramearth.com as a primary, secondary, or alias domain in Google Workspace. Update the Mail Exchange (MX) records with your domain registrar to direct mail flow to Google’s mail servers.

Option A is correct because to receive emails at terramearth.com in Google Workspace, you must first add the domain as a primary, secondary, or alias domain in Google Workspace, then update the Mail Exchange (MX) records at your domain registrar to point to Google's mail servers. This is the standard and complete process for domain email routing configuration.

Why the other options are wrong

  • B. TLS connections are for securing existing mail server communication, not for initial email routing setup.
  • C. Unverified domains cannot receive email; domains must be verified and added to Google Workspace.
  • D. Domain aliases and email forwarding are workarounds that do not properly route mail to Google Workspace; the correct approach is to update MX records.

Question 24

Your organization has hired temporary employees to work on a sensitive internal project. You need to ensure that the sensitive project data in Google Drive is limited to only internal domain sharing. You do not want to be overly restrictive. What should you do?

  1. Configure the Drive sharing options for the domain to internal only.
  2. Restrict the Drive sharing options for the domain to allowlisted domains.
  3. Create a Drive DLP rule, and use the sensitive internal Project name as the detector.
  4. Turn off the Drive sharing setting from the Team dashboard.
Show answer and explanation

Correct answer: A. Configure the Drive sharing options for the domain to internal only.

Configuring Drive sharing options to restrict sharing to internal domain only directly addresses the requirement to limit sensitive project data to internal sharing. This setting is straightforward, organization-wide, and appropriate for sensitive projects without being overly restrictive to legitimate internal collaboration.

Why the other options are wrong

  • B. Allowlisting specific domains adds unnecessary complexity when internal-only sharing meets the stated requirement.
  • C. DLP rules are more granular controls typically applied to specific content types; a sharing restriction is simpler and more appropriate here.
  • D. Turning off Drive sharing entirely is too restrictive and prevents legitimate internal collaboration.

Question 25

You manage Chrome Enterprise browsers for your large organization. You want to ensure that specific extensions are automatically installed on all managed Chrome Enterprise browsers. What should you do?

  1. Allowlist the specific Chrome browser extensions.
  2. Configure a script to deploy the extensions upon user login.
  3. Publish the extensions in the Chrome Web Store.
  4. Force-install the extensions through Chrome browser policies.
Show answer and explanation

Correct answer: D. Force-install the extensions through Chrome browser policies.

Chrome browser policies provide a native mechanism to force-install specified extensions automatically on all managed Chrome Enterprise browsers organization-wide. This ensures consistent deployment without user intervention or choice. Option A allowlisting only permits extensions but doesn't automatically install them. Option B using login scripts is manual and not the native Chrome management approach. Option C publishing to the Web Store doesn't enforce installation on managed devices.

Why the other options are wrong

  • A. Allowlisting permits extensions but does not automatically deploy or install them on browsers.
  • B. Login scripts require custom development, maintenance, and don't leverage Chrome's native management capabilities.
  • C. Publishing to the Web Store makes extensions available but doesn't force installation on managed devices or ensure consistent deployment.

25 questions in. Want the rest? The first half of the pack, free by email · The full pack

Question 26

Today your company signed up for Google Workspace Business Starter with an existing domain name. You want to add team members and manage their access to email and other services. However, you are unable to create new user accounts or change user settings. You need to fix this problem. What should you do?

  1. Run the Transfer tool to bring unmanaged users to your Workspace account.
  2. Check domain ownership in the DNS settings.
  3. Wait 24 hours after signing up for the features to become active.
  4. Upgrade to a Google Workspace Enterprise edition.
Show answer and explanation

Correct answer: B. Check domain ownership in the DNS settings.

Inability to create user accounts after signing up for Google Workspace typically indicates the domain ownership has not been verified in DNS settings. Verifying domain ownership through DNS records is a prerequisite before admin controls for user management become available. This is the first troubleshooting step when account creation fails.

Why the other options are wrong

  • A. The Transfer tool is for migrating unmanaged users, not for resolving account creation restrictions.
  • C. While some features may require a brief wait, 24 hours is not the standard issue; domain verification is the root cause.
  • D. Upgrading editions does not resolve domain verification problems; the issue exists regardless of edition level.

Question 27

Your company is undergoing a regulatory compliance audit. As part of the audit, you are required to demonstrate that you can preserve all electronic communications related to a specific project for a potential legal discovery process. You need to configure Google Vault to accomplish this goal. What should you do?

  1. Use the security investigation report to show Vault log events.
  2. Use the search and export functionality to identify all relevant communications within the project timeframe.
  3. Create a matter and a hold on all project-related data sources such as Email, Chat, and Drive within Google Workspace.
  4. Create a custom retention policy for the project data. Ensure that the policy covers the required retention period.
Show answer and explanation

Correct answer: C. Create a matter and a hold on all project-related data sources such as Email, Chat, and Drive within Google Workspace.

Creating a matter and applying holds to all relevant data sources (Email, Chat, Drive) is the proper Google Vault procedure for legal preservation. A matter formalizes the legal case, and holds ensure data cannot be deleted or modified during the discovery process. This directly addresses regulatory compliance requirements and demonstrates proper data preservation for potential litigation.

Why the other options are wrong

  • A. Security investigation reports show Vault log events but do not preserve data or create holds.
  • B. Search and export are discovery tools, not preservation mechanisms; data could still be deleted without holds.
  • D. Custom retention policies manage ongoing data lifecycle but lack the legal protections and formality of a Vault matter and hold.

That was 27 of 108.

The full Google Associate Google Workspace Administrator pack has all 108 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 53 free as one PDF by email. Get the Half Pack →