Google Associate Google Workspace Administrator Practice Exams
Last updated on Oct 21,2026- Exam Code: Associate Google Workspace Administrator
- Exam Name: Associate Google Workspace Administrator
- Certification Provider: Google
- Latest update: Oct 21,2026
Question #31
You are migrating your organization’s email to Google Workspace. Your organization uses the terramearth.com email domain. You need to configure Google Workspace to receive emails sent to terramearth.com.
What should you do?
- A . Add terramearth.com as a primary, secondary, or alias domain in Google Workspace. Update the Mail Exchange (MX) records with your domain registrar to direct mail flow to Google’s mail servers.
- B . Establish a Transport Layer Security (TLS) connection between your company’s existing mail servers and Google’s mail servers
- C . Configure an email address in Google Workspace to capture emails sent to unverified domains, including terramearth.com.
- D . Create a domain alias for terramearth.com in Google Workspace. Configure email forwarding to redirect emails to the new Google Workspace accounts.
Correct Answer: A
A
Explanation:
To receive emails for your domain (terramearth.com) in Google Workspace, you need to add the domain to Google Workspace as either a primary, secondary, or alias domain, depending on your organization’s requirements. After adding the domain, you must update the Mail Exchange (MX) records at your domain registrar to point to Google’s mail servers. This step is essential to ensure that emails are correctly routed to Google Workspace.
A
Explanation:
To receive emails for your domain (terramearth.com) in Google Workspace, you need to add the domain to Google Workspace as either a primary, secondary, or alias domain, depending on your organization’s requirements. After adding the domain, you must update the Mail Exchange (MX) records at your domain registrar to point to Google’s mail servers. This step is essential to ensure that emails are correctly routed to Google Workspace.
Question #32
Your company has offices in several different countries and is deploying Google Workspace. You’re setting up Google Calendar and need to ensure that, when a user is creating a Google Calendar event, rooms are suggested in a nearby office.
What should you do?
- A . Assign building ID, floor name, and floor section to define users’ work locations based on defined buildings and rooms.
- B . Add your users to Google Groups by location. Add room resources to the corresponding groups.
- C . Add your users to organizational units (OUs) by location. Add room resources to the corresponding OUs.
- D . Restrict room sharing to a dynamic group based on user location.
Correct Answer: C
C
Explanation:
To ensure that Google Calendar suggests nearby office rooms when a user creates an event, you need to associate both the users and the room resources with their respective locations within the Google Workspace organizational structure. The most effective way to do this is by organizing users into organizational units (OUs) based on their location and then associating the room resources with the corresponding OUs.
Here’s why option C is the correct approach and why the others are less suitable for this specific requirement:
C. Add your users to organizational units (OUs) by location. Add room resources to the corresponding OUs.
Google Calendar uses the organizational unit (OU) structure to determine the proximity of resources to users. By placing users within OUs that correspond to their office locations and then assigning the room resources of each office to the same or relevant child OUs, Google Calendar can suggest nearby rooms to users when they schedule meetings. This method directly links users and resources based on their organizational location.
Associate Google Workspace Administrator topics guides or documents reference: The official Google Workspace Admin Help documentation on "Set up rooms and shared resources" (or similar titles) explains how to create and manage room resources. It also details how to associate these resources with specific buildings, floors, and, importantly, organizational units. While the documentation might not explicitly state that nearby suggestions solely rely on OUs, the OU structure is the primary way Google Workspace understands the organizational hierarchy and location of users and resources. By aligning user and resource OUs, you provide the context for "nearby" suggestions.
C
Explanation:
To ensure that Google Calendar suggests nearby office rooms when a user creates an event, you need to associate both the users and the room resources with their respective locations within the Google Workspace organizational structure. The most effective way to do this is by organizing users into organizational units (OUs) based on their location and then associating the room resources with the corresponding OUs.
Here’s why option C is the correct approach and why the others are less suitable for this specific requirement:
C. Add your users to organizational units (OUs) by location. Add room resources to the corresponding OUs.
Google Calendar uses the organizational unit (OU) structure to determine the proximity of resources to users. By placing users within OUs that correspond to their office locations and then assigning the room resources of each office to the same or relevant child OUs, Google Calendar can suggest nearby rooms to users when they schedule meetings. This method directly links users and resources based on their organizational location.
Associate Google Workspace Administrator topics guides or documents reference: The official Google Workspace Admin Help documentation on "Set up rooms and shared resources" (or similar titles) explains how to create and manage room resources. It also details how to associate these resources with specific buildings, floors, and, importantly, organizational units. While the documentation might not explicitly state that nearby suggestions solely rely on OUs, the OU structure is the primary way Google Workspace understands the organizational hierarchy and location of users and resources. By aligning user and resource OUs, you provide the context for "nearby" suggestions.
Question #33
You are configuring Chrome browser security policies for your organization. These policies must restrict certain Chrome apps and extensions.
You need to ensure that these policies are applied on the devices regardless of which user logs into the device.
What should you do?
- A . Configure the allowed list of apps in the Devices page in the apps and extensions settings.
- B . Configure the Chrome user setting to require users to sign in to use Chrome apps and extensions.
- C . Configure the Policy Precedence to override the domain-wide policy applied for apps and extensions.
- D . Require 2SV for user logins.
Correct Answer: A
A
Explanation:
To ensure that Chrome apps and extension policies are applied regardless of which user logs into the device, you should configure the allowed list of apps in the Devices section of the apps and extensions settings. This policy applies at the device level, ensuring that the restrictions are enforced for any user who logs into that device, providing consistent security across the organization.
A
Explanation:
To ensure that Chrome apps and extension policies are applied regardless of which user logs into the device, you should configure the allowed list of apps in the Devices section of the apps and extensions settings. This policy applies at the device level, ensuring that the restrictions are enforced for any user who logs into that device, providing consistent security across the organization.
Question #34
Your organization wants to provide access to YouTube to a select group of users for educational purposes, while restricting YouTube access for all other users. You need to implement a solution that allows for granular control over YouTube access based on user roles or groups.
What should you do?
- A . Deploy a Chrome extension from the Google Workspace Marketplace that blocks YouTube for users who are not in the select user group.
- B . Configure a SAML application to manage YouTube access for different user groups.
- C . Instruct the select group of users to switch to their personal Google account when accessing YouTube.
- D . Use organizational units (OUs) to apply a policy that restricts YouTube access, and create an exception for the select group of users.
Correct Answer: D
D
Explanation:
To achieve granular control over YouTube access within your Google Workspace organization, allowing access to a select group while restricting it for others, the recommended approach is to use organizational units (OUs) in conjunction with service settings exceptions. You would apply a policy to restrict YouTube access at a higher-level OU (encompassing most users) and then create a child OU containing the select group, where you override the inherited policy to allow YouTube access.
Here’s why option D is the most appropriate solution and why the others are less suitable for centrally managed, granular control within Google Workspace:
D. Use organizational units (OUs) to apply a policy that restricts YouTube access, and create an exception for the select group of users.
Google Workspace allows administrators to configure settings for various Google services, including YouTube, at the organizational unit level. You can set a policy to block YouTube access for the top-level OU or a parent OU containing most of your users. Then, you can create a child OU specifically for the select group of users who need access and, within the settings for this child OU, override the inherited policy to allow YouTube access. This provides centralized management and ensures that the restrictions and exceptions are applied consistently based on the organizational structure.
Associate Google Workspace Administrator topics guides or documents reference: The official Google Workspace Admin Help documentation on "Control access to YouTube" (or similar titles) explains how to manage YouTube settings at the OU level. It details the different access options available (e.g., unrestricted, restricted, signed-in users in your organization, off) and how these settings can be applied to specific OUs. The concept of OU inheritance and overriding settings in child OUs is fundamental to Google Workspace policy management, allowing for exceptions to be created for specific groups of users.
D
Explanation:
To achieve granular control over YouTube access within your Google Workspace organization, allowing access to a select group while restricting it for others, the recommended approach is to use organizational units (OUs) in conjunction with service settings exceptions. You would apply a policy to restrict YouTube access at a higher-level OU (encompassing most users) and then create a child OU containing the select group, where you override the inherited policy to allow YouTube access.
Here’s why option D is the most appropriate solution and why the others are less suitable for centrally managed, granular control within Google Workspace:
D. Use organizational units (OUs) to apply a policy that restricts YouTube access, and create an exception for the select group of users.
Google Workspace allows administrators to configure settings for various Google services, including YouTube, at the organizational unit level. You can set a policy to block YouTube access for the top-level OU or a parent OU containing most of your users. Then, you can create a child OU specifically for the select group of users who need access and, within the settings for this child OU, override the inherited policy to allow YouTube access. This provides centralized management and ensures that the restrictions and exceptions are applied consistently based on the organizational structure.
Associate Google Workspace Administrator topics guides or documents reference: The official Google Workspace Admin Help documentation on "Control access to YouTube" (or similar titles) explains how to manage YouTube settings at the OU level. It details the different access options available (e.g., unrestricted, restricted, signed-in users in your organization, off) and how these settings can be applied to specific OUs. The concept of OU inheritance and overriding settings in child OUs is fundamental to Google Workspace policy management, allowing for exceptions to be created for specific groups of users.
Question #35
An employee at your organization may be sharing confidential documents with unauthorized external parties. You must quickly determine if any sensitive information has been leaked.
What should you do?
- A . Review the employee’s Drive log events in the security investigation tool.
- B . Audit Drive access by using the Admin SDK Reports API.
- C . Review the employee’s user log events within the security investigation tool.
- D . Create a custom report of the user’s external sharing by using the security dashboard.
Correct Answer: A
A
Explanation:
To quickly determine if an employee has shared confidential documents externally, you should utilize the security investigation tool in the Google Admin console and specifically review the Drive log events associated with that employee’s account. This tool provides a centralized place to audit user activity related to Google Drive, including sharing actions.
Here’s why option A is the most direct and efficient first step:
A
Explanation:
To quickly determine if an employee has shared confidential documents externally, you should utilize the security investigation tool in the Google Admin console and specifically review the Drive log events associated with that employee’s account. This tool provides a centralized place to audit user activity related to Google Drive, including sharing actions.
Here’s why option A is the most direct and efficient first step:
Question #36
Your organization has hired temporary employees to work on a sensitive internal project. You need to ensure that the sensitive project data in Google Drive is limited to only internal domain sharing. You do not want to be overly restrictive.
What should you do?
- A . Configure the Drive sharing options for the domain to internal only.
- B . Restrict the Drive sharing options for the domain to allowlisted domains.
- C . Create a Drive DLP rule, and use the sensitive internal Project name as the detector.
- D . Turn off the Drive sharing setting from the Team dashboard.
Correct Answer: A
A
Explanation:
By configuring the Drive sharing options for your domain to "internal only," you ensure that sensitive project data is restricted to your organization’s internal users. This prevents any external sharing while allowing your team members to collaborate freely within the organization. It strikes the right balance between maintaining security and avoiding unnecessary restrictions on collaboration.
A
Explanation:
By configuring the Drive sharing options for your domain to "internal only," you ensure that sensitive project data is restricted to your organization’s internal users. This prevents any external sharing while allowing your team members to collaborate freely within the organization. It strikes the right balance between maintaining security and avoiding unnecessary restrictions on collaboration.
Question #37
Your organization recently deployed Google Workspace. Over 3,000 external contacts were shared in public folders in Microsoft Exchange before the implementation. You need to ensure that these external contacts appear to domain users in Gmail.
What should you do?
- A . Export the external contacts to a CSV file, upload the file to Google Drive, and instruct users to import to their My Contacts.
- B . Use Google Cloud Directory Sync to sync the external contacts from the public folders in Microsoft Exchange to the Directory.
- C . Use the Domain Shared Contacts API to add the external contacts to the Directory.
- D . Create a user account, add the external contacts, and delegate them to all users in the domain.
Correct Answer: C
C
Explanation:
The Domain Shared Contacts API allows you to add external contacts to the Google Workspace directory, making them available to all users in the domain. This is the most effective and scalable solution for adding a large number of external contacts (like the 3,000 from Microsoft Exchange) to your Google Workspace environment. Once the contacts are added to the directory, they will be accessible to all users in Gmail and other Google Workspace apps.
C
Explanation:
The Domain Shared Contacts API allows you to add external contacts to the Google Workspace directory, making them available to all users in the domain. This is the most effective and scalable solution for adding a large number of external contacts (like the 3,000 from Microsoft Exchange) to your Google Workspace environment. Once the contacts are added to the directory, they will be accessible to all users in Gmail and other Google Workspace apps.
Question #38
You are configuring Gmail for your company and want to implement a layered security approach. You decide to implement industry-standard email authentication protocols.
What should you do? Choose 2 answers
- A . Enable a default email quarantine for all users to isolate suspicious emails and determine if the messages haven’t been authenticated.
- B . Configure a blocked senders rule to block all emails from unknown senders.
- C . Configure DKIM to digitally sign outbound emails and verify their origin.
- D . Disable IMAP for your organization to prevent external clients from accessing Gmail.
- E . Set up SPF records to specify authorized mail servers for your domain.
Correct Answer: CE
CE
Explanation:
To implement industry-standard email authentication protocols as part of a layered security approach for Gmail, you should configure DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework) records for your domain. These protocols are crucial for verifying the sender’s identity and ensuring the integrity of email messages.
Here’s a breakdown of why options C and E are correct and why the others are not primarily email authentication protocols or best practices in this context:
C. Configure DKIM to digitally sign outbound emails and verify their origin.
DKIM adds a digital signature to the headers of outbound emails. This signature is verified by receiving mail servers using a public key published in your domain’s DNS records. DKIM helps to confirm that the email was indeed sent from your domain and that its content has not been altered in transit. It is a key email authentication protocol that enhances deliverability and protects against email spoofing.
Associate Google Workspace Administrator topics guides or documents reference: The official Google Workspace Admin Help documentation on "Help prevent email spoofing with DKIM" (or similar titles) explains how to set up DKIM for your domain. It details the process of generating a DKIM key, adding the public key as a TXT record in your DNS, and enabling DKIM signing in the Google Admin console. The documentation emphasizes DKIM’s role in authenticating outbound mail and improving email security.
E. Set up SPF records to specify authorized mail servers for your domain.
SPF is a DNS-based email authentication protocol that allows you to specify which mail servers are authorized to send emails on behalf of your domain. Receiving mail servers check the SPF record in the sender’s domain’s DNS to verify if the sending server’s IP address is listed as authorized. This helps to prevent spammers from forging the "From" address of your domain.
Associate Google Workspace Administrator topics guides or documents reference: The Google Workspace Admin Help documentation on "Help prevent spoofing with SPF" (or similar titles) guides administrators on creating and publishing SPF records in their domain’s DNS. It explains the syntax of SPF records and how they help receiving servers validate the sender’s origin, thus reducing spoofing and improving deliverability.
Now, let’s look at why the other options are not the primary choices for implementing industry-standard email authentication protocols:
CE
Explanation:
To implement industry-standard email authentication protocols as part of a layered security approach for Gmail, you should configure DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework) records for your domain. These protocols are crucial for verifying the sender’s identity and ensuring the integrity of email messages.
Here’s a breakdown of why options C and E are correct and why the others are not primarily email authentication protocols or best practices in this context:
C. Configure DKIM to digitally sign outbound emails and verify their origin.
DKIM adds a digital signature to the headers of outbound emails. This signature is verified by receiving mail servers using a public key published in your domain’s DNS records. DKIM helps to confirm that the email was indeed sent from your domain and that its content has not been altered in transit. It is a key email authentication protocol that enhances deliverability and protects against email spoofing.
Associate Google Workspace Administrator topics guides or documents reference: The official Google Workspace Admin Help documentation on "Help prevent email spoofing with DKIM" (or similar titles) explains how to set up DKIM for your domain. It details the process of generating a DKIM key, adding the public key as a TXT record in your DNS, and enabling DKIM signing in the Google Admin console. The documentation emphasizes DKIM’s role in authenticating outbound mail and improving email security.
E. Set up SPF records to specify authorized mail servers for your domain.
SPF is a DNS-based email authentication protocol that allows you to specify which mail servers are authorized to send emails on behalf of your domain. Receiving mail servers check the SPF record in the sender’s domain’s DNS to verify if the sending server’s IP address is listed as authorized. This helps to prevent spammers from forging the "From" address of your domain.
Associate Google Workspace Administrator topics guides or documents reference: The Google Workspace Admin Help documentation on "Help prevent spoofing with SPF" (or similar titles) guides administrators on creating and publishing SPF records in their domain’s DNS. It explains the syntax of SPF records and how they help receiving servers validate the sender’s origin, thus reducing spoofing and improving deliverability.
Now, let’s look at why the other options are not the primary choices for implementing industry-standard email authentication protocols:
Question #39
You are configuring Google Chat for your organization. Using the Adin console, you want to enable employees to view their chat history by default and allow employees to turn off chat history.
What should you do?
- A . Configure Google Vault to retain all Chat messages, and exclude organizational units (OUs) with users who want to turn Chat history off.
- B . Set the space history setting to OFF and chat history to ON.
- C . Set the top-level default conversation history setting to ON and allow users to change their history
setting. - D . Set the top-level default conversation history settings to OFF and allow users in each organizational unit (OU) to change their history setting.
Correct Answer: C
C
Explanation:
By setting the default conversation history to "ON" at the top level, all employees will have chat history enabled by default. Allowing users to change their own history setting gives them the flexibility to turn off chat history if they choose to do so. This approach aligns with your goal of enabling chat history by default while still giving employees the option to turn it off.
C
Explanation:
By setting the default conversation history to "ON" at the top level, all employees will have chat history enabled by default. Allowing users to change their own history setting gives them the flexibility to turn off chat history if they choose to do so. This approach aligns with your goal of enabling chat history by default while still giving employees the option to turn it off.
Question #40
Your company provides shared Chromebook workstations for employees to access sensitive company data. You must configure the devices to ensure no sensitive data is stored locally and that browsing data is cleared after each use.
What should you do?
- A . Force ephemeral mode in Chrome. Disable offline access for sensitive Workspace apps like Docs, Sheets, and Drive.
- B . Enable the Manage Guest Session functionality, and set the maximum user session length.
- C . Force ephemeral mode in Chrome. Allow offline access for all Workspace apps with strict expiration times.
- D . Disable offline access for all Workspace apps. Enable incognito mode for Chrome browsing sessions.
Correct Answer: A
A
Explanation:
Enabling ephemeral mode in Chrome ensures that all browsing data is cleared after each session, and nothing is stored locally on the Chromebook. Disabling offline access for sensitive Workspace apps, such as Docs, Sheets, and Drive, ensures that users cannot download or store sensitive data locally. This combination provides a secure environment, preventing the retention of any sensitive data on the device after use.
A
Explanation:
Enabling ephemeral mode in Chrome ensures that all browsing data is cleared after each session, and nothing is stored locally on the Chromebook. Disabling offline access for sensitive Workspace apps, such as Docs, Sheets, and Drive, ensures that users cannot download or store sensitive data locally. This combination provides a secure environment, preventing the retention of any sensitive data on the device after use.