Google Associate Google Workspace Administrator Practice Exams
Last updated on Oct 22,2026- Exam Code: Associate Google Workspace Administrator
- Exam Name: Associate Google Workspace Administrator
- Certification Provider: Google
- Latest update: Oct 22,2026
Your organization requires enhanced privacy and security when sending messages to banks and other financial institutions. Your organization uses Gmail, but the banks use various other email providers. You need to maximize privacy and limit access to messages sent and received between your organization and the banks.
What should you do?
- A . Set up Transport Layer Security (TLS) compliance for inbound and outbound messages with a list of the banks’ email domains. Validate the TLS connections.
- B . Configure Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) authentication for your email domains.
- C . Enable Protect against unauthenticated emails in Gmail Safety.
- D . Enable confidential mode for Gmail. Instruct employees to use confidential mode when sending messages to the banks.
A
Explanation:
Transport Layer Security (TLS) ensures that emails are encrypted in transit between your organization and the banks, thereby enhancing privacy and security. By setting up TLS compliance and validating TLS connections for the banks’ email domains, you ensure that the communication is secure and protected from interception, even if the banks use various email providers. This approach provides the highest level of privacy for sensitive financial communications.
Your organization collects credit card information in customer files. You need to implement a policy for your organization’s Google Drive data that prevents the accidental sharing of files that contain credit card numbers with external users. You also need to record any sharing incidents for reporting.
What should you do?
- A . Create a data loss prevention (DLP) rule that uses the predefined credit card number detector, sets the action to “block external sharing”, and enables the “Log event” option.
- B . Enable Gmail content compliance, and create a rule to block email attachments containing credit card numbers from being sent to external recipients.
- C . Implement a third-party data loss prevention solution to integrate with Drive and provide advanced content detection capabilities.
- D . Configure a data retention policy to automatically delete files containing credit card numbers after a specified period.
A
Explanation:
A data loss prevention (DLP) rule with the predefined credit card number detector will help you identify and prevent the accidental sharing of files that contain sensitive credit card information. Setting the action to "block external sharing" ensures that such files cannot be shared externally. Enabling the "Log event" option will record any incidents of external sharing for auditing and
reporting purposes, fulfilling both the security and reporting requirements.
You manage Chrome Enterprise browsers for your large organization. You want to ensure that specific extensions are automatically installed on all managed Chrome Enterprise browsers.
What should you do?
- A . Allowlist the specific Chrome browser extensions.
- B . Configure a script to deploy the extensions upon user login.
- C . Publish the extensions in the Chrome Web Store.
- D . Force-install the extensions through Chrome browser policies.
D
Explanation:
Using Chrome browser policies, you can force-install specific extensions on all managed Chrome Enterprise browsers. This ensures that the desired extensions are automatically installed on users’
browsers without requiring manual installation. This approach is the most efficient and scalable solution for managing extensions across a large organization.
Your organization’s employees frequently collaborate with external clients and vendors by using Google Meet. There are active instances of unsupervised meetings within your organization that do not have a host, and unsupervised meetings that continue after an event has completed. You want to end all meetings that are being used inappropriately as quickly as possible.
What should you do?
- A . End all unsupervised meetings by using the Google Meet APIs.
- B . Enable Host Management for Google Meet, and train internal host employees how to end meetings for everyone.
- C . Turn off Google Meet in the Admin console for your organization. Turn Google Meet back on after two minutes.
- D . Identify and end all unsupervised meetings by using the security investigation tool.
A
Explanation:
Using the Google Meet APIs allows you to programmatically end all unsupervised meetings quickly. This approach is the most effective for managing unsupervised meetings in real-time, especially if there are multiple such meetings happening across the organization. It provides a centralized method to monitor and take action on these meetings, ensuring security and preventing misuse.
You’ve received multiple reports about a suspicious email from someone who is pretending to be from your organization’s human resources department. The email is prompting employees to click a link for a password update. You want to remediate this sender’s emails.
What should you do?
- A . Use the security investigation tool to search for users who received the suspicious email, and select Mark message as phishing.
- B . Use the security investigation tool to action the suspicious email and select Mark message as spam.
- C . Create an activity rule to alert administrators to similar emails from that sender.
- D . Notify all employees and request that they report this email as spam.
A
Explanation:
The security investigation tool allows you to search for and take action on suspicious emails within your organization. Marking the email as phishing helps to flag the email as malicious and prevents further emails from the same sender from being delivered to users’ inboxes. This also ensures that the email is properly categorized for review and investigation by your security team.
Your company has just started using Search Ads 360. You need to limit access to Additional Google services for your entire organization by using the Admin console. Only the marketing team and a specific group of users from the web design team should have access.
What should you do?
- A . Enable Search Ads 360 for both the marketing and web design team organizational units (OUs). Create a group to explicitly deny access to Search Ads 360. Assign the group to the web design users who should not have access.
- B . Enable Search Ads 360 at the top level of your organizational structure.
- C . Enable Search Ads 360 for the marketing organizational unit (OU). Create a sub-OU under the marketing OU. and move the web design team users who need access into this sub-OU.
- D . Enable Search Ads 360 for the marketing organizational unit (OU). Create a new group in the Admin console that includes the web design team users who need access. Enable Search Ads 360 for that group.
D
Explanation:
To limit access to Search Ads 360 to only the marketing team and a specific group of users from the web design team, the most effective and Google-recommended approach is to enable the service for the marketing organizational unit (OU) and then create a separate group containing the specific web design users who need access, enabling the service for that group as well. This allows for granular control and avoids granting access to the entire web design OU.
Here’s why option D is the correct solution and why the others are less ideal:
D. Enable Search Ads 360 for the marketing organizational unit (OU). Create a new group in the Admin console that includes the web design team users who need access. Enable Search Ads 360 for that group.
This approach leverages both organizational units and groups for access control. By enabling Search Ads 360 for the marketing OU, you grant access to all users within that department. Then, by creating a separate group containing the specific web design users who require access and enabling Search Ads 360 for that group, you provide them with the necessary permissions without granting access to the entire web design OU. This method allows for targeted access based on both departmental affiliation and specific user needs, aligning with the principle of least privilege.
Associate Google Workspace Administrator topics guides or documents reference: The Google Workspace Admin Help documentation on "Turn services on or off for users" explains how to control access to Google services at both the organizational unit and group levels. It highlights the flexibility of using a combination of OUs and groups to achieve granular access control. Enabling a service for an OU applies it to all members of that OU, while enabling it for a group applies it only to the members of that specific group, regardless of their OU.
Your organization needs an approval application for purchases where a user can enter information on the purchase required and then submit it for management approval. You need to suggest a solution to create the application that must be available on both the web and mobile devices. Your organization does not have software developers or the budget to hire a third party.
What should you do?
- A . Suggest that the organization develop an application internally with a database, a backend service for data retrieval, and a frontend service for the application’s user interface.
- B . Suggest that the organization continue to approve requests manually until budget is available to use a third-party application provider.
- C . Suggest the organization use AppSheet to create the application.
- D . Suggest that the organization use AppScript to create forms linked to a Google Sheet to store the purchase data.
C
Explanation:
AppSheet is a no-code platform that allows users to create custom applications without the need for software development skills. It is capable of building applications that can be used both on the web and mobile devices. AppSheet would allow the organization to create the approval application efficiently, meeting the requirements of the purchase process, and would be a cost-effective solution
that does not require hiring developers or using a third-party application provider.
Your company is transitioning to Google Workspace from legacy communication and collaboration applications. User accounts are managed in Active Directory and synced to Google Workspace by using Google Cloud Directory Sync (GCDS). Your company is implementing a new security policy for all accounts that requires complex passwords. Passwords must be at least 20 characters long, contain 3 symbols, 4 numbers, and 2 capital letters.
You need to enforce the new password policy in Google Workspace.
What should you do?
- A . Share the instructions for changing a Google account password with your users. Monitor password strength in the Google Admin console as users change their passwords.
- B . Enable strong password enforcement and require a minimum length of 20 characters at the top-level organizational unit.
- C . Create a password policy in Active Directory. Install Password Sync on the global catalog servers for Active Directory and require a password change for your users.
- D . Create a password policy in Active Directory. Enable password synchronization in GCDS.
D
Explanation:
Since user accounts are managed in Active Directory (AD) and synced to Google Workspace via Google Cloud Directory Sync (GCDS), the best approach to enforce the new password policy is to create the password policy within Active Directory and then enable password synchronization in GCDS. This ensures that the complex password requirements are enforced within AD, and when passwords are updated, they will be synchronized with Google Workspace, maintaining consistency across both systems.
Your organization has a Shared Drive with 150 users organized as a group. All users of the group need to be able to add and edit files, but the ability to move, delete, and share content must be limited to a single user. You need to configure the shared drive to meet these requirements efficiently.
What should you do?
Your organization has a Shared Drive with 150 users organized as a group. All users of the group need to be able to add and edit files, but the ability to move, delete, and share content must be limited to a single user. You need to configure the shared drive to meet these requirements efficiently.
What should you do?
- A . Create a folder inside the shared drive. Share the files with the group by using the share function.
- B . Create a folder inside the shared drive. Share the folder link with the group.
- C . In the Admin console, assign Contributor access for the shared drive to each user. Assign Content Manager access for the shared drive to the single user.
- D . In the Admin console, assign Contributor access for the shared drive to the group. Assign Content Manager access for the shared drive to the single user.
D
Explanation:
By assigning Contributor access to the group, all 150 users will be able to add and edit files in the shared drive. Assigning Content Manager access to the single user ensures that only that person has the ability to move, delete, and share content within the shared drive. This approach efficiently meets the requirement of limiting certain administrative privileges while allowing the group to collaborate on content.
Your company’s security team has requested two requirements to secure employees’ mobile devices-enforcement of a passcode and remote account wipe functionality. The security team does not want an agent to be installed on the mobile devices or to purchase additional licenses. Employees have a mix of iOS and Android devices. You need to ensure that these requirements are met.
What should you do?
- A . Implement a third-party enterprise mobility management (EMM) provider.
- B . Set up advanced mobile management for iOS devices and basic mobile management for Android devices.
- C . Set up basic management for both iOS and Android devices.
- D . Set up advanced management for both iOS and Android devices.
D
Explanation:
Advanced mobile management in Google Workspace provides the necessary features for securing mobile devices without the need for third-party apps or additional licenses. This includes enforcing passcodes and enabling remote account wipe functionality for both iOS and Android devices.
Advanced management ensures that both security requirements are met while keeping the setup efficient and within the organization’s existing licenses.