Google Associate Google Workspace Administrator Practice Exams
Last updated on Oct 22,2026- Exam Code: Associate Google Workspace Administrator
- Exam Name: Associate Google Workspace Administrator
- Certification Provider: Google
- Latest update: Oct 22,2026
Your organization allows employees to use their personal devices for work purposes. You want to ensure these devices follow the company’s security policies. You need to choose a mobile management solution that provides minimal passcode enforcement and allows for an admin to remotely wipe a user’s account from the device. You also want to avoid having to install agents on employees’ personal devices.
What should you do?
- A . Implement Google’s advanced management on mobile devices.
- B . Implement Google’s basic management on mobile devices.
- C . Enforce a strong password policy, and enforce the password policy at the next sign-in.
- D . Deploy a third-party mobile device management (MDM) solution.
B
Explanation:
Google’s basic management for mobile devices allows administrators to enforce minimal security policies, such as passcode enforcement, without requiring the installation of any agents on employees’ personal devices. This solution also allows for remotely wiping a user’s account from the device if needed, ensuring data security while maintaining a less intrusive management approach for personal devices.
Your company wants to start using Google Workspace for email. Your domain is verified through a third-party provider. You need to route the email to Google Workspace.
What should you do?
- A . Change your domain’s A record to point to Google’s mail servers.
- B . Configure a forwarding rule in your current email system to redirect all messages to Gmail.
- C . Update your domain’s MX records to the Google Workspace MX records provided in the setup instructions.
- D . Create a CNAME record that maps your domain to “gmail.com.”
C
Explanation:
To route your email to Google Workspace, you need to update your domain’s MX (Mail Exchange) records to point to Google’s mail servers. This step ensures that emails sent to your domain are delivered to your Google Workspace Gmail accounts. The MX records are provided in the setup instructions during the Google Workspace configuration process.
Your company has recently migrated from an on-premises email solution to Google Workspace. You have successfully added and verified the new primary domain. However, you also want to continue receiving emails sent to your former on-premises email server for a transitional period. You need to ensure that emails sent to your former domain are still delivered to your on-premises server, even though your primary email system is now Google Workspace.
What should you do?
- A . Configure MX records for the former domain to point to your on-premises email servers.
- B . Add the former domain as a secondary domain in your Google Workspace settings and verify the domain.
- C . Adjust the TTL (Time-to-Live) for the former domain to ensure a smooth transition.
- D . Add the former domain as a domain alias for the primary domain.
A
Explanation:
To ensure that emails sent to your former domain are still delivered to your on-premises server during a transitional period after migrating your primary email to Google Workspace, you need to configure the MX (Mail Exchanger) records for the former domain to point to your on-premises email servers.
Here’s why the other options are incorrect and why configuring MX records is the correct approach, based on the principles of email routing and domain management within Google Workspace:
Multiple users in your organization are reporting that Calendar invitations sent from a specific department are not being received. You verified that the invitations are being sent and there are no error messages in the sender’s logs. You want to troubleshoot the issue.
What should you do?
- A . Analyze the message headers of the sent invitations by using the Google Admin Toolbox to identify any delivery issues.
- B . Verify that the senders in the specific department have the necessary permissions to share their calendars externally and send invitations outside of the organization.
- C . Disable and re-enable the Calendar service for the affected users to refresh their connection.
- D . Check the affected users’ Calendar settings to confirm whether they have accidentally blocked invitations from the specific department.
A
Explanation:
Using the Google Admin Toolbox to analyze the message headers of the sent invitations helps you identify if there are any issues with the delivery of the invitations, such as misrouted messages or issues with email delivery to the affected users. This approach will give you detailed information on what might be causing the issue, even if no error messages appear in the sender’s logs.
You work for a healthcare provider that uses an external medical billing company to manage patient records and invoices. Your organization’s employees need to share patient documents with the billing company’s employees for processing. You need to configure access so the medical billing company’s employees can view and edit the documents, but they cannot delete the documents.
What should you do?
- A . Create a shared drive that is managed by your organization’s employees. Grant Contributor access to the billing company’s staff.
- B . Create a shared drive. Grant Content Manager access to your organization’s employees and the billing company.
- C . Create a group, and add the employees from your organization and the billing company. Create a shared folder on Google Drive. Grant Editor access to the group
- D . Restrict access for the medical billing company’s employees by using Data Loss Prevention (DLP) policies.
A
Explanation:
Creating a shared drive and granting Contributor access to the billing company’s staff allows them to view and edit documents, but not delete them. This is the most suitable approach because it ensures that only your organization’s employees manage the overall shared drive, while still allowing external users to collaborate on documents without compromising their integrity by preventing deletion. The shared drive structure also offers better control over document permissions compared to shared folders.
A user in your organization reported that their internal event recipient is not receiving the Calendar event invites. You need to identify the source of this problem.
What should you do?
- A . Check whether the business hours are set up in the event recipient’s Calendar settings.
- B . Check if Calendar service is turned off for the event creator.
- C . Check whether the Calendar event has more than 50 guests.
- D . Check whether the event recipient has turned off their email notifications for new events in their Calendar settings.
D
Explanation:
When an internal user reports not receiving Google Calendar event invites, the most likely immediate cause to investigate on the recipient’s end is their notification settings within Google Calendar. Users can customize their notification preferences, and it’s possible they have turned off email notifications for new events.
Here’s why option D is the most relevant first step and why the other options are less likely to be the primary cause of this specific issue:
D. Check whether the event recipient has turned off their email notifications for new events in their Calendar settings.
Google Calendar allows users to configure various notification settings, including whether they receive email notifications for new events, changes to events, reminders, etc. If the recipient has disabled email notifications for new events, they would not receive the invites in their inbox, even though the event might be correctly added to their Calendar.
Associate Google Workspace Administrator topics guides or documents reference: The official Google Calendar Help documentation for users, such as "Change notification settings," explains how users can customize their event notifications. This includes options to turn off email notifications for new events. While administrators don’t directly manage individual user’s notification settings, understanding these user-level controls is crucial for troubleshooting. An administrator might guide the user to check these settings.
Your organization is concerned about unauthorized access attempts. You want to implement a security measure that makes users change their password if there are twenty or more failed login attempts within one hour. You want to use the most effective and efficient approach.
What should you do?
- A . Set up a Chrome action rule to restrict users from defined ChromeOS actions after twenty failed password attempts.
- B . Create an activity rule for user log events, define a time period and threshold, and select an Action for the rule to force a password change.
- C . Create an activity rule for live-state data sources that meets the required time period and threshold to identify users who need to change their password.
- D . Enable email alerts to notify users that they need to change their password.
B
Explanation:
Creating an activity rule for user log events allows you to monitor failed login attempts within a specific time period (such as one hour) and set a threshold (like twenty attempts). This rule can automatically trigger an action, such as forcing a password change, when the defined threshold is met. This is the most effective and efficient approach to addressing unauthorized access attempts while ensuring that security measures are enforced without manual intervention.
You are onboarding a new employee who will use a company-provided Android device. Your company requires the ability to enforce strong security policies on mobile devices, including password complexity requirements and remote device wipe capabilities. You need to choose the
appropriate Google Workspace mobile device management solution.
What should you do?
- A . Use a third-party mobile device management (MDM) solution to manage the device.
- B . Allow the employee to use their personal device without enrolling it in any mobile device management (MDM) solution.
- C . Implement Google’s basic management solution for the mobile device.
- D . Implement Google’s advanced management solution for the mobile device.
D
Explanation:
Google’s advanced management solution for mobile devices provides the ability to enforce strong security policies, including password complexity requirements and remote wipe capabilities. This solution allows administrators to manage and secure company-provided Android devices, ensuring compliance with company security policies. Advanced management offers greater control over device settings and security features compared to basic management, which is more limited in scope.
You are designing a group structure for your company that will be used to grant access to a specific shared drive. You need this solution to automatically add and remove employees based on their job role.
What should you do?
- A . Create a security group. Add all employees with the desired job role. Grant the security group access to the shared drive.
- B . Create a distribution list. Add all employees with the desired job role. Grant the distribution list access to the shared drive.
- C . Create a dynamic group. Set the membership criteria to the desired job role. Grant the dynamic group access to the shared drive.
- D . Create a configuration group. Add users on an exception basis. Grant the configuration group access to the shared drive.
C
Explanation:
A dynamic group automatically manages its membership based on user attributes, such as job role. This approach ensures that employees are automatically added or removed from the group based on their role, minimizing manual effort and ensuring that the group always reflects the current team composition. Granting this dynamic group access to the shared drive ensures that the right users have the appropriate permissions without requiring constant manual updates.
Your organization’s security team has published a list of vetted third-party apps and extensions that can be used by employees. All other apps are prohibited unless a business case is presented and approved. The Chrome Web Store policy applied at the top-level organization allows all apps and extensions with an admin blocklist. You need to disable any unapproved apps that have already been installed and prevent employees from installing unapproved apps.
What should you do?
- A . Change the Chrome Web Store allow/block mode setting to allow all apps, admin manages blocklist, In the App access control card, block any existing web app that is not on the security team’s vetted list.
- B . Change the Chrome Web Store allow/block mode setting to block all apps, admin manages allowlist. Add the apps on the security team’s vetted list to the allowlist.
- C . Disable Extensions and Chrome packaged apps as Allowed types of apps and extensions for the
top-level organizational unit. Selectively enable the appropriate extension types for each suborganization - D . Disable the Chrome Web Store service for the top-level organizational unit. Enable the Chrome Web Store service for organizations that require Chrome apps and extensions.
B
Explanation:
Changing the Chrome Web Store policy to block all apps and managing an allowlist ensures that only vetted, approved apps are allowed for installation. This approach enforces the security team’s policy by restricting access to unapproved apps while enabling the installation of only those apps that have been explicitly approved. This method provides control over what can be installed, aligning with the organization’s security requirements.