Associate Google Workspace Administrator Practice Exam

What the Associate Google Workspace Administrator exam covers

• Managing user accounts, domains, and Directory166 questions
• Managing core Workspace services165 questions
• Managing data governance and compliance144 questions
• Managing security policies and access controls167 questions
• Managing browsers and endpoints97 questions
• Monitoring and troubleshooting common issues148 questions

Free Associate Google Workspace Administrator practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 887.

1. Question 1Managing user accounts, domains, and Directory

   Larkspur Design is leaving a hosted IMAP email provider and wants to copy existing mail into Gmail. IT has no on-premises servers and wants to run the whole migration from the Admin console. Which Google tool should the administrator use?

   • AGoogle Cloud Directory Sync
   • BData Migration ServiceCorrect
   • CGoogle Workspace Migration for Microsoft Outlook
   • DGoogle Takeout
   ✓ Correct answer: B

   In the Admin console, Apps > Google Workspace > Gmail > Data migration lets the admin create a migration project, pick Email as the migration type, choose the generic IMAP server connection protocol, and supply the source host, port, and admin credentials to pull each mailbox into Gmail. Because the whole workflow runs as a hosted console job, Larkspur needs no on-premises migration server, which is exactly the constraint in this scenario.

   Why the other options are wrong

   • AGCDS (Google Cloud Directory Sync) synchronizes user, group, and OU identities from an LDAP directory; it never touches mailbox content, so it cannot import IMAP mail.
   • CGWMMO installs on a single Windows PC and migrates one Outlook PST or profile at a time; it is not a console-managed, server-side IMAP migration tool.
   • DGoogle Takeout exports a signed-in user's own Workspace data as a downloadable archive; it does not import external IMAP mail into Gmail.
2. Question 2Managing user accounts, domains, and Directory

   The only super administrator at Ashford Council has forgotten their password, and super administrator account recovery is turned off. What is the correct path to regain access?

   • AComplete Google's super admin account recovery process, which verifies domain ownership through several checksCorrect
   • BHave any standard user reset the super administrator's password.
   • CRestore the super administrator's password from Google Vault.
   • DWait for the password to expire so the account resets automatically without any manual admin steps
   ✓ Correct answer: A

   With no second super admin and self-service recovery disabled, the only route is Google's super administrator account recovery, which confirms you control the domain by having you add a specific DNS record such as a TXT or CNAME entry at your registrar. Once Google validates that record, it lets you reset the super admin password and regain access.

   Why the other options are wrong

   • BA standard user has no privilege to reset a super administrator's password; only another super admin or Google can.
   • CVault only retains, searches, and exports message and file content for eDiscovery; it never stores or restores passwords.
   • DGoogle passwords never auto-reset on expiry without admin action; an expiry policy only forces a change at a sign-in the admin cannot reach.
3. Question 3Managing core Workspace services

   Coho Vineyard's warehouse scanners and a billing application must send outbound email through Google using the company domain. Which Gmail routing setting is designed to relay outbound mail from internal devices and applications through Google?

   • AThe SMTP relay service settingCorrect
   • BThe inbound gateway setting
   • CA Default routing rule for internal senders
   • DThe Email allowlist setting
   ✓ Correct answer: A

   The SMTP relay service lets on-premises devices and applications send mail through Google's servers using the organization's domain, with options to require authentication or TLS and to restrict allowed IP ranges. It is the purpose-built path for device and application mail.

   Why the other options are wrong

   • BThe inbound gateway handles incoming mail arriving through a relay in front of Google, not outbound mail from devices.
   • CDefault routing acts on message flow and recipients but is not the mechanism for authorizing devices to relay outbound mail.
   • DThe Email allowlist trusts sending IP addresses for spam scoring; it does not relay outbound mail.
4. Question 4Managing core Workspace services

   Solaris Foods still wants employees to be able to share files with external partners, but wants each user to see a caution prompt before an external share is completed. Which Drive and Docs setting fits this requirement?

   • AEnable 'Warn when files are shared outside the organization'Correct
   • BSet 'Sharing outside the organization' to 'Off'
   • CSet 'Sharing outside the organization' to 'Allowlisted domains'
   • DDisable 'Allow users to receive files from outside the organization'
   ✓ Correct answer: A

   The warning setting lets external sharing continue while displaying a confirmation prompt whenever a user shares with someone outside the organization. It nudges users to reconsider without preventing legitimate external collaboration.

   Why the other options are wrong

   • BSetting sharing to 'Off' blocks external sharing entirely, which contradicts the goal of still allowing it.
   • CAllowlisted domains restricts external sharing to named domains; it does not add a warning for permitted shares.
   • DDisabling receiving only affects inbound external files, not a warning on outbound shares.
5. Question 5Managing data governance and compliance

   In a Vault Gmail search, which of the following is a valid way to scope which accounts are searched at Wexford Motors?

   • ABy the recipient's Internet service provider
   • BBy specific accounts or by an organizational unitCorrect
   • CBy the DKIM key that signed the messages
   • DBy the sending device's serial number
   ✓ Correct answer: B

   When searching Gmail in Vault, an administrator can target specific accounts or an entire organizational unit, then refine by date range and terms. This account or OU scope defines whose data is searched.

   Why the other options are wrong

   • AThe recipient's Internet service provider is not a Vault search scope.
   • CDKIM signing keys are an authentication feature, not a search scope.
   • DDevice serial numbers are used in endpoint management, not Vault search.
6. Question 6Managing data governance and compliance

   An administrator wants to use the Data Export tool to export only Gmail data (not Drive) for the whole organization. What is the correct expectation?

   • AThe Data Export tool exports all supported data types together and cannot be limited to GmailCorrect
   • BSelect Gmail as the only data type to include in the export options before starting the job
   • CUse Google Takeout with only Gmail selected for the whole domain's user accounts
   • DThis requires assigning a separate Vault license to every user in the domain before export
   ✓ Correct answer: A

   The Data Export tool produces a complete export of the organization's supported data and does not offer a per-service selector such as Gmail only. Narrowing to a single service or query is a job for Vault, not the Data Export tool.

   Why the other options are wrong

   • BThere is no data-type selector in the Data Export tool; it exports everything supported regardless of what is chosen.
   • CTakeout runs per user on their own data and cannot export Gmail for the whole domain at once.
   • DVault licensing does not change the Data Export tool, which still exports all data types together.
7. Question 7Managing security policies and access controlsSelect all that apply

   An administrator at Copperline Telecom is deciding whether to use organizational units or groups to apply settings. Which statements are accurate? (Select all that apply.)

   • AA user belongs to exactly one organizational unit at a timeCorrect
   • BA user can belong to only one group at a time
   • CGroup-based settings can target users across multiple OUsCorrect
   • DWhen both apply, the group configuration overrides the OU configurationCorrect
   • EGroup configurations cannot be prioritized when a user is in several groups
   ✓ Correct answer: A, C, D

   Each user occupies exactly one organizational unit, while groups allow membership that spans multiple OUs. When a setting is configured on both, the group configuration takes precedence over the OU value for that user.

   Why the other options are wrong

   • BUsers can belong to many groups simultaneously, unlike organizational units.
   • EWhen a user is in several groups, administrators set a priority order to resolve conflicts, so group configurations can indeed be prioritized.
8. Question 8Managing security policies and access controls

   Tamarack Freight manages company-owned Android devices and wants a line-of-business Android app to appear automatically on those devices. Where does the administrator distribute it?

   • AApps > Web and mobile apps, add the Android app from managed Google Play and set it to force-install for the OUCorrect
   • BApps > Google Workspace Marketplace apps, add the Android app to the allowlist for individual install
   • CDevices > Networks, publish the app as a managed configuration profile for the network
   • DApps > Additional Google services, turn on the Google Play service setting for the OU
   ✓ Correct answer: A

   Android apps are added and distributed through managed Google Play under Apps, Web and mobile apps, where an administrator can set an app to force-install for an organizational unit. Force-installing places the app on managed devices automatically.

   Why the other options are wrong

   • BThe Marketplace allowlist applies to Workspace add-ons for individual install, not native Android app distribution.
   • CThe Networks section manages Wi-Fi, Ethernet, VPN, and certificate profiles, not app distribution.
   • DAdditional Google services toggles Google-owned services and is not the Android app distribution surface.
9. Question 9Managing browsers and endpoints

   Ptarmigan Games wants dedicated hardware that automatically launches a single web app in full-screen kiosk mode with no user sign-in. Which managed entity supports auto-launching a kiosk app?

   • AA managed ChromeOS device configured with a kiosk appCorrect
   • BAn enrolled Chrome browser running on Windows
   • CA managed Chrome profile signed in on any browser
   • DA Chrome Browser Cloud Management enrollment token
   ✓ Correct answer: A

   Auto-launching a single app in kiosk mode is configured on managed ChromeOS devices through device settings, which is designed for unattended, single-purpose hardware. Enrolled browsers, managed profiles, and enrollment tokens do not provide ChromeOS kiosk auto-launch.

   Why the other options are wrong

   • BAn enrolled Windows browser runs a full desktop OS and does not offer ChromeOS kiosk auto-launch.
   • CA managed profile customizes a signed-in user's browsing, not an unattended kiosk.
   • DThe enrollment token is a mechanism to enroll browsers, not a kiosk configuration.
10. Question 10Monitoring and troubleshooting common issues

    An Aspen Dental Group user forwards a message they received that took hours to arrive and looked suspicious. The administrator wants to see the delivery hops with the time spent at each, plus the SPF, DKIM, and DMARC results, all from the message itself. Which tool is designed for this?

    • AThe Google Admin Toolbox Messageheader toolCorrect
    • BEmail Log Search in the Admin console
    • CThe Google Admin Toolbox Check MX tool
    • DThe Google Admin Toolbox Dig tool
    ✓ Correct answer: A

    Messageheader parses a message's full headers that you paste in, laying out each Received hop with the delay at each step and summarizing the SPF, DKIM, and DMARC results. That is exactly what analyzing a single suspicious, slow message requires.

    Why the other options are wrong

    • BEmail Log Search reports delivery status from Google's logs but does not parse a pasted message's hop-by-hop delays and authentication details.
    • CCheck MX inspects a domain's mail configuration, not the headers of an individual message.
    • DDig performs DNS lookups and cannot analyze a message's headers.

Who this Associate Google Workspace Administrator practice exam is for

This practice set is for anyone preparing for the Associate Google Workspace Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced Google practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Associate Google Workspace Administrator practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Associate Google Workspace Administrator exam.

Related Google resources

• Associate Google Workspace Administrator study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• GCP Associate Cloud Engineer practice examRelated
• Google Cloud Associate Data Practitioner practice examRelated
• Google Cloud Generative AI Leader practice examRelated

Associate Google Workspace Administrator practice exam FAQ