[Q19-Q36] Updated Jul-2025 Exam Engine or PDF for the Google Google-Workspace-Administrator test to help you quickly prepare for the Google exam!

4.5/5 - (2 votes)

Updated Jul-2025 Test Engine or PDF for the Google Google-Workspace-Administrator test to help you quickly prepare for the Google exam!

Full Google-Workspace-Administrator Practice Test and 103 unique questions with explanations waiting just for you, get it now!

Q19. You work for a small organization and are planning to deploy an upcoming Google Workspace feature. You want users to have access to the feature as soon as possible. What should you do?

Confirm that your organization is set to the rapid release option to ensure that your users receive new features when Google releases them.

Do nothing. No extra configuration is needed as all Workspace customers receive new features at the same time.

Confirm that your organization is set to the scheduled release option to ensure that your users receive new features when Google releases them.

Enable the new feature in a Workspace Sandbox organization, and roll out to users only after testing.

Q20. Per regulatory requirements, your company is required to keep the data of employees located in Germany within Europe and the data of employees located in the US within the US. The employees in Germany are in a separate organizational unit (OU) than employees in the US. You need to ensure that where employee data is stored is in compliance with the location regulations.
What should you do?

Instruct employees to use Drive for desktop to keep documents on their corporate computers.

Create two Groups. Assign employees into the Germany or US Group based on their location. Use Google Drive trust rules to prevent sharing between the Groups.

Navigate to the Data Regions function in the Admin console. Select the Europe region for employees in Germany, and select the US region for US employees.

Navigate to the Data Regions function in the Admin console. Select ‘No preference.’

Q21. Your company uses Google Workspace and has acquired a subsidiary that, for business reasons, will remain indefinitely on its existing third-party collaboration platform and legacy LDAP system.
This subsidiary operates autonomously with a separate, unfederated Active Directory forest. It is anticipated that interaction between the two companies will be infrequent and primarily conducted via email. Leadership’s minimum requirement is adding employees of that subsidiary to your corporate global address book (GAL). What should you do?

Configure GCDS on the subsidiary LDAP to provision their users with Cloud Identity licenses on the parent domain.

Create a script that uses the Directory API to sync the subsidiary’s contact list as shared contacts.

Publish a CSV file containing the subsidiary’s directory for your users to upload into Google Contacts.

Provision the subsidiary users with G Suite accounts on the parent domain for the additional benefit of allowing collaboration in Drive.

Q22. Your large organization, 80,000 users, has been on Google for two years. Your CTO wants to create an integrated team experience with Google Groups, Teams Drives, and Calendar. Users will use a Google Form and Apps Script to request a new “G-Team.” A “G-Team’ is composed of a Google Group and a Team Drive/ Secondary Calendar that is shared using that Google Group.
What two design decisions are required to implement this workflow securely? (Choose two.)

The Apps Script will need to run as a Google Workspace admin.

You will need a Cloud SQL instance to store “G-Team’ data.

The Google Form will need to be limited to internal users only.

The Apps Script will need to run on a timed interval to process new entries.

The Google Form will need to enforce Group naming conventions.

Q23. You work for an organization that is headquartered in Washington DC You want to reliably send email announcements to all employees in the area and update membership automatically What should you do?

Create a Dynamic Group by using the location condition to keep the distribution list automatically updated based on the employees work locations

Create a Security Group and apply the Location label to allow employees to join based on the specified location

Create a Google Group and add all employees in the Washington DC work location

Create a Google Group and set permissions to invite employees to join the group

Q24. Your organization has been using Google Workspace for almost a year, and your annual security and risk assessment initiative is approaching in preparation for the risk assessment you want to quickly review all the security-related settings for Gmail, Drive and Calendar and identify the ones that may be posing risk What should you do?

Review all the alerts in the Alert center

Review the Security health page in the Admin console

Review all settings for each organizational unit (OU) separately because it is the only way to see the security settings tor Workspace apps

Review the Gmail Drive, and Calendar reports in the Reporting section in the Admin console.

Q25. As a Workspace Administrator you want to keep an inventory of the computers and mobile devices your company owns in order to track details such as device type and who the device is assigned to. How should you add the devices to the company-owned inventory?

Download the company-owned inventory template CSV file from the Admin panel enter the serial number of the devices and upload the

completed file to the company-owned inventory in the admin panel B O Download the company-owned inventory template CSV file from the Admin panel enter the device OSs. and serial numbers and upload the

completed file to the company-owned inventory in the admin panel. C O Download the company-owned inventory template CSV file from the Admin panel enter the asset tags of the devices, and upload the

completed file to the company-owned inventory in the admin panel D O Download the company-owned inventory template CSV file from the Admin panel, enter the device OSs. and asset tags, and upload the

Q26. After migrating to Google Workspace, your legal team requests access to search all email and create litigation holds for employees who are involved with active litigation. You need to help the legal team meet this request.
What should you do?

Add the legal team to the User Management Admin system role.

Add the legal team to the Google Vault Google Group.

Create a custom role with Google Vault access, and add the legal team.

Create a matter in Google Vault, and share with the legal team.

Q27. You are applying device and user policies for employees in your organization who are in different departments. You need each department to have a different set of policies. You want to follow Google- recommended practices. What should you do?

Create separate top-level organizational units for each department.

Create an Access group for each department. Configure the applicable policies.

Add all managed users and devices in the top-level organizational unit.

Create a child organizational unit for each department.

Google recommends using the organizational unit (OU) structure for applying different settings and policies to different groups of users and devices within your Google Workspace domain. To apply a unique set of policies to each department, you should create a child organizational unit for each department under your main domain structure.
Here’s why option D aligns with Google’s best practices and why the others are less suitable:
* D. Create a child organizational unit for each department.
* Explanation: Organizational units provide a hierarchical structure for managing users and devices. By creating a child OU for each department, you can then apply specific device and user policies to that OU. Users and devices within a child OU inherit policies from parent OUs but can also have OU-specific policies that override or supplement the inherited ones. This allows for granular control and ensures that each department can have the policies tailored to its needs. This is the recommended method by Google for managing policies based on departments or other logical groupings within an organization.
* Associate Google Workspace Administrator topics guides or documents reference: The official Google Workspace Admin Help documentation on “How the organizational structure works” and “Apply settings for specific groups of users or devices” (or similar titles) clearly explains the purpose and benefits of using OUs for policy management. It emphasizes the hierarchical nature and how policies are applied and inherited through the OU structure. Creating child OUs for departments is a direct application of this recommended practice.
* A. Create separate top-level organizational units for each department.
* Explanation: Creating separate top-level OUs for each department is generally not recommended for managing policies within the same organization. Top-level OUs are meant to represent distinct functional or administrative units that might have their own domain settings and administrators. Managing all departments under a single domain but in separate top-level OUs can complicate overall administration, sharing, and user management across the organization.
Child OUs within a single domain provide the necessary separation for policy application while maintaining a unified organizational structure.
* Associate Google Workspace Administrator topics guides or documents reference: Google’s documentation on organizational structure usually advises on creating a logical hierarchy of child OUs under a single top-level OU representing the organization. Separating departments into top- level OUs is not a standard or recommended practice for policy management within a single domain.
* B. Create an Access group for each department. Configure the applicable policies.
* Explanation: Access groups are primarily used for controlling access to specific resources or services. While you can manage group membership based on departments, policies for users and devices are typically applied at the organizational unit level, not directly to access groups. While some settings might be influenced by group membership, OUs are the primary mechanism for policy enforcement.
* Associate Google Workspace Administrator topics guides or documents reference: The Google Workspace Admin Help distinguishes between organizational units and groups (including access groups). Policies are consistently described as being applied to OUs. Groups are for managing access and collaboration.
* C. Add all managed users and devices in the top-level organizational unit.
* Explanation: Applying all policies at the top-level OU would mean that all users and devices inherit the same set of policies. This contradicts the requirement of having different policies for each department. To achieve department-specific policies, you need to organize users and devices into separate OUs.
* Associate Google Workspace Administrator topics guides or documents reference: Google’s documentation emphasizes the flexibility of the OU structure to apply different policies to different subsets of users and devices. Placing everyone in the top-level OU negates this flexibility.
Therefore, the Google-recommended practice for applying different device and user policies to employees in different departments is to create a child organizational unit for each department. This allows for targeted policy application and management within the overall organizational structure.

Q28. You have configured Secure Transport (TLS) Compliance for all messages coming to and from an external domain. altostrat.com. that your end users communicate with via Gmail. What will your end users experience when messages are delivered to them from altostrat.com without TLS enabled?

The message will be delivered to their spam folder.

The message will not be delivered to the end user in any form.

The user will receive a failure message informing them that the message could not be delivered to their inbox and that they will need to work with their Workspace administrator to resolve the issue.

A warning banner will appear on the message informing the user that the message was not sent securely.

Q29. business information to all employees. They want to learn how often the site is being visited and how it is used. What should you do?

Embed a JavaScript page counter showing usage statistics.

Export the Apps Usage Activity Report showing Sites activity and send the daily report to the Communications and Training Department.

Add a Google Analytics Web Property ID to the Site.

Export the Drive Audit Log filtered to show Site Views.

Q30. Your organization recently deployed Google Workspace. Your admin team has been very focused on configuring the core services for your environment, which has left you little time to pay attention to other areas. Your security team has just informed you that many users are leveraging unauthorized add-ons, and they are concerned about data exfiltration. The admin team wants you to cut off all add-ons access to Workspace data immediately and block all future add-ons until further notice. However, they approve of users leveraging their Workspace accounts to sign into third-party sites. What should you do?

Modify your Marketplace Settings to block users from installing any app from the Marketplace.

Set all API services to “restricted access” and ensure that all connected apps have limited access.

Remove all client IDs and scopes from the list of domain-wide delegation API clients.

Block each connected app’s access.

Q31. Your organization has implemented Single Sign-On (SSO) for the multiple cloud-based services it utilizes. During authentication, one service indicates that access to the SSO provider cannot be accessed due to invalid information.
What should you do?

Verify the NameID Element in the SAML Response matches the Assertion Consumer Service (ACS) URL.

Verify the Audience Element in the SAML Response matches the Assertion Consumer Service (ACS) URL.

Verify the Subject attribute in the SAML Response matches the Assertion Consumer Service (ACS) URL.

Verify the Recipient attribute in the SAML Response matches the Assertion Consumer Service (ACS) URL.

Q32. Your organization is migrating their current on-premises email solution to Google Workspace. You need to ensure that emails sent to your domain are correctly routed to Gmail. What should you do?

Change the Mail Exchange (MX) records in your current email domain’s DNS settings to point to Google’s mail servers.

Set up email forwarding from your on-premises email provider to Gmail.

Create a content compliance rule to filter and route incoming emails.

Configure SPF, DKIM, and DMARC records in your current email domain’s DNS settings.

Q33. Your company maintains a strict privacy policy regarding the external sharing of certain information. You need to scan and block any outgoing email that contains certain sensitive data, such as credit card and national ID numbers. What should you do?

Create a content compliance rule that blocks any outbound email that contains sensitive data.

Create a Drive Data Loss Prevention (DLP) rule that blocks content with sensitive data.

Create a new Activity rule that sends a High severity alert for any outbound email that contains sensitive data.

Create a content compliance rule that warns the user when they’re sending any outbound email that contains sensitive data but still allows sending with proper justification.

Q34. Your organization has detected a significant rise in unauthorized access to applications from personal devices.
This poses a critical security risk and could lead to data loss. To mitigate this risk, you must immediately restrict user access to these applications. What should you do?

Limit apps access to company-issued devices by using context-aware access.

Enable multi-factor authentication for application access.

Enable data loss prevention rules.

Configure apps data access to Limited to only allow access to unrestricted services.

The problem states a “significant rise in unauthorized access to applications from personal devices,” posing a
“critical security risk” and potential “data loss.” The immediate goal is to “immediately restrict user access to these applications” from personal devices.
Context-Aware Access (CAA) is specifically designed to control access to Google Workspace applications based on the “context” of the user and their device. This includes whether the device is managed (company- issued) or unmanaged (personal), its security posture, IP address, and location. By configuring CAA policies, you can enforce that users can only access specific applications if they are using a company-issued device.
Here’s why the other options are less effective or not the primary solution for this immediate restriction:
* B. Enable multi-factor authentication for application access. MFA is a crucial security layer, but it authenticates the user, not the device. A disgruntled employee could still use their personal device with MFA enabled to download data if no device-based restriction is in place. It prevents unauthorized users but not authorized users on unauthorized devices.
* C. Enable data loss prevention rules. DLP rules are excellent for preventing sensitive data from leaving the organization (e.g., by blocking sharing of files containing credit card numbers). However, they don’t restrict access to applications based on the device type. An employee could still access and potentially download non-DLP-sensitive data from a personal device if only DLP is enabled. The immediate risk is access from personal devices, not just content-based data loss.
* D. Configure apps data access to Limited to only allow access to unrestricted services. This option typically refers to allowing specific APIs or services to be accessed by third-party apps, or perhaps limiting access within a highly restricted environment. It’s not a direct control mechanism for user access from personal vs. company-issued devices to core Google Workspace applications.
References from Google Workspace Administrator:
* Protect your business with Context-Aware Access: This is the primary documentation for Context- Aware Access, explicitly mentioning its use case for “Allow access to apps only from company-issued devices.” Reference: Google Workspace Admin Help: Protect your business with Context-Aware Access About Context-Aware Access: Provides an overview of how CAA works and its capabilities, including controlling access based on device security status (e.g., managed vs. unmanaged).
Reference: Google Workspace Admin Help: About Context-Aware Access

Q35. Your organization is concerned with the increasing threat of phishing attacks that may impact users.
Leadership has declined to force-enable 2-Step verification. You need to apply a security measure to prevent unauthorized access to user accounts.
What should you do?

Enable Enforce Strong Password policy.

Enable Employee ID Login Challenge.

Decrease the Maximum User Session Length.

Revoke token authorizations to external applications.

Q36. Your organization has just appointed a new CISO. They have signed up to receive admin alerts and just received an alert for a suspicious login attempt. They are trying to determine how frequently suspicious login attempts occur within the organization. The CISO has asked you to provide details for each user account that has had a suspicious login attempt in the past year and the number of times it occurred for each account.
What action should you take to meet these requirements?

Use the login audit report to export all suspicious login details for analysis.

Create a custom dashboard with the security investigation tool showing suspicious logins.

Use the account activity report to export all suspicious login details for analysis.

Create a custom query in BigQuery showing all suspicious login details.

Full Google-Workspace-Administrator Practice Test and 103 unique questions with explanations waiting just for you, get it now: https://www.examcost.com/Google-Workspace-Administrator-practice-exam.html