Associate Google Workspace Administrator

Last checked November 10, 2026 against the official Google Cloud exam page.

1. Question 1Managing core Workspace services

   An administrator notices that mail sent to the company's domain still arrives at the previous provider after the domain was moved to Google. Which DNS records must be changed so inbound mail is routed to Google?

   1. AThe MX records, so they point to Google's mail servers for the domain
   2. BThe SPF TXT record, so it lists Google's servers for outbound mail only
   3. CThe A record for the website, so it resolves to a Google web server
   4. DThe www CNAME record, so it points to the company's new hosting provider
   Show answer and explanationHide answer

   Correct answer: A

   MX records tell other mail servers where to deliver inbound mail for the domain, so they must point to Google. SPF controls which servers may send outbound mail and does not route inbound mail, while A and CNAME records serve web hosting.

2. Question 2Managing user accounts, domains, and Directory

   An employee's account is being removed after they leave the company. Their manager needs the employee's Drive documents to stay available to the team. What should the administrator do before deleting the account?

   1. AAsk the manager to request the files from Google Support after the account is deleted
   2. BDelete the account first and then try to restore the files from the trash
   3. CTransfer the employee's Drive files to the manager or a Shared Drive
   4. DShare each file with the team individually and leave the account active
   Show answer and explanationHide answer

   Correct answer: C

   Files owned by a user are tied to that account, so ownership should be transferred to the manager or a Shared Drive before the account is deleted. Waiting until after deletion risks losing the content, since a deleted account can be restored only for a limited time, and sharing files one by one does not change ownership, so they would still belong to an account being removed.

3. Question 3Managing security policies and access controls

   An administrator wants employees to sign in with a method that resists phishing and does not rely on a typed password or a one-time code. Which option best fits this goal?

   1. ASMS one-time codes sent to each employee's personal phone number for every sign-in attempt
   2. BSecurity questions answered during account recovery
   3. CPasskeys, which use device-bound cryptographic credentials to sign in
   4. DA password that expires and must be changed every month
   Show answer and explanationHide answer

   Correct answer: C

   Passkeys are phishing-resistant credentials bound to a device, so there is no reusable password or code for an attacker to capture. SMS codes can be phished or intercepted, security questions are weak, and monthly password changes do not stop phishing.

4. Question 4Managing data governance and compliance

   Legal counsel asks that all email and Drive files belonging to one employee be preserved for an open investigation, even if the employee deletes items. Which Google Vault feature should the administrator use?

   1. AA context-aware access level that restricts the employee's devices
   2. BA scheduled full mailbox export saved to the administrator's personal Drive
   3. CA hold on that employee's Gmail and Drive data in Google Vault
   4. DTwo-step verification enforced on the employee's sign-in
   Show answer and explanationHide answer

   Correct answer: C

   A Vault hold preserves matter-relevant data even when users delete it. An export copies data without preserving it in place, and context-aware access and two-step verification control sign-in rather than retention.

5. Question 5Monitoring and troubleshooting common issues

   A vendor reports that its messages land in spam. In a message header, the administrator sees spf=fail but dkim=pass. What is the most likely explanation?

   1. AThe vendor edited the message body after signing it, which broke the DKIM signature
   2. BThe vendor's sending server is not listed in the vendor domain's SPF record
   3. CThe recipient's MX record was changed to point at a different provider
   4. DA Vault hold on the recipient's account is blocking the vendor's messages
   Show answer and explanationHide answer

   Correct answer: B

   SPF fails when the sending server is not authorized in the domain's SPF record, while a DKIM pass shows the signature verified and the content was not altered. An MX change on the recipient side and a Vault hold do not produce an SPF result in the sender's headers.