Free Associate Google Workspace Administrator practice test: 30 questions with answers

MX records tell other mail servers where to deliver inbound mail for the domain, so they must point to Google. SPF controls which servers may send outbound mail and does not route inbound mail, while A and CNAME records serve web hosting.

SPF lists the servers allowed to send for the domain, DKIM signs messages so that tampering can be detected, and DMARC tells receivers how to act when checks fail. MX records route inbound mail, while Drive sharing and Vault settings do not authenticate outbound mail.

Drive sharing settings in the Admin console control the defaults applied to new files, so tightening them keeps files private unless someone changes the sharing. Disabling Drive removes the team's ability to work, PDF copies are not a sharing control, and granting Super Admin to everyone is a security risk.

A Shared Drive belongs to the organization rather than to any one person, so its files remain when members leave. Files in My Drive are owned by their creators, local copies are not centrally managed, and keeping a departed employee's account active is not a sound storage plan.

Calendar delegation lets one user act on another user's calendar without sharing credentials. Public visibility exposes event details to everyone, resource calendars represent rooms and equipment, and mail forwarding does not handle calendar invitations.

Files owned by a user are tied to that account, so ownership should be transferred to the manager or a Shared Drive before the account is deleted. Waiting until after deletion risks losing the content, since a deleted account can be restored only for a limited time, and sharing files one by one does not change ownership, so they would still belong to an account being removed.

Suspension blocks sign-in while keeping the account and its data, and restoring the account reverses it. Erasure happens through deletion, and the other options describe behaviour that Workspace does not provide for a suspended user.

SAML single sign-on hands authentication to the existing identity provider, so users reuse their corporate sign-in. Two-step verification adds a second factor but does not connect Workspace to the identity provider, and a shared password removes individual accountability.

Google Cloud Directory Sync is the tool that synchronizes users and groups from an on-premises directory into Google Workspace. Vault, Takeout and the status dashboard do not manage directory records, so they cannot automate account provisioning.

Organizational units are the usual scope for giving different groups of users different service settings, and child units inherit from their parent unless a setting is overridden. Separate domains are not needed for this, a single top-level rule would reach everyone, and editing each user by hand does not scale.

Passkeys are phishing-resistant credentials bound to a device, so there is no reusable password or code for an attacker to capture. SMS codes can be phished or intercepted, security questions are weak, and monthly password changes do not stop phishing.

Context-aware access evaluates signals such as device security state and the user's IP address or location before allowing access. Email volume and interface color theme are not access signals, so they cannot be used to make an access decision.

Admin roles should match the job, so a prebuilt or custom role limited to user management keeps help desk staff from changing security settings. Super Admin access exceeds what the team needs, a shared login removes accountability, and removing role restrictions is the opposite of least privilege.

The investigation tool lets administrators search across mailboxes and act on matching messages, such as removing them. Takeout exports a single user's data, the status dashboard reports service incidents, and the message header analyzer only explains the routing and authentication details of one message.

The Marketplace allowlist controls which Marketplace apps users can install, so only reviewed apps are available to them. A Super Admin per app adds risk, disabling Drive is far broader than needed, and email approval of web links does not control app installation.

A Vault hold preserves matter-relevant data even when users delete it. An export copies data without preserving it in place, and context-aware access and two-step verification control sign-in rather than retention.

Retention rules define how long Vault keeps data for the scope they cover, while holds preserve specific matter data even after users delete it. The other options reverse the two roles or invent approval workflows and file-type limits that Vault does not impose.

A data loss prevention rule can detect sensitive content such as card numbers in Gmail and block or warn on messages sent outside the organization. Vault retention controls how long data is kept, Shared Drive roles govern file access, and Calendar resources are for booking rooms and equipment.

Drive labels classify files such as Confidential or Public, and that classification is the basis for applying policies to them. Calendar colors, group posting permissions and Gmail filters do not classify Drive content for policy enforcement.

Takeout is a user-initiated download of that user's own data, and data regions set where the organization's data is stored at rest. The Data Export tool is an administrator tool, and sign-in location is governed by access controls such as context-aware access, not by data regions.

SPF fails when the sending server is not authorized in the domain's SPF record, while a DKIM pass shows the signature verified and the content was not altered. An MX change on the recipient side and a Vault hold do not produce an SPF result in the sender's headers.

Email Log Search records delivery events so administrators can see whether a message was delivered, deferred or rejected. Takeout exports user data, the status dashboard shows service incidents, and the Drive audit log covers file events rather than mail delivery.

The Google Workspace Status Dashboard publishes service health and incident information, so it is the first place to check for a wider outage. Audit logs record admin and user actions, Vault searches find retained data, and the header analyzer examines email headers rather than service health.

The admin audit log records administrative changes with the actor and timestamp, which answers who changed what and when. The status dashboard reports service health, Email Log Search tracks mail delivery, and Vault holds retained content rather than configuration history.

A HAR file is a captured log of browser network activity, which helps support staff see the requests behind a failure. It is not a file backup, a mail settings export, or a device certificate.

Basic mobile management centers on the work account and work data, while advanced management adds device-wide policies and the ability to wipe the whole device. The other options misstate which device types each mode covers or invent behaviour that neither mode has.

An account wipe removes work account data while leaving personal content on a personally owned device. A full device wipe would erase personal data, and uninstalling the app or leaving the account active does not remove company data from the phone.

Chrome policies and extension settings applied to an organizational unit reach managed browsers for the users in that unit. Manual installs cannot be enforced centrally, and separate stores or emailed policy files are not how Chrome policies are managed.

Chrome Browser Cloud Management enrolls browsers so that administrator-set policies apply to them when users sign in. Shared profiles, group membership and disabling Chrome Sync do not deliver central policy enforcement.

Wiping a returned company device and removing it from management clears the former employee's data before reuse. Renaming an enrolled device leaves data in place, removing one app is not enough, and management does not block reassignment.