Google Cloud · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A user is leaving the company. You need to keep their data for 7 years. What is the best practice?
Export all data to a PST file
Transfer Drive ownership to another user
Suspend the user account and keep it
Create a Vault hold for the user's account
A Vault hold preserves the user's data indefinitely, satisfying the seven-year retention requirement without relying on the account itself. Unlike litigation hold on a mailbox, a Vault hold applies across Gmail, Drive and Meet recordings, and survives licence removal, so data remains accessible after the account is deleted.
You need to ensure that credit card numbers are not sent via Gmail by your employees. Which tool should you configure?
Context-aware access
DLP rules
DLP rules inspect outbound email content for sensitive data patterns, such as credit card numbers, and block or quarantine messages that match. Configuring them in Google Workspace directly satisfies the requirement to prevent employees sending card numbers through Gmail, enforcing protection at the message level before delivery occurs.
Google Vault retention rules
Security center investigation tool
You need to prevent users from sharing sensitive files outside the organization. Which setting should you modify?
Endpoint management
Vault retention settings
Drive sharing options in the Admin Console
Drive sharing options govern external sharing permissions for Google Drive content, letting administrators restrict files from being shared beyond the organisation's domain. This directly satisfies the requirement to prevent sensitive files leaving the organisation, since the setting controls whether users can grant access to external recipients.
App access control
How can you ensure that deleted emails are kept for 3 years even if the user empties their trash?
Enable endpoint management
Use an Admin Console report
Configure a Gmail filter
Set a Gmail retention rule in Google Vault
A Google Vault retention rule preserves messages independently of the user's mailbox, so emptying Trash cannot remove them before the three-year period expires. Vault holds data at the archive layer, satisfying the stem's requirement that deletion survive user action.
Your legal team requires that all emails from a specific user be preserved for an upcoming audit. Which tool should you use to ensure these messages are not deleted?
Data Loss Prevention (DLP) rules
Google Workspace Migration for Microsoft Outlook
Admin Console Reporting
Google Vault
Google Vault applies a retention rule or legal hold directly to the specified user's mailbox, preserving every message regardless of deletion by the user. This satisfies the legal team's audit requirement, since held content remains searchable and exportable until the matter is closed or the hold is removed.
You need to investigate a potential data breach where a user downloaded a large number of sensitive files. Which tool provides the most granular audit logs for Drive file downloads?
Security center investigation tool
The security centre investigation tool surfaces per-file Drive audit events, including the specific user, timestamp, file ID and download action, satisfying the need for granular download-level detail. Unlike aggregated usage reports or alert-only dashboards, it exposes individual access records, letting you trace exactly which sensitive files the user downloaded.
DLP policy logs
Vault eDiscovery search
Reports dashboard
Want more Data Governance And Compliance practice?
Practice this domainYou need to ensure that all corporate-owned Android devices require a screen lock. Where should you configure this setting?
Apps > Google Workspace > Android settings
Devices > Mobile & endpoints > Settings > Android > Password settings
Password settings under Android within Mobile & endpoints define screen lock requirements, including lock type and timeout, applied to enrolled corporate-owned devices. This satisfies the requirement that all corporate-owned Android devices enforce a screen lock.
Security > Authentication > Password policy
Directory > Users > Security settings
You want to require that all corporate-owned iOS devices are encrypted. How is this achieved?
Enable Advanced Mobile Management for all iOS users
Use an MDM profile to force file-level encryption
Configure a passcode policy in the iOS device management settings
A passcode policy in the iOS device management settings enforces encryption, satisfying the requirement that all corporate-owned iOS devices are encrypted. On iOS, setting a passcode automatically enables hardware-based data protection encryption; without a passcode, files remain unencrypted. No separate encryption toggle exists, so the passcode policy is the mechanism.
Enable the 'Require disk encryption' setting in iOS mobile settings
You are configuring Endpoint Verification. What is the primary purpose of the Endpoint Verification extension on a user's browser?
To collect device information for context-aware access
The Endpoint Verification extension reports device attributes such as screen lock, encryption, OS version and disk status to Google, which context-aware access then evaluates against access levels. It satisfies the stem's requirement by supplying device trust signals for policy decisions.
To enable remote wipe capabilities
To enforce password complexity
To block all malicious websites
You are setting up Context-Aware Access. You want to deny access to Google Workspace if the device is not encrypted. Which tool identifies the 'is_encrypted' attribute?
Device policy controller
Endpoint Verification extension
The Endpoint Verification extension reports device attributes, including is_encrypted, to Google Workspace, letting Context-Aware Access evaluate encryption state in its access level conditions. Without that signal, the access level cannot determine whether a device meets the encryption requirement.
Admin console audit logs
Google Cloud Identity sync
You need to deploy a specific Android application to a subset of users. What is the correct procedure?
Instruct users to download it themselves from the Play Store
Upload the APK file to the server and email the link to users
Use a third-party MDM integration
Use the 'Apps' section in the Admin console to select the app from Managed Google Play and assign it to an OU
Managed Google Play hosts approved Android apps; selecting the app under Apps in the Admin console and assigning it to the target organisational unit scopes distribution precisely. This satisfies the requirement to deploy the application to a subset of users rather than the whole organisation.
A user claims their corporate data is not being wiped after they left the company. You previously issued a 'wipe device' command. What should you check to verify the outcome?
The Admin console audit log for mobile management
The mobile management audit log records each wipe command and its outcome, showing whether the device acknowledged and completed the wipe or the command failed. Reviewing it verifies what actually happened after the wipe was issued.
The Google Cloud Platform logs
The user's account status in the directory
The user's Gmail sent items
Want more Endpoint Management practice?
Practice this domainYour organization requires all contractors to use security keys for 2-Step Verification, while full-time employees can use prompts or authenticator apps. How should you configure this in the Google Admin console?
Modify the default domain-wide sign-in security policy to require security keys globally and grant exceptions via API.
Configure Context-Aware Access to block non-security key authentications for the contractors group.
Create an IAM custom role that revokes prompt-based authentication for external users.
Place contractors in a dedicated OU, navigate to Security > Authentication > 2-step verification, and configure the allowed methods to only include security keys.
Placing contractors in a dedicated OU lets you apply an authentication policy scoped to that group alone, satisfying the requirement that only contractors are restricted. Within Security > Authentication > 2-step verification, limiting allowed methods to security keys enforces phishing-resistant hardware authentication, while employees in other OUs retain prompts and authenticator apps.
You need to create a custom administrator role that allows specific users to manage Google Meet hardware devices and review their health status, but nothing else. Which privilege category should you select when building this custom role?
Services > Google Meet hardware
Selecting Services > Google Meet hardware grants only the privileges needed to manage Meet hardware devices and view their health, satisfying the least-privilege constraint. It excludes unrelated services, so the custom role cannot administer Gmail, Drive or other workloads.
Organizational Units and Admin Roles
Mobile and Endpoints > Device Management
Security Center > Investigation Tool
You need to ensure that users can only access Google Workspace services when they are connecting from corporate-owned devices managed by Endpoint Management and located within the corporate IP range. Which feature combination meets this requirement?
Context-Aware Access access levels referencing IP subnets and device policy compliance, assigned to targeted apps.
Context-Aware Access access levels combine IP subnet conditions with device policy compliance, and assigning them to targeted apps enforces both constraints at access time. This satisfies the requirement that access occur only from managed corporate devices within the corporate IP range.
Google Cloud IAM conditions with Context-Aware Access and Security Health Analytics
Domain-wide SAML SSO with custom attribute mapping for IP addresses
Advanced Protection Program combined with Context-Aware Access
An administrator needs to enforce 2-Step Verification for all users in the Sales organizational unit (OU). Where in the Google Admin console should the administrator navigate to configure this setting?
Account settings > Security settings > 2SV
Directory > Users > Security > Access control
Security > Authentication > 2-step verification
Security > Authentication > 2-step verification is the console path holding enforcement settings, where you select the Sales OU and set enforcement to on. This satisfies the stem's requirement to apply 2-Step Verification to a specific organisational unit.
Devices > Mobile & endpoints > Settings > Universal settings
An organization wants to prevent users from signing in to their Google Workspace accounts from outside their home country. Which feature should the administrator configure?
Data Region Policy
Context-Aware Access
Context-Aware Access evaluates conditions such as geographical location before granting access, so an access level can deny sign-ins originating outside the home country. This directly satisfies the requirement to block authentication attempts from foreign locations.
Advanced Protection Program
Password Monitoring
Your company has an external contractor who needs temporary access to Google Workspace. You want to ensure their account automatically deactivates after 30 days without manual administrative intervention. How can you achieve this securely?
Enable the Advanced Protection Program, which automatically deletes inactive external accounts after 30 days.
Use Cloud Identity Premium automated user lifecycle management or the Admin SDK API to schedule account suspension after 30 days.
Cloud Identity Premium's automated lifecycle management, or the Admin SDK API, enforces time-bound access by suspending the contractor account on a scheduled date, satisfying the 30-day automatic deactivation constraint without manual intervention. This removes standing access risk while retaining auditability, unlike manual reminders or shared credentials.
Set the user password expiration policy specifically for that user's OU to 30 days.
Configure a Context-Aware Access rule with a time-based expiration condition.
Want more Security Policies And Access Controls practice?
Practice this domainA user is unable to sync their Google Drive files to their local machine using Drive for Desktop. What is the first step you should recommend?
Reset the user's password.
Reinstall the entire Google Workspace account.
Disable multi-factor authentication.
Check the Drive for Desktop application status and error logs.
Checking Drive for Desktop's status and error logs first isolates whether the fault lies in the client itself — authentication, cache corruption, or a stalled sync process — before touching network or account settings. This satisfies the stem's requirement for the initial diagnostic step, since the application's own telemetry pinpoints the failing component directly.
An organization uses a third-party gateway to route email. Users report that emails are being marked as spam frequently. Which DNS record should you investigate to ensure Google trusts the gateway?
DKIM record
A record
SPF record
The SPF record authorises the third-party gateway's sending IP addresses to send on the domain's behalf. If it omits the gateway, Google's receiving servers see unauthorised senders and flag messages as spam. Updating the SPF record to include the gateway satisfies the requirement that Google trusts mail routed through it.
MX record
A user has left the company. You need to migrate their data to another user. Which tool should you use?
Data Migration Service
Data Migration Service transfers Drive files owned by the departing user to another user, satisfying the requirement to migrate their data. It preserves sharing permissions and folder structure during the transfer, unlike simple ownership reassignment or manual downloads. This makes it the appropriate tool for migrating a leaver's Drive content to a colleague.
Security Investigation Tool
Google Takeout
Google Vault
A user claims they cannot see a shared calendar. What should you check to resolve this?
User's secondary email
Calendar sharing permissions
Calendar sharing permissions directly govern whether a shared calendar appears for the user, so verifying the grant on the calendar's sharing settings resolves the visibility failure. This satisfies the stem's constraint: the user cannot see the calendar, which sharing permissions control. Confirm the user holds at least Reviewer or higher, since insufficient rights hide it.
User's password
Browser cache
A user reports that they are not receiving emails from an external vendor. As an administrator, where should you first look to verify if the messages reached Google's servers?
Email Log Search
Email Log Search queries Google's mail infrastructure directly, showing whether inbound messages from the vendor reached Google's servers and what happened afterwards. This satisfies the need to verify server-side delivery before investigating the recipient's mailbox or vendor-side sending issues.
Security Dashboard
Reports > User usage
Gmail > Compliance settings
A user reports that emails sent to a specific external domain are bouncing with a '550 5.7.1' error. What is the likely reason?
The message size exceeds the limit.
The domain's email authentication (SPF/DKIM/DMARC) is failing.
A 550 5.7.1 rejection typically indicates the receiving server refused the message due to authentication failure. If the sending domain's SPF, DKIM, or DMARC alignment fails, the recipient's policy rejects it, satisfying the scenario of bounces to one external domain.
The user's storage quota is exceeded.
The recipient's mailbox is full.
Want more Troubleshooting practice?
Practice this domainYou are automating user creation via the Directory API. Which scope is required to create users?
https://www.googleapis.com/auth/admin.reports.audit.readonly
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.domain.readonly
https://www.googleapis.com/auth/admin.directory.user
The admin.directory.user scope grants full read/write access to user resources in the Directory API, which is precisely what user creation requires. Read-only scopes such as admin.directory.user.readonly cannot create accounts, and the broader admin.directory.user.alias scope only manages aliases, so this scope satisfies the stem's write requirement.
Which tool would you use to sync local Active Directory users to Google Workspace?
Google Workspace Migrate
Google Cloud Directory Sync
Google Cloud Directory Sync connects directly to on-premises Active Directory via LDAP and provisions users into Google Workspace, satisfying the requirement to sync local AD accounts. It maps AD attributes to Workspace fields and runs scheduled synchronisations, unlike Microsoft Entra ID, which targets Microsoft 365 rather than Google's directory.
Directory API
Admin SDK
An administrator mistakenly deleted a user account 10 days ago. How can you restore this account?
Contact Google Support for data recovery
Restore from a Vault export
Create a new user with the same email
Use the Restore User tool in the Admin console
The Admin console's Restore User tool recovers accounts deleted within the 20-day retention window, satisfying the 10-day constraint. Restoration reinstates the account with its prior data and group memberships, unlike recreating it manually. This is the native Google Workspace recovery path for recently deleted users.
You have multiple domains in a single Google Workspace account. How can you provision users in a specific sub-domain?
Rename the primary domain
Use a group alias
Create an OU for the domain
Select the domain from the dropdown in the 'Add user' dialog
The 'Add user' dialog includes a domain dropdown listing every verified domain in the account, so selecting the target sub-domain creates the user there directly. This satisfies provisioning into a specific sub-domain without separate admin accounts.
You need to add a secondary domain to your Google Workspace account. What must you perform after adding the domain in the Admin console?
Verify domain ownership
Verifying domain ownership is mandatory because Google must confirm you control the DNS before it will provision the secondary domain. Adding the domain in the Admin console only creates a pending entry; verification via a TXT or CNAME record activates it, satisfying the requirement that ownership be proven before the domain becomes usable.
Create a new OU
Set up SPF records
Provision user accounts
A new employee needs access to Google Workspace. What is the minimum action required in the Google Admin console to create the account?
Assign a Google Groups membership
Configure an alias
Add a user and assign a Google Workspace license
Creating the user in the Admin console and assigning a Google Workspace licence provisions the account and grants access to services. This single action satisfies the minimum requirement, since an unlicensed user cannot access Workspace core services.
Create an organizational unit
Want more User Accounts Domains And Directory practice?
Practice this domainWhich setting allows you to see what files are being shared externally across your entire domain?
Drive Audit Log
Apps > Google Workspace > Drive > Sharing audit
Report > User Reports > Drive
Security Investigation Tool
The Security Investigation Tool runs domain-wide queries over Drive logs, letting admins search sharing events and external visibility across all users. This satisfies the requirement to see files shared externally across the entire domain, unlike per-file or per-user sharing reports.
You need to prevent users from sharing Google Drive files with people outside the organization. Which setting should you modify?
Directory > Users > Sharing
Account > Organizational units > Restrictions
Security > Access and data control > Drive
Apps > Google Workspace > Drive and Docs > Sharing settings
Sharing settings under Apps > Google Workspace > Drive and Docs control external sharing at the organisational unit level, letting you restrict files from being shared outside the domain. This directly satisfies the requirement to block external sharing.
Your organization requires that all Google Meet recordings be saved to a specific shared folder. How can you automate this?
Set the 'Default storage' path in Apps > Google Workspace > Meet
It is not possible to change the default location via Admin Console settings
Google Meet recordings default to the organiser's Drive, and the Admin Console offers no setting to redirect them to a shared folder. Automation therefore requires Drive API scripting or Workspace Studio workflows that move files post-recording, satisfying the requirement indirectly rather than through native configuration.
Configure the 'Recording location' in Meet settings
Create a Drive retention policy for Meet
You want to ensure that users cannot change their profile photo. Where is this setting located?
Security > Account settings
Account > Account settings > Profile editing
Profile editing under Account settings controls which user attributes, including the profile photo, users may modify themselves. Disabling it prevents self-service photo changes while administrators retain control through the Microsoft Entra ID admin centre, satisfying the requirement that users cannot change their profile photo.
Directory > Users > Permissions
Apps > Google Workspace > Directory
You are setting up a new service account to access Gmail APIs. Where must you provide the required OAuth scopes to authorize access?
Account > Security > App access
Directory > Users > Service Accounts
Security > Access and data control > API controls > Manage domain-wide delegation
Domain-wide delegation authorises a service account to impersonate users and call Gmail APIs, and its OAuth scopes are configured in the Admin console under Security > Access and data control > API controls. This satisfies the requirement for where scopes must be provided.
Apps > Google Workspace > Gmail > API
You need to change the default language and region settings for all new users in a specific Organizational Unit. How do you do this?
Security > General > Account
Account > Account settings
Account settings under the top-level Account section let an administrator set default language and region for new users, applied per organizational unit. This satisfies the stem's requirement to change defaults for all new users within a specific OU.
Directory > Users > Account settings
Apps > Google Workspace > Profile
Want more Core Workspace Services practice?
Practice this domainThe vendor does not publish an exact question count for the GWS-ADMIN; the exam lasts 120 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Data Governance And Compliance, Endpoint Management, Security Policies And Access Controls, Troubleshooting, User Accounts Domains And Directory, Core Workspace Services. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Google Cloud GWS-ADMIN exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.