I85PREP
⌘ K
GCP Workspace Admin study materials
GCP Workspace Admin study resources

GCP Workspace Admin practice questions

One question at a time. Build your GCP Workspace Admin understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Manage user accounts and objects

A Workspace administrator needs to give a new employee a mailbox and access to the corporate directory. Which action creates the account and its Google Workspace services in one step?

  1. Issuing a Google Cloud IAM binding
  2. Creating a user in the Admin console Correct answer.
  3. Adding the address as a Groups alias
  4. Enrolling the device in endpoint management

Explanation

Creating a user in the Admin console provisions an account with a primary email address and the core services enabled for the organizational unit. Aliases and group addresses do not create a distinct user identity.

Question 2Manage user accounts and objects

Which Admin console path is used to add a single new user to the directory?

  1. Directory > Users > Add new user Correct answer.
  2. Apps > Google Workspace > Gmail > Routing
  3. Billing > Subscriptions > Add license
  4. Security > Authentication > Login challenge

Explanation

Individual accounts are created under Directory > Users, where the Add new user flow collects name, primary email, and password. The other paths configure services, billing, or security rather than directory objects.

Question 3Manage user accounts and objects

An admin wants to bulk-create 300 accounts from a spreadsheet. Which built-in capability should be used?

  1. Creating a Shared drive for each user
  2. Manually creating each user in the Admin console
  3. Importing users through Google Cloud IAM
  4. Using the Users bulk upload with a CSV file Correct answer.

Explanation

The Admin console supports bulk user upload via a CSV template, which creates many accounts in one operation. Manual creation, shared drives, and IAM do not provision Workspace users at scale.

Question 4Manage user accounts and objects

What is the primary purpose of an organizational unit in Google Workspace?

  1. To group users so settings and policies can be applied hierarchically Correct answer.
  2. To license Google Cloud resources per project
  3. To store files shared across the company
  4. To provide a shared mailbox for a department

Explanation

Organizational units form a hierarchy under the account and let admins apply service and policy settings to subsets of users. They are not mailboxes, licenses, or storage containers.

Question 5Manage user accounts and objects

Which object should an admin create to give a team a single email address that delivers to multiple members?

  1. A user alias
  2. A Google Group Correct answer.
  3. A secondary domain
  4. A super admin role

Explanation

A Google Group has its own address and delivers mail to all its members, making it the right object for a team address. Aliases belong to a single user, secondary domains are namespaces, and admin roles grant privileges.

Question 6Manage user accounts and objects

A user needs an additional email address that delivers to the same mailbox without creating a new account. What should the admin add?

  1. A Google Group membership
  2. A secondary domain
  3. An email alias for the user Correct answer.
  4. A delegated mailbox

Explanation

An email alias is an alternate address attached to an existing user that delivers to that user's mailbox. Groups, domains, and delegation serve different purposes.

Question 7Manage user accounts and objects

Which role grants the broadest administrative control over a Google Workspace account?

  1. Help Desk Admin
  2. Super Admin Correct answer.
  3. Groups Admin
  4. Storage Admin

Explanation

Super Admin includes all administrative privileges across the account, including security and billing. The other predefined roles cover narrower scopes.

Question 8Manage user accounts and objects

An admin must suspend a departing employee's account while preserving its data for a later transfer. Which action meets this requirement?

  1. Suspend the user Correct answer.
  2. Remove the user from all groups
  3. Change the user's password
  4. Delete the user immediately

Explanation

Suspending an account blocks sign-in while keeping the mailbox and Drive data intact for later transfer. Deleting removes the account and starts data deletion.

Question 9Manage user accounts and objects

What happens to a user's data when the account is deleted and no data transfer is performed?

  1. Data becomes available to all super admins
  2. Data is eventually purged after the recovery window Correct answer.
  3. Data is automatically moved to a Shared drive
  4. Data is retained indefinitely by default

Explanation

Deleted users can be restored for a limited period, after which the account and associated data are permanently removed. Retention is not indefinite and data is not auto-migrated.

Question 10Manage user accounts and objects

An admin wants new hires in the Sales OU to automatically receive a signature template and specific Gmail settings. What is the most appropriate mechanism?

  1. Create a Google Group named Sales
  2. Set the options per user manually
  3. Configure settings at the Sales OU level Correct answer.
  4. Apply the settings at the root OU only

Explanation

Settings applied to an organizational unit are inherited by users in that OU, so configuring at the Sales OU level applies them automatically to new hires. Per-user changes do not scale and root-level settings affect everyone.

Question 11Manage user accounts and objects

A user in a child OU has a setting that differs from the parent OU. How does inheritance resolve this?

  1. The user is moved to the parent OU automatically
  2. Both settings are applied and conflict
  3. The child OU setting takes precedence for its users Correct answer.
  4. The parent setting always overrides the child

Explanation

Settings cascade down the hierarchy, and a value set on a child OU overrides the inherited parent value for users in that child. The parent does not force its value once the child is explicitly configured.

Question 12Manage user accounts and objects

An admin needs to rename a user's primary email address after a legal name change while keeping the old address working. What should be done?

  1. Rename the user and add the old address as an alias Correct answer.
  2. Delete and recreate the account with the new name
  3. Change only the display name
  4. Create a new user and forward the old mailbox

Explanation

Renaming the user updates the primary address, and adding the previous address as an alias keeps mail to the old address delivered. Deleting or creating a separate account risks data loss and duplication.

Question 13Manage user accounts and objects

Which statement about a user alias is accurate?

  1. It creates a separate Drive storage quota
  2. It delivers mail to the user's mailbox Correct answer.
  3. It can be used to sign in to Google services
  4. It requires its own license

Explanation

An alias is an alternate address that routes mail to the owning user's mailbox; it is not a sign-in identity and does not carry its own storage or license.

Question 14Manage user accounts and objects

A company wants to reuse a domain address for a distribution list without consuming a user license. Which object is most appropriate?

  1. A super admin account
  2. A Google Group with that address Correct answer.
  3. A user account with an alias
  4. A secondary domain

Explanation

A Google Group can own an address and deliver to members without requiring a per-user license for the address itself. A user account consumes a license, and domains and admin roles are unrelated.

Question 15Manage user accounts and objects

An admin must delegate mailbox access so an assistant can read and send from an executive's Gmail. Which feature should be configured?

  1. A Groups alias
  2. Mail delegation Correct answer.
  3. An OU policy
  4. A secondary domain

Explanation

Mail delegation grants another user access to a mailbox without sharing the password. Aliases, domains, and OU policies do not provide delegated mailbox access.

Question 16Manage user accounts and objects

What is the effect of placing a user in a suspended state versus archiving their data with a transfer?

  1. Suspension deletes all data; transfer keeps it in place
  2. Both actions permanently remove the account
  3. Suspension moves data to a Shared drive automatically
  4. Suspension blocks sign-in but keeps data; transfer moves data to another user Correct answer.

Explanation

Suspension disables sign-in while retaining data, whereas a data transfer reassigns Drive and mail data to another user before deletion. These are distinct lifecycle operations.

Question 17Manage user accounts and objects

An admin wants to enforce that all users in a specific OU must use a strong password policy. Where should this be configured?

  1. At the OU level in security settings Correct answer.
  2. Per user in each account's settings
  3. In the Google Cloud IAM policy
  4. In each user's Gmail signature

Explanation

Password policies are applied through security settings at the OU level so all users in that unit inherit the requirement. Per-user configuration does not scale, and the other locations do not control passwords.

Question 18Manage user accounts and objects

Which predefined admin role is best suited for a support technician who only needs to reset user passwords?

  1. Groups Admin
  2. Super Admin
  3. User Management Admin
  4. Help Desk Admin Correct answer.

Explanation

The Help Desk Admin role is scoped to support tasks such as password resets without granting broad directory or security control. Super Admin and User Management Admin exceed the need, and Groups Admin is unrelated.

Question 19Manage user accounts and objects

An admin needs to move a subset of users into a new department OU so different Drive sharing policies apply. What is the correct approach?

  1. Assign the users a new license
  2. Change each user's display name
  3. Create a new group and add the users
  4. Create the OU and move the users into it Correct answer.

Explanation

Organizational units control policy application, so creating the OU and moving users into it causes the OU's Drive sharing settings to apply. Groups, display names, and licenses do not change policy scope.

Question 20Manage user accounts and objects

A company adds a secondary domain and wants new users to have addresses on that domain by default. What must be configured?

  1. Create a group for the new domain
  2. Set the secondary domain as a domain alias only
  3. Add the domain as a secondary domain and create users on it Correct answer.
  4. Add the domain to each user as an alias

Explanation

A secondary domain is a full namespace where users can be created with primary addresses on that domain. A domain alias only provides alternate addresses for existing users.

Question 21Manage user accounts and objects

An admin deletes a user by mistake and needs to restore the account and its data. What should be done within the recovery window?

  1. Restore the user from the deleted users list Correct answer.
  2. Reassign the license to a new account
  3. Recreate the user with the same address manually
  4. Import the mailbox from a Groups archive

Explanation

Recently deleted users can be restored from the deleted users list during the recovery period, which reinstates the account and its associated data. Manual recreation does not recover the original data.

Question 22Manage user accounts and objects

An admin wants to ensure that when an employee leaves, their Drive files are preserved and owned by their manager before the account is deleted. Which sequence is correct?

  1. Delete the user, then transfer data afterward
  2. Suspend the user and leave data unassigned
  3. Transfer the user's data to the manager, then delete the user Correct answer.
  4. Remove the user from groups, then change the password

Explanation

Data should be transferred to a new owner before deletion so files remain accessible and owned within the organization. Deleting first risks losing data once the recovery window closes.

Question 23Manage user accounts and objects

A Workspace admin wants to require that a subset of privileged users complete a stronger sign-in challenge than the rest of the company. Which approach fits the Workspace model?

  1. Set a single account-wide password length
  2. Add the users to a Google Group
  3. Disable two-step verification for everyone
  4. Apply the authentication policy to an OU containing those users Correct answer.

Explanation

Authentication settings are applied per organizational unit, so placing privileged users in their own OU allows a stricter sign-in requirement for just that group. Account-wide or group-based changes do not target authentication policy.

Question 24Manage user accounts and objects

An organization uses both a primary domain and a domain alias. What is a key difference between a domain alias and a secondary domain?

  1. A domain alias lets existing users receive mail at the alias domain; a secondary domain can host separate new users Correct answer.
  2. A domain alias replaces the primary domain entirely
  3. A domain alias requires new licenses; a secondary domain does not
  4. A secondary domain cannot be used for email

Explanation

A domain alias gives existing users alternate addresses on another domain, while a secondary domain is a separate namespace where distinct users can be created. Neither replaces the primary domain.

Question 25Manage user accounts and objects

An admin needs to grant a manager the ability to manage group membership for their department without granting broader admin rights. Which approach is most appropriate?

  1. Give the manager the Groups Admin role for the whole account
  2. Make the manager an owner of the specific group Correct answer.
  3. Add the manager to the group as a member
  4. Assign Super Admin to the manager

Explanation

Making the manager an owner of a specific group grants management of that group's membership without account-wide privileges. Super Admin and account-wide Groups Admin exceed the requirement, and membership alone grants no management rights.

Question 26Manage user accounts and objects

Which action immediately blocks a user from signing in while retaining the mailbox, Drive files, and license assignment for later restoration?

  1. Renaming the user's primary email address
  2. Suspending the user account Correct answer.
  3. Removing the user from all groups
  4. Deleting the user account and purging the trash

Explanation

Suspending an account blocks sign-in and access to Workspace services while the account, its data, and its license association remain in place. The admin can later restore the account with its content intact. Deletion begins a retention window after which data is purged, and the other options do not block sign-in.

Question 27Manage user accounts and objects

An admin creates a new user and assigns a password. Which setting determines whether the user must choose a new password at first sign-in?

  1. The user's group membership type
  2. The organizational unit's password length policy
  3. The domain's MX record configuration
  4. The 'Change password at next sign-in' checkbox on the user Correct answer.

Explanation

The user creation and reset flows include a checkbox that forces a password change on the next sign-in. Password policies govern strength and reuse but do not by themselves force a first-login change. Mail routing and group type are unrelated to credential reset behavior.

Question 28Manage user accounts and objects

An admin wants to add a second domain so that users can also receive mail at addresses on that domain, but does not want to create separate accounts on it. Which configuration achieves this?

  1. A Google Group
  2. A subdomain
  3. A domain alias Correct answer.
  4. A secondary domain

Explanation

A domain alias gives every existing user an additional address on the alias domain that delivers to the same mailbox, without creating new accounts. A secondary domain creates a separate namespace where users must be created explicitly. Subdomains and groups do not provide per-user alternate addresses across the whole organization.

Question 29Manage user accounts and objects

A user's primary email address must be changed from [email protected] to [email protected], and mail sent to the old address should continue to reach the mailbox. What should the admin do?

  1. Rename the user's display name to the new address
  2. Create a new user for the new address and forward the old mailbox to it
  3. Add the new address as an alias and leave the primary unchanged
  4. Change the primary address and add the old address as an alias Correct answer.

Explanation

Changing the primary address updates the account's identity, and adding the former address as an alias keeps mail to it flowing to the same mailbox. Creating a second user splits data and licensing. An alias alone does not make the new address the primary identity, and display name changes do not affect addresses.

Question 30Manage user accounts and objects

An admin must give a team lead the ability to add and remove members of a specific Google Group without granting rights to modify users or organization-wide settings. What is the most appropriate approach?

  1. Share the group's settings page credentials with the team lead
  2. Assign the team lead the Super Admin role
  3. Make the team lead an owner or manager of that specific group Correct answer.
  4. Assign the team lead the Groups Admin predefined role

Explanation

Group-level roles such as owner or manager grant membership management scoped to that group only. Predefined admin roles like Groups Admin apply across the organization, which exceeds the requirement. Super Admin and credential sharing violate least privilege.

Question 31Manage user accounts and objects

An admin needs to bulk create 500 user accounts with consistent OU placement and group membership. Which approach is most efficient and repeatable?

  1. Manually creating each user in the Admin console
  2. Uploading a CSV file of users in the Admin console Correct answer.
  3. Sending each user a self-signup invitation link
  4. Creating the users one at a time through the Gmail settings page

Explanation

The Admin console supports bulk user upload from a CSV that specifies attributes such as OU and group membership, making the process repeatable. Manual creation does not scale, self-signup does not guarantee OU placement, and Gmail settings do not create accounts.

Question 32Manage user accounts and objects

An employee leaves the company. The admin must preserve the employee's Drive files under the manager's ownership and free the user license. Which sequence best meets these goals?

  1. Delete the user without any transfer and rely on the trash
  2. Change the user's password and give it to the manager
  3. Suspend the user and leave the license assigned indefinitely
  4. Transfer Drive data to the manager, then delete the user Correct answer.

Explanation

Transferring data first moves file ownership to the manager so the content survives account deletion. Deleting the user afterward removes the account and frees the license. Suspension preserves data but keeps consuming a license, and deletion without transfer eventually purges the data.

Question 33Manage user accounts and objects

An admin wants new users in the Contractors OU to be blocked from using Google Drive while employees in the parent organization continue to use it. How should this be configured?

  1. Disable Drive sharing settings for the entire domain
  2. Remove the Contractors from all groups that use Drive
  3. Set the Drive service to Off for the Contractors OU Correct answer.
  4. Set the Drive service to Off at the top-level organization

Explanation

Service on/off state is set per organizational unit and inherits down the hierarchy, so turning Drive off at the Contractors OU affects only that subtree. Setting it off at the root would disable Drive for everyone, including employees. Sharing settings and group membership do not block access to the service itself.

Question 34Manage user accounts and objects

An admin must restore a recently deleted user along with the account's associated data. Within what window must the restore be performed, and where is it done?

  1. Within 90 days, from the Drive sharing settings
  2. At any time, by recreating a user with the same address
  3. Within 24 hours, from the Gmail settings page
  4. Within 30 days, from the Users list filtered to recently deleted users Correct answer.

Explanation

Deleted users can be restored from the recently deleted view in the Admin console within the recovery window, which is 30 days by default, and restoration brings back the account and its data. Recreating a user with the same address does not recover the prior data. Gmail and Drive settings pages are not where account restoration occurs.

Question 35Manage core Workspace services

An administrator wants every new user in the organization to receive a temporary password that must be changed at first sign-in. Which Admin console setting controls this behavior?

  1. The session control length for Google services
  2. The API access control allowlist
  3. The 2-Step Verification enforcement setting
  4. The password policy configured for the organizational unit Correct answer.

Explanation

Password policies are set per organizational unit and can require a change on next sign-in, along with length and strength rules. Enforcement settings for 2SV and session control govern authentication factors and session duration, not password rotation at first login.

Question 36Manage core Workspace services

A company needs to route all outbound mail from its domain through a third-party security gateway before delivery. Which Gmail setting should the administrator configure?

  1. An outbound gateway in the Gmail routing settings Correct answer.
  2. A hosted S/MIME certificate for the domain
  3. A content compliance rule with a quarantine action
  4. A default routing rule that changes the envelope recipient

Explanation

An outbound gateway (also called outbound relay) sends mail from your users through a specified SMTP host before it leaves to external recipients. Content compliance and S/MIME handle inspection and signing rather than relaying, and recipient-changing rules alter addressing, not transport path.

Question 37Manage core Workspace services

Which Google Workspace service is the central place to define organizational units and apply service settings to subsets of users?

  1. The Google Workspace Marketplace
  2. Google Cloud IAM
  3. Google Endpoint Verification
  4. The Admin console Correct answer.

Explanation

The Admin console is where organizational units are created and where per-service settings are applied to users in those units. Cloud IAM governs Google Cloud resources, Endpoint Verification reports device state, and the Marketplace distributes third-party apps.

Question 38Manage core Workspace services

A user is in a child organizational unit that has Gmail disabled, while the parent OU has Gmail enabled. What is the effective state for that user?

  1. Gmail is disabled because the child OU setting overrides the parent Correct answer.
  2. Gmail is enabled because the parent setting takes precedence
  3. Gmail is enabled but only for internal messages
  4. Gmail is disabled only until the user accepts the terms of service

Explanation

Settings inherit down the OU tree, and a setting applied to a child OU overrides the value inherited from its parent. The most specific OU containing the user determines the effective service state.

Question 39Manage core Workspace services

Which tool should an administrator use to bulk-create hundreds of user accounts from a CSV file?

  1. The Google Workspace Directory API users.insert method called per row
  2. The Chrome Browser Cloud Management console
  3. Google Cloud Identity groups import
  4. The bulk upload users feature in the Admin console Correct answer.

Explanation

The Admin console provides a bulk upload users workflow that accepts a CSV template for creating many accounts at once. The Directory API can create users but requires scripting one call per user, groups import handles groups, and Chrome management handles browsers.

Question 40Manage core Workspace services

An administrator wants new hires to appear in the directory automatically from the HR system without manual CSV uploads. Which approach fits best?

  1. Turn on contact sharing for the domain
  2. Enable Directory Sync for Chrome devices
  3. Configure automated user provisioning from the HR app via the Marketplace Correct answer.
  4. Schedule a daily report export from the Admin console

Explanation

Automated user provisioning lets a connected application, such as an HR system, create and update accounts through the Marketplace integration. Reports are read-only exports, contact sharing affects address autocomplete, and Chrome device sync is unrelated to user lifecycle.

Question 41Manage core Workspace services

What is the primary purpose of a Google Workspace group in the context of service administration?

  1. To store shared files in a single Drive folder
  2. To grant access and settings to many users as one unit Correct answer.
  3. To replace organizational units entirely
  4. To provide a shared mailbox with its own password

Explanation

Groups bundle users so permissions, mailing lists, and access can be managed collectively. They complement rather than replace OUs, which control service settings, and they are not file containers or password-bearing mailboxes.

Question 42Manage core Workspace services

A security team wants to require a hardware security key for a subset of administrators while allowing other users to use any second factor. Which configuration achieves this?

  1. Set session length to one hour for the admin OU
  2. Disable 2SV for everyone and rely on password strength
  3. Enable 2-Step Verification for the whole domain with no exceptions
  4. Apply a 2SV enforcement policy to the admin OU that allows only security keys Correct answer.

Explanation

2SV enforcement can be scoped to an OU and configured to permit only specific methods such as security keys. Domain-wide enforcement without method restrictions, disabling 2SV, or shortening sessions does not restrict the factor type.

Question 43Manage core Workspace services

Which setting determines how long a user can remain signed in to Google services before being asked to authenticate again?

  1. Password policy
  2. Session control Correct answer.
  3. Account recovery
  4. Context-aware access

Explanation

Session control sets the duration of a web session before reauthentication is required and can be scoped by OU. Password policy governs credential rules, recovery governs account reset, and context-aware access evaluates access conditions.

Question 44Manage core Workspace services

An administrator must ensure that users cannot install any third-party apps that request access to Gmail data. Which control should be applied?

  1. API access control allowlisting for the domain Correct answer.
  2. Drive sharing restrictions
  3. Chrome app blocking for the OU
  4. Gmail content compliance rules

Explanation

API access control lets administrators restrict which third-party apps can access Google Workspace data, including Gmail scopes. Chrome app blocking, Drive sharing, and content compliance address different surfaces.

Question 45Manage core Workspace services

What does configuring a default routing rule with a changed envelope recipient accomplish for inbound mail?

  1. It encrypts the message in transit
  2. It quarantines the message for review
  3. It strips attachments from the message
  4. It redirects delivery to a different mailbox address Correct answer.

Explanation

Changing the envelope recipient in a default routing rule delivers the message to an alternate address while preserving the header recipient. Encryption, quarantine, and attachment stripping are handled by other Gmail settings.

Question 46Manage core Workspace services

Which Admin console location is used to enable or disable a core service such as Google Calendar for an organizational unit?

  1. Directory > Users > user profile
  2. Billing > Subscriptions
  3. Reports > Audit log
  4. Apps > Google Workspace > Calendar > Sharing settings Correct answer.

Explanation

Core service on/off state and related options are configured under Apps > Google Workspace for each service. User profiles, audit logs, and billing do not control service availability.

Question 47Manage core Workspace services

A company wants external sharing of Google Drive files limited to users in a specific allowlist of trusted domains. Which Drive setting should be configured?

  1. Sharing settings with a trusted domains allowlist Correct answer.
  2. Link sharing default set to anyone with the link
  3. Offline access for the OU
  4. Drive file stream cache limits

Explanation

Drive sharing settings can restrict external sharing to an allowlist of trusted domains. Link sharing defaults, cache limits, and offline access affect visibility or client behavior, not which external domains are trusted.

Question 48Manage core Workspace services

Which action best describes what happens when an administrator suspends a user account?

  1. The account and its data are permanently deleted
  2. The account is converted into a shared mailbox
  3. The user retains sign-in but loses Gmail only
  4. The user cannot sign in but the data is retained Correct answer.

Explanation

Suspension blocks sign-in while preserving the account and its data so it can be restored or transferred. Deletion removes the account, and suspension is not a per-service or mailbox-conversion action.

Question 49Manage core Workspace services

Before deleting a departing employee's account, an administrator needs to preserve the mailbox for a manager. Which step should be taken first?

  1. Disable Gmail for the OU
  2. Rename the account and keep it active
  3. Transfer the user's data to another user, then delete the account Correct answer.
  4. Delete the account and restore it from trash later

Explanation

Data transfer moves Drive and Gmail data to another user before deletion so the content remains accessible. Deleting first risks data loss after the retention window, renaming keeps an active account, and disabling Gmail affects the whole OU.

Question 50Manage core Workspace services

Which Google Workspace feature lets administrators define rules that inspect message content and take actions such as adding a header or rejecting a message?

  1. Content compliance Correct answer.
  2. Hosted S/MIME
  3. Email routing quarantine
  4. Gmail delegation

Explanation

Content compliance rules match expressions or metadata and can add headers, modify delivery, or reject messages. S/MIME handles signing, delegation shares a mailbox, and quarantine is an action rather than the rule type.