Google Workspace Administrator Advanced Practice Exam: Hard Questions 2025

Your organization has a parent Google Workspace domain with multiple child organizational units (OUs): Sales, Engineering, and Contractors. Contractors must be prevented from accessing Drive on iOS/Android, but must retain Gmail and Calendar on mobile. Additionally, you must ensure contractors can still access Drive from managed Windows laptops. Which configuration best meets the requirement with the least operational overhead?

A global company uses a multi-domain Google Workspace setup (primary domain plus several secondary domains). They need to separate external sharing policies by region, but users frequently move between regions. The security team wants policy to follow the user, not the resource, and wants minimal disruption during transfers. What is the best design approach?

You are consolidating two existing Google Workspace tenants after an acquisition. The acquired company’s users must keep sending/receiving mail using their existing email addresses, but all user accounts must live in the parent tenant and be managed centrally. You need to avoid creating duplicate user identities and preserve deliverability during the transition. What should you do first in the parent tenant to support this?

Your HR system provisions users via Google Cloud Directory Sync (GCDS). A recurring issue occurs: users who change their legal name are being provisioned as new accounts instead of being renamed, causing loss of access to Drive files shared to their old account. You need to fix this without manual intervention and prevent duplicate identities. What is the most effective change?

A user is leaving the company. Compliance requires that their Gmail and Drive data be retained for 7 years, while their license must be reclaimed immediately. Their manager needs ongoing access to the user’s Drive files and must be able to respond to critical emails sent to the former employee’s address. What is the best approach to satisfy all requirements?

Engineering reports that new hires are not receiving access to critical internal applications that rely on group membership. Your provisioning pipeline uses dynamic groups based on user attributes. Investigation shows the users exist and have correct attributes in Directory, but group membership is delayed for hours, causing onboarding failures. What is the most appropriate mitigation that preserves attribute-based access control while reducing onboarding time?

Your organization is rolling out Google Chat and wants to restrict users from creating external 1:1 chats, but still allow external Spaces for a limited set of approved partner domains. Additionally, only a specific group of users (Partner Managers) should be able to create those external Spaces. What configuration best meets these requirements?

A subset of users report they cannot send mail to a partner domain; they receive an NDR indicating messages are being rejected due to SPF/DKIM/DMARC alignment. Your domain uses Gmail with an outbound gateway for a legacy application that sends as users via SMTP. Normal Gmail-sent messages pass DMARC, but application-sent messages fail. What is the best fix?

After enabling a new Gmail routing rule to prepend a subject tag for messages from external senders, executives complain that some messages are missing the tag and others have it duplicated. Your environment has multiple routing rules, some applied at the OU level and others at the group level for a pilot. What is the most likely cause and best corrective action?

Your security team needs to investigate suspected data exfiltration from Drive. They want to identify files that were shared externally by a specific user over the last 30 days, determine whether any of those files were downloaded, and then prevent further external sharing by that user without impacting the whole org. What is the best sequence of actions using Google Workspace tools?