Workspace Admin Tests the Narrowest Admin Console Fix — Not Org-Wide Toggles
This Associate exam replaced the Professional Workspace Administrator exam, retired 31 December 2024. It suits hands-on admins; the shift is scoping every change to the right OU or group while protecting data first.
Check Your Readiness →Most candidates understand Google Cloud Certified Associate Google Workspace Administrator concepts — and still fail. This exam tests how you apply knowledge under pressure.
Questions read like help-desk tickets and change requests. Several options are real settings placed in the wrong service or at the wrong scope. Google's published weights round to about 101%. Favour the option that preserves data, uses least privilege and touches the smallest population.
Create a new OU and move all five users into it
A user belongs to exactly one OU, so moving them drops their other inherited settings. A configuration group targets the exception across OUs, and group-based settings take precedence over OU settings for that service.
Write a Gmail content compliance rule or a Drive trust rule
This is content-based, so use a DLP rule with the relevant detector, scoped to external sharing, with a block action and user message. Run it in audit mode first; trust rules act on who shares with whom.
Check the security health page and email users to delete it
The security investigation tool queries Gmail log events, identifies recipients and clickers, and bulk-deletes the message from every inbox. Security health shows configuration posture only, not individual incidents.
Ask the manager to forward the message headers to IT
No received message means no header to analyse. Email Log Search traces delivery for roughly the last 30 days by sender, recipient or message ID. Messageheader in Admin Toolbox only helps once a message is in hand.
Deletion ends Vault coverage and removes unowned Drive files after the roughly 20-day account restore window. Transfer ownership first, then move the account to an Archived User license so mail stays searchable in Vault at lower cost.
Retention rules purge at the end of their period and can be edited. Create a Vault matter and place a hold on the named accounts or OUs; holds override retention, but they do not survive deletion of the account.
DKIM is generated in the Admin console, published as DNS TXT, then switched on. Also list every third-party sender in SPF, and move DMARC from p=none to quarantine or reject only after reports confirm legitimate mail aligns.
Super admin cannot be scoped to an OU. Prebuilt roles such as Help Desk Admin or User Management Admin, or a custom role, can be limited to one OU. Keep more than one protected super admin with secured recovery.
Account wipe removes only Workspace data, or the Android work profile, and leaves personal content. Device wipe is a factory reset for lost company-owned devices, and device approval or app control needs advanced, not basic, management.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
Test whether you pick the right Admin console tool and scope for each Workspace ticket.