Workspace Admin · Domain 2 of 6

Workspace Admin Domain 2: Managing core Workspace services

The largest section covers configuring each core service in the Admin console: Gmail routing, security and authentication, Drive and Docs sharing, Calendar, Meet and Chat, Gemini controls, and enabling AppSheet and Apps Script.

Exam weight
~23%
Official objectives
7
Estimated questions estimate
12–14
Suggested study time estimate
14–18 hrs

About 15 min read Reviewed October 2026

Overview

Section 2 is the heaviest part of the exam at about 23%, and it is also the broadest. It covers seven services: Gmail, Drive and Docs, Calendar, Meet, Chat, Google's generative AI features in Workspace, and the AppSheet and Apps Script development tools. For each one you are expected to know where the setting lives, whether it can be scoped to an OU or group, and what the end user will notice after it changes.

Gmail carries the most detail, from MX records and routing to compliance rules, spam controls, attachment limits and the SPF, DKIM and DMARC records that protect your domain. Drive questions centre on default sharing, shared drives, storage limits and labels. The remaining services are mostly about turning features on or off for the right people and choosing safe defaults.

How it's tested

Questions in this section describe a business request for one service and ask which setting delivers it. Many options are real settings in the wrong service or at the wrong scope. Read for the service named, the population affected, and whether the request is about routing, sharing, safety or simply turning a feature on.

  • Mail flow and authentication

    Mail is rejected, spoofed or routed oddly, and you pick the MX, routing, compliance rule or SPF, DKIM and DMARC change that fixes it.

  • Sharing defaults

    A team needs tighter or looser Drive sharing, and you choose OU-level sharing settings, target audiences, shared drives or labels.

  • Feature by population

    Only some users should get Meet recording, Chat with external users, Gemini or AppSheet, and you scope the setting to an OU or group.

Reasoning it through

A marketing team reports that customers see their newsletters land in spam, and the headers show DKIM as none. The domain already publishes an SPF record. The fix the exam wants is to generate a DKIM key in the Gmail authentication settings, publish the TXT record at the DNS host, and then start authentication. Once SPF and DKIM pass, a DMARC policy can be tightened gradually from none to quarantine.

Objectives 7

Official objectives from the Google Cloud outline, in outline order.

2.1 Configuring GmailMX records, routing, compliance, spam and malware controls, authentication, migration and delegation.
What it means
This objective covers setting MX records, basic mail routing, content compliance rules, spam, phishing and malware settings such as allowlists, denylists, inbound gateways and IP allowlists, attachment size limits and blocked file types, forwarding, POP and IMAP access, SPF, DKIM and DMARC, email migration, delegated access, compliance footers and quarantines.
What to understand
MX records must point to Google for inbound mail to reach Gmail. Routing and compliance rules act on messages by OU, so the same domain can treat finance mail differently from sales mail. An inbound gateway setting tells Gmail that mail arrives through another filter first, so spam checks read the right IP. SPF lists permitted senders, DKIM signs messages with a domain key, and DMARC tells receivers what to do when both fail. Admin quarantines hold messages for review. Delegation lets an assistant read and send from a manager's mailbox.
How it shows up
A delivery, spoofing or policy problem in Gmail is described, and you choose the routing, compliance or authentication setting.
Common confusion
Mixing up SPF and DKIM; SPF authorises sending servers, DKIM adds a cryptographic signature to each message.
2.2 Configuring Google Drive and DocsSharing defaults, trust rules, shared drives, storage, labels, offline and templates.
What it means
This objective covers default sharing for new files, Drive trust rules, limits on external sharing, target audiences, custom Docs templates, shared drives, storage quotas for users and OUs, allowing or blocking Drive for desktop, transferring file and folder ownership, Drive labels, and turning offline access on or off.
What to understand
Sharing settings by OU decide whether users can share outside the domain and what the default link setting is for new files. Target audiences steer users to share with a defined group instead of the whole organisation. Shared drives hold files owned by the organisation, so content stays when a member leaves, and member roles range from Manager to Viewer. Storage limits can be set per user or OU on pooled storage. Drive labels add structured metadata to files for search and policy.
How it shows up
A sharing, ownership or storage request is described, and you choose the Drive setting or shared drive design.
Common confusion
Assuming files in My Drive stay with the team after the owner leaves; shared drive files do, My Drive files need a transfer.
2.3 Configuring Google CalendarResource calendars, booking policies, delegation, sharing and event ownership.
What it means
This objective covers resource calendars and booking policies, calendar and resource delegation, default internal sharing for primary and secondary calendars, team shared calendars, external sharing, transferring event ownership, and blocking invitations from unknown senders.
What to understand
Calendar sharing has separate defaults for inside and outside the organisation, and both can be set per OU. Showing only free and busy externally is a common safe default. Delegation lets an assistant manage a manager's events. When an organiser leaves, the Admin console can transfer their future events to another user so meetings are not orphaned. Restricting invitations to known senders cuts calendar spam.
How it shows up
A calendar visibility or ownership problem is described, and you choose the sharing level or transfer tool.
Common confusion
Changing a user's own sharing when the request is an organisation-wide default, which belongs in the Admin console.
2.4 Configuring Google MeetEnabling Meet by OU, safety, video quality, recordings, transcripts and note-taking.
What it means
This objective covers turning Meet on or off for the organisation or specific OUs, setting safety options such as who can join and host management, and configuring video settings including default quality, recording, transcripts and automated note-taking.
What to understand
Meet settings follow OU and group scope like most services. Safety settings decide whether people outside the organisation can join and whether hosts manage the meeting by default. Recording and transcripts are edition-dependent and save to the organiser's Drive, so turning them off for a sensitive OU is a common request. Automated note-taking is a Gemini feature and follows the generative AI controls as well.
How it shows up
A meeting privacy or capability request is described, and you choose the Meet safety or video setting and its scope.
Common confusion
Thinking recordings are stored in Meet itself; they are saved to the organiser's Google Drive.
2.5 Configuring Google ChatEnabling Chat, history, spaces, external access, invites and Chat apps.
What it means
This objective covers turning Chat on or off for the organisation or OUs and configuring its settings: whether history is on, how spaces work, whether people outside the domain can join, moderation, invitation behaviour, and which Chat apps users can install.
What to understand
History settings decide whether messages are kept and whether users can change that, which matters for Vault retention. External chat can be allowed only with allowlisted domains. Space managers can moderate a space, and admins set whether users can create spaces open to external people. Chat apps can be allowed, limited to an allowlist, or blocked, and they also appear in Marketplace controls.
How it shows up
A retention, external collaboration or bot request in Chat is described, and you choose the Chat setting.
Common confusion
Expecting Vault to retain messages sent with history off; off-the-record messages are not kept for Vault.
2.6 Using generative AI for Google WorkspaceData privacy, enabling Gemini by OU, Gemini app extensions and usage reports.
What it means
This objective covers explaining how Google keeps organisational data private and secure when Gemini is used in Workspace, turning Gemini features on or off for the organisation or OUs, controlling Workspace extensions in the Gemini app, and reading Gemini usage reports.
What to understand
Gemini in Workspace works within the user's existing permissions, so it only surfaces content that the user can already open. Google states that Workspace customer data is not used to train its models outside the customer's domain without permission. Admins can scope Gemini access by OU or group and decide whether the Gemini app can reach Gmail, Drive and other Workspace data through extensions. Usage reports show adoption and active users.
How it shows up
A data privacy or rollout question about Gemini is asked, and you choose the control, scope or reassurance that fits.
Common confusion
Thinking Gemini can expose files a user lacks access to; it respects existing Drive and Gmail permissions.
2.7 Supporting Workspace developmentAppSheet and Apps Script use cases and enablement.
What it means
This objective covers recognising when AppSheet or Apps Script is the right tool, such as automating a repetitive task or building a simple app on top of Sheets, and enabling AppSheet for the organisation or particular OUs.
What to understand
AppSheet builds no-code apps and automations from data in Sheets and other sources, which suits business users. Apps Script is JavaScript-based code that extends Gmail, Sheets, Docs and Forms, which suits technical users and admins. Admins can turn AppSheet on or off by OU and control Apps Script access to data through API and third-party app access controls.
How it shows up
A business team wants to automate a task, and you choose AppSheet or Apps Script and the enablement setting.
Common confusion
Choosing Apps Script for a non-technical team when AppSheet would deliver a no-code app.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • MX records

    DNS records that route inbound mail for the domain to Google.

    Remember
    Wrong or stale MX records stop inbound delivery.
    Tested as
    Mail flow questions.
    Trap
    Changing SPF when inbound mail is the problem.

  • SPF

    A DNS TXT record listing servers allowed to send for the domain.

    Remember
    Include every third-party sender.
    Tested as
    Spoofing and spam folder issues.
    Trap
    Forgetting a marketing platform that sends on your behalf.

  • DKIM

    A domain key that signs outgoing messages.

    Remember
    Generate in the Admin console, publish in DNS, then start authentication.
    Tested as
    Outbound deliverability.
    Trap
    Publishing the record but never starting authentication.

  • DMARC

    A DNS policy telling receivers how to treat mail that fails SPF and DKIM alignment.

    Remember
    Move from p=none to quarantine or reject after monitoring.
    Tested as
    Spoofing scenarios.
    Trap
    Jumping straight to reject before checking reports.

  • Inbound gateway

    Tells Gmail which upstream server filters mail first.

    Remember
    Prevents Gmail from treating the gateway IP as the sender.
    Tested as
    Hybrid filtering setups.
    Trap
    Adding the gateway to the spam allowlist instead.

  • Content compliance rule

    A Gmail rule that matches message content and takes an action such as reject, quarantine or add a footer.

    Remember
    Rules apply per OU.
    Tested as
    Policy-driven mail handling.
    Trap
    Using DLP when the request is a simple routing action.

  • Admin quarantine

    Holds matched messages for admin review before delivery.

    Remember
    Reviewers release or reject them.
    Tested as
    Sensitive outbound mail.
    Trap
    Expecting users to see quarantined messages in spam.

  • Shared drives

    Drives owned by the organisation rather than a user.

    Remember
    Files stay when a member leaves.
    Tested as
    Team storage scenarios.
    Trap
    Storing team files in one person's My Drive.

  • Target audiences

    Defined groups that users are encouraged to share with by link.

    Remember
    They steer sharing without blocking it.
    Tested as
    Oversharing scenarios.
    Trap
    Treating them as a hard restriction.

  • Calendar external sharing

    The default detail shown to people outside the organisation.

    Remember
    Free and busy only is a common safe default.
    Tested as
    Privacy questions.
    Trap
    Editing one user's calendar instead of the OU default.

  • Chat history

    Controls whether messages are kept.

    Remember
    History off means Vault has nothing to retain.
    Tested as
    Retention questions.
    Trap
    Assuming Vault overrides history settings.

  • Gemini data protection

    Gemini respects existing permissions and does not train outside the domain on customer data without permission.

    Remember
    Scope access by OU or group.
    Tested as
    AI rollout questions.
    Trap
    Blocking Gemini over a risk it does not have.

  • AppSheet enablement

    AppSheet can be turned on or off by OU.

    Remember
    No-code apps for business users.
    Tested as
    Development tool questions.
    Trap
    Choosing custom code for a simple workflow.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

SPF vs. DKIM vs. DMARC

ConceptMeaningKey differenceCommon trap
SPF Lists servers allowed to send for the domain Checks the sending IP Exceeding the DNS lookup limit with many includes
DKIM Signs messages with a domain key Checks message integrity and origin Not starting authentication after publishing
DMARC Policy for messages failing alignment Tells receivers what to do and sends reports Setting reject before SPF and DKIM pass

My Drive vs. shared drive

ConceptMeaningKey differenceCommon trap
My Drive Files owned by an individual user Ownership leaves with the user unless transferred Using it for team records
Shared drive Files owned by the organisation Membership roles control access Assuming Viewer can reorganise content

AppSheet vs. Apps Script

ConceptMeaningKey differenceCommon trap
AppSheet No-code app and automation builder Built for business users Overlooking it for simple workflows
Apps Script JavaScript platform that extends Workspace apps Built for technical users Choosing it when no one can maintain code

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. SPF for inbound mail

    What candidates pick
    Edit the SPF record when inbound mail stops arriving after a migration.
    Why it looks right
    SPF is the best-known mail DNS record.
    Why it's wrong
    Inbound routing depends on MX records; SPF only affects how others judge your outbound mail.

    Clue to watch for Mail to the domain bounces or goes to the old server.

  2. Allowlist the gateway

    What candidates pick
    Add the third-party filter's IP to the spam allowlist.
    Why it looks right
    It stops the gateway's mail being marked as spam.
    Why it's wrong
    Allowlisting skips spam checks entirely; the inbound gateway setting lets Gmail evaluate the original sender correctly.

    Clue to watch for Mail passes through another filter before Gmail.

  3. Block all external sharing

    What candidates pick
    Disable sharing outside the domain for everyone.
    Why it looks right
    It removes the risk at once.
    Why it's wrong
    It breaks teams that legitimately share with partners; scope the restriction to the OU that needs it or allowlist partner domains.

    Clue to watch for Only one department handles sensitive files.

  4. Recordings in Meet

    What candidates pick
    Look for recording storage settings inside Meet.
    Why it looks right
    Recording is a Meet feature.
    Why it's wrong
    Recordings save to the organiser's Drive, so Drive sharing and retention govern them.

    Clue to watch for A question asks who can access recordings.

  5. Gemini sees everything

    What candidates pick
    Disable Gemini to stop users seeing HR files they cannot open.
    Why it looks right
    AI assistants feel like they search everything.
    Why it's wrong
    Gemini respects existing permissions; fix the oversharing in Drive instead.

    Clue to watch for The concern is about access the user does not already have.

  6. Code for every automation

    What candidates pick
    Ask the finance team to write Apps Script for a simple approval tracker.
    Why it looks right
    Apps Script is powerful.
    Why it's wrong
    AppSheet gives a no-code app on top of their sheet and can be enabled for their OU.

    Clue to watch for The users are not developers.

Answer framework

For any Section 2 request, work out the service, the scope and the setting before you look at the options.

  1. Name the service: Gmail, Drive and Docs, Calendar, Meet, Chat, Gemini, or AppSheet and Apps Script.
  2. Identify who is affected and scope the change to the narrowest OU or group that covers them, testing with a pilot OU first when the change is risky.
  3. For Gmail, separate inbound routing (MX, gateways, routing rules) from outbound trust (SPF, DKIM, DMARC) and content handling (compliance rules, quarantines).
  4. For Drive, Calendar and Chat, check the internal and external sharing defaults, ownership, and how the choice affects later Vault retention.
  5. For Meet and Gemini, confirm the edition supports the feature, then set safety, recording or access controls, and use reports to confirm adoption.

Practice question

A company sends invoices from Gmail and through a third-party billing platform. Some customers report that invoices from the billing platform fail authentication, while Gmail messages pass. The domain has a DMARC policy of quarantine. What should the administrator change first?

Want more like this? The Workspace Admin practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this section the most time because it carries the highest weight and the widest feature list. Begin with Gmail, since it has the deepest settings. In a test tenant, set up DKIM, write an SPF record that includes a third-party sender, publish a DMARC record at p=none, and create one compliance rule that adds a footer and one that quarantines. Read a message header and find the SPF, DKIM and DMARC results.

Move to Drive next. Change the sharing default for one OU, build a shared drive with different member roles, set a storage limit, and create a Drive label. Then run through Calendar, Meet and Chat quickly, noting which settings are internal versus external and which affect retention. For Gemini, read Google's admin documentation on data protection and practise turning the feature on for a single group. Finish with AppSheet and Apps Script use cases. Build a one-page table of each service with its most tested setting and its scope, and review it before every practice test.

FAQ

How much of the Workspace Admin exam is Section 2?

Managing core Workspace services is the largest section at about 23% of the exam, around 12 to 14 questions.

Do I need to know DNS records in detail?

You need to know what MX, SPF, DKIM and DMARC records do, where they are published, and the order of setup. Exact syntax is less important than knowing which record fixes which symptom.

Which Workspace edition does the exam assume?

Google recommends hands-on experience with Business Plus and knowledge of Enterprise edition features, so expect questions about features such as Meet recording and advanced controls that need higher editions.

Are Gemini settings really on the exam?

Yes. Sub-objective 2.6 covers data privacy, enabling Gemini by OU, Workspace extensions in the Gemini app, and Gemini usage reports.

What is the difference between shared drives and shared folders?

A shared folder lives in one user's My Drive and is owned by that user. A shared drive is owned by the organisation, so its files remain when members leave.

Can I limit external Chat to partner domains?

Yes. External chat can be restricted to allowlisted domains, and the setting can be scoped by OU.

Where do Meet recordings go?

Recordings and transcripts are saved to the meeting organiser's Google Drive, so Drive sharing and retention rules apply to them.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered Gmail routing and authentication, Drive sharing, Calendar, Meet, Chat, Gemini and AppSheet. Check that you can pick the right setting at the right scope.

Take the Workspace Admin practice test Check your Workspace Admin readiness

Keep going