CertifyCloudxAce every cloud certification.

AGWA sample questions with answers

10 free practice questions for the Associate Google Workspace Administrator exam. Try each one, then open the answer to see why the right option wins and every other option loses.

Question 1Managing user accounts, domains, and Directory

Tolland Foods created a dynamic group of everyone whose country is Canada, so that those users get a stricter Drive sharing setting as a configuration group. The group works as a mailing list, but it doesn't appear when you search for it in the Drive settings' Groups panel, and you are a super admin. What should you do?

  1. A.

    Recreate the group as a standard group in Google Groups, since dynamic groups can never be used for policy settings.

  2. B.

    Add the Security label to the dynamic group in the Admin console, then apply the Drive sharing setting to it in the Groups panel.

  3. C.

    Move all Canadian users into a new Canada organizational unit, because configuration groups ignore any location-based membership rule.

  4. D.

    Nest the dynamic group inside a standard group created in the Admin console and apply the setting to the standard group.

Show answer

Answer: B

A dynamic group needs the Security label before it can be used as a configuration group.

  • A. Groups created in Google Groups can't be configuration groups at all, and dynamic groups can be once labelled.
  • B. Correct: once labelled as a security group, the dynamic group is eligible and can carry the Drive setting.
  • C. Membership method isn't the issue; the missing Security label is, and restructuring units is unnecessary.
  • D. Dynamic groups can't be members of any other group, so this nesting is impossible.
Question 2Managing user accounts, domains, and Directory

Kestrelbay Analytics wants a mailing list of every employee based in its Dublin office except contractors, who are marked with the employee type Contractor. Staff move offices monthly and the hand-built list is always stale. The account is on Enterprise Plus and profile attributes are accurate. What should you do?

  1. A.

    Create a standard group and ask each person to join or leave it themselves whenever they change office or contract type.

  2. B.

    Create a standard group and schedule an Apps Script that rebuilds its membership every night by reading user profiles through the Directory API.

  3. C.

    Create a dynamic group whose membership query matches the Dublin location attribute and excludes employee type Contractor.

  4. D.

    Create a Dublin organizational unit for these users and send the announcements to the organizational unit instead of to a group.

Show answer

Answer: C

A dynamic group keeps membership in step with profile attributes, and its query can exclude users who match a condition.

  • A. Self-managed membership is what produced the stale list in the first place.
  • B. A custom script re-implements dynamic groups and must be maintained, secured and monitored.
  • C. Correct: a query on location with an exclusion for contractors keeps the list accurate as profiles change.
  • D. Organizational units apply policy; they have no email address, so they can't be used as a mailing list.
Question 3Managing user accounts, domains, and Directory

As part of a primary-domain change at Olvera Textiles, you removed its brand domain as a user alias domain. Ten minutes later, adding the same domain back as a secondary domain fails with an error. Nothing else in the account has changed and you are a super admin. What should you do?

  1. A.

    Wait up to 24 hours after removing the domain, then add it to the account again as a secondary domain from Manage domains.

  2. B.

    Add the domain as a user alias domain again and convert it to a secondary domain from the domain's settings page.

  3. C.

    Contact Google Workspace support, because a domain removed from an account can never be added back to the same account.

  4. D.

    Verify the domain with a new TXT record before adding it, because a domain must be verified before Add a domain accepts it.

Show answer

Answer: A

After removing a domain you may need to wait up to 24 hours before you can add it again.

  • A. Correct: the documented cause is the post-removal delay; adding it again after up to 24 hours succeeds.
  • B. Google offers no in-place conversion between domain types; removal and re-adding is the documented route.
  • C. Removed domains can be added back once the waiting period has passed; support isn't needed.
  • D. Verification follows the Add a domain step; it isn't a prerequisite for adding the domain.
Question 4Managing user accounts, domains, and Directory

Two teams at Aldergate Media arrived at the same training room, each holding an accepted Calendar invitation. The room's calendar is set to add every invitation it receives, including ones that overlap an existing booking. Facilities want overlapping requests refused automatically and can't review bookings by hand. What should you do?

  1. A.

    Share the room's calendar with a facilities coordinator who reviews each request and accepts or declines it on the room's behalf.

  2. B.

    Set working hours on the room's calendar so that it can be booked only between nine in the morning and five in the afternoon.

  3. C.

    Lower the room's capacity in Buildings and resources so that fewer guests can be invited to meetings held in it.

  4. D.

    Open the room's calendar settings and set Auto-accept invitations to Auto-accept invitations that do not conflict.

Show answer

Answer: D

Auto-accept invitations that do not conflict makes a resource decline overlapping bookings automatically.

  • A. A resource manager approves bookings by hand, which facilities have said they can't do.
  • B. Working hours limit when bookings are expected, not whether they overlap.
  • C. Capacity is information for bookers; it doesn't stop overlapping events.
  • D. Correct: the non-conflicting auto-accept mode declines overlaps automatically.
Question 5Managing user accounts, domains, and Directory

Halberd Engineering has department groups for Mechanical, Electrical and Civil staff, each kept up to date by its department. The chief engineer wants one engineering@ list that always reaches everyone in all three departments, without anyone maintaining a second copy of the membership. What should you do?

  1. A.

    Merge the three department groups into engineering@ and delete them, so there is only one list to look after.

  2. B.

    Create engineering@ and add the three department groups to it as members, so that their membership flows through automatically.

  3. C.

    Create an Engineering organizational unit containing all engineers and send the chief engineer's mail to that unit.

  4. D.

    Create engineering@ and add every engineer to it individually, then ask the departments to update both groups whenever staff change.

Show answer

Answer: B

Adding groups as members of another group lets a parent list reuse existing department memberships.

  • A. Deleting the department groups breaks their own mail and any sharing or settings that depend on them.
  • B. Correct: nested department groups keep engineering@ current with no second list to maintain.
  • C. Organizational units have no address and can't be used as mailing lists.
  • D. A second, hand-maintained copy of membership is exactly the duplication the chief engineer wants to avoid.
Question 6Managing user accounts, domains, and Directory

Facilities at Polwhele Clinics want every room name in Calendar to show its building, floor, capacity and key equipment, such as video conferencing, so staff can choose correctly at a glance. Last year someone typed such details into names by hand and they drifted out of date. What should you do?

  1. A.

    Create one building per equipment type so that the building name shown in Calendar tells staff what each room contains.

  2. B.

    Rename every room using a standard pattern that spells out building, floor, capacity and equipment, and audit names every quarter.

  3. C.

    Keep each room's building, floor, capacity and features accurate, and let Calendar's autogenerated room name display them.

  4. D.

    Add a User Visible Description to each room listing its capacity and equipment, which replaces the name shown in Calendar.

Show answer

Answer: C

Structured resources get an autogenerated name built from building, floor, section, name, capacity and features.

  • A. Fake buildings per equipment type corrupt location data and break room suggestions.
  • B. Hand-maintained names are the approach that already drifted out of date.
  • C. Correct: the autogenerated name reflects the structured data, so it updates whenever the data does.
  • D. The description appears only while booking and isn't used as the room's name.
Question 7Managing user accounts, domains, and Directory

Corrieston Group runs its subsidiary brand as a verified secondary domain in the same Workspace account. An account manager is moving permanently to the subsidiary and must sign in and send mail as she@subsidiary.example, keep all her Drive files, and still receive mail sent to her old group address. What should you do?

  1. A.

    Add the subsidiary domain as a user alias domain so that she, and every other user, gains an address on the subsidiary domain.

  2. B.

    Create a second account on the subsidiary domain, move her files with the Drive transfer tool, and then suspend the original account.

  3. C.

    Update her user in Directory > Users and pick the subsidiary domain for her primary email; her previous address stays as an email alias.

  4. D.

    Move her into the subsidiary's organizational unit, because organizational unit membership decides which domain a user signs in with.

Show answer

Answer: C

Changing the domain part of a user's primary address moves her to the other domain and keeps the old address as an alias.

  • A. A user alias domain gives every user an extra address and doesn't change anyone's sign-in address.
  • B. A second account needs another license and a transfer, and her mail history would stay in the old account.
  • C. Correct: selecting the secondary domain for her primary email changes her sign-in and sending address while keeping data and the old address.
  • D. Organizational units control policies; they don't determine a user's domain or sign-in address.
Question 8Managing user accounts, domains, and Directory

A regulator requires staff in Lanyon Bank's Dealing organizational unit to change their Google passwords at least every 90 days; everyone else keeps non-expiring passwords. Users should get warnings before the deadline rather than surprise lockouts. What should you do?

  1. A.

    Set Expiration to 90 days at the top-level organizational unit and send the other departments instructions to ignore the reminders.

  2. B.

    Every 90 days, reset all Dealing passwords from Directory > Users with Ask user to change their password selected.

  3. C.

    Create a configuration group for the dealers and set a 90-day session length, which expires their passwords along with the session.

  4. D.

    Select the Dealing unit in Password management and set Expiration to 90 days; users see pop-up alerts during the 30 days before expiry.

Show answer

Answer: D

Password expiration is set per organizational unit in Password management, with in-product alerts 30 days before expiry.

  • A. A top-level setting forces expiry on everyone, which the requirement explicitly avoids.
  • B. Manual resets every quarter give no warning, are easy to miss, and aren't a policy the Admin console enforces.
  • C. Session length governs how often users re-authenticate; it doesn't make passwords expire.
  • D. Correct: an organizational unit-level 90-day expiration meets the rule for dealers only and warns them in advance.
Question 9Managing user accounts, domains, and Directory

Pelworth Dental is on the Annual Plan with 250 Business Standard licenses, all assigned. Adding two new hygienists fails with a license error. Two receptionists left last month; their accounts are only suspended, their data has been handed over, and finance will not buy more licenses. What should you do?

  1. A.

    Suspend the two former receptionists for a second time from the Users list so that Google stops counting their Business Standard licenses.

  2. B.

    Delete the two former receptionists' accounts, then create the hygienists' accounts, which can take the licenses the deletions free up.

  3. C.

    Create the two hygienists with a free Cloud Identity license and add Business Standard to them later when the renewal comes.

  4. D.

    Turn on automatic licensing for Business Standard so that the two new accounts receive a license as soon as they are created.

Show answer

Answer: B

On the Annual Plan, suspended accounts still hold licenses; deleting departed users frees licenses for new accounts.

  • A. Suspended accounts keep their licenses and are billed like active users; suspending them again does nothing.
  • B. Correct: deleting departed users on an Annual Plan releases their licenses for reassignment, which is the documented fix for a license error when adding users.
  • C. A Cloud Identity Free license gives an identity without Gmail, Drive or Calendar, so the hygienists could not do their jobs.
  • D. Automatic licensing assigns licenses the organization already has; with every license in use it cannot license the new accounts.
Question 10Managing user accounts, domains, and Directory

A contractor set up Google Cloud Directory Sync for Garthwaite Rail and ran a successful manual sync from Configuration Manager before leaving. Three weeks later, new starters in Active Directory still have no Workspace accounts. The saved configuration is correct and no errors are logged. What should you do?

  1. A.

    Replace the saved configuration with a new one, since configurations built in Configuration Manager expire after 14 days.

  2. B.

    Reinstall GCDS on a domain controller, because GCDS only runs automatically when it is installed on one of the controllers.

  3. C.

    Schedule the GCDS command-line sync with the server's scheduler, such as Windows Task Scheduler, to run every few hours.

  4. D.

    Turn on automatic synchronization for the connection in the Admin console under Directory > External directories.

Show answer

Answer: C

GCDS has no built-in scheduler; automatic syncs need third-party scheduling such as Windows Task Scheduler or cron.

  • A. Saved GCDS configurations don't expire; the configuration is fine, and nothing is running it.
  • B. GCDS can run on any supported server that reaches the directory; a domain controller is not needed for scheduling.
  • C. Correct: GCDS relies on an external scheduler to run the command-line sync automatically.
  • D. External directories in the Admin console manages cloud Directory Sync (beta) and Inbound SCIM connections, not an on-premises GCDS installation.

Keep going with 522 more AGWA questions

Free papers every day, in the real exam formats, with progress by exam domain. Unlock every paper and timed mock exam when you are ready.

Practise freeSee all AGWA papers
AGWA sample questions with answers (10 free) · CertifyCloudx