G O O G L E C E R T I F I C A T I O N
Google Workspace Administrator Practice Exam
Exam Number: 1003 | Last updated April 21, 2026 | 899+ questions across 4 vendor-aligned objectives
Google’s Google Workspace Administrator credential is built for professionals who the skills needed to work on Google Cloud in production settings. The target audience includes collaboration engineers, IT administrators, and tenant owners who run Google Workspace for an organization and support its end users. Passing candidates have shown they can reason about trade-offs and pick the right service for a given constraint.
Heavy-weighted areas define where study time pays back fastest: 30% targets Plan and Implement Google Workspace for Your Organization (domain provisioning, DNS, mail routing, migration from legacy platforms); 25% targets Manage Users, Resources, and Shared Drives (organizational units, groups, delegated admin roles, Shared Drives governance).
Supporting domains fill out the blueprint: 25% covers Manage Core Services of Google Workspace (Gmail compliance, Calendar, Drive, Meet, Chat policy configuration); 20% covers Configure Security and Access (two-step verification, context-aware access, DLP, endpoint management). Each still appears on the exam, so none can be safely skipped. Google updates exam guides regularly, so verify domain weights on the official certification page before you finalize a study plan.
Every answer links to the source. Each explanation below includes a hyperlink to the exact Google documentation page the question was derived from. PowerKram is the only practice platform with source-verified explanations. Learn about our methodology →
550
practice exam users
90%
satisfied users
79.7%
passed the exam
4.2/5
quality rating
Test your Workspace Administrator knowledge
10 of 899+ questions
Question #1 - Plan and Implement Google Workspace for Your Organization
A non-profit is moving mail from a legacy on-premises Exchange system to Google Workspace and must ensure inbound mail is delivered to Gmail after cutover weekend.
Which DNS change is the critical step for redirecting inbound mail?
A) Updating the domain’s MX records to Google’s mail servers
B) Adding an SPF record only, without touching MX
C) Pointing an A record for www to Gmail
D) Updating NS records at the registrar to Google
Show solution
Correct answers: A – Explanation:
MX records direct inbound mail delivery, so updating them to the Google Workspace MX values is the critical cutover step. SPF alone authorizes senders but does not route inbound mail. An A record for www governs the website, not mail. NS records control the whole DNS zone and are not required to change for mail routing. Source: Check Source
Question #2 - Manage Users, Resources, and Shared Drives
An admin wants engineers in the ‘Engineering’ organizational unit to have access to early Google Workspace features, while the rest of the company stays on the standard release track.
Which approach correctly uses the OU structure?
A) Apply the setting at the top-level OU and accept the default for Engineering
B) Override the release track setting at the Engineering OU
C) Delete the Engineering OU and use a Group instead
D) Move the Engineering users to a separate Google Cloud project
Show solution
Correct answers: B – Explanation:
Settings at child OUs can override inherited parent settings, so overriding the release track at the Engineering OU is the correct pattern. Applying at the top OU affects everyone. Groups do not carry service settings the way OUs do. Google Cloud projects are unrelated to Workspace OU policy inheritance. Source: Check Source
Question #3 - Manage Users, Resources, and Shared Drives
A consulting firm’s project team keeps losing files when employees leave because those files were in My Drive folders owned by the departing employee.
Which Google Workspace feature addresses the root cause?
A) Individual Drive with ownership transfer requests at offboarding
B) Mandating that everyone share files by link only
C) Storing files in personal Gmail attachments
D) Shared Drives, where the organization owns the files
Show solution
Correct answers: D – Explanation:
Shared Drives make the team the file owner rather than the individual, so departures no longer risk the content. Ownership transfers at offboarding are error-prone and reactive. Link sharing does not change ownership. Gmail attachments are not a governed storage model. Source: Check Source
Question #4 - Configure Security and Access
A security officer wants to require all Google Workspace users to present a second factor at sign-in, starting with the finance OU.
Which Admin console control enforces that requirement?
A) Context-Aware Access with no other settings
B) Disabling IMAP for finance users
C) Enforcing 2-Step Verification at the finance OU
D) Turning off less-secure app access company-wide
Show solution
Correct answers: C – Explanation:
Enforcing 2-Step Verification at the finance OU requires a second factor for those users, matching the stated goal. Context-Aware Access controls context but is not by itself an MFA requirement. Disabling IMAP or less-secure apps hardens access but does not enforce a second factor. Source: Check Source
Question #5 - Manage Core Services of Google Workspace
A legal team wants all messages sent by the executive group to be preserved indefinitely regardless of what individuals do in Gmail.
Which Google Workspace capability meets that need?
A) Gmail retention labels set by each executive
B) Google Vault with a retention rule targeting that group
C) Relying on the Trash folder defaults
D) A third-party backup installed on each laptop
Show solution
Correct answers: B – Explanation:
Google Vault applies org-wide retention regardless of user action and is the governance tool for this use case. User-set labels are not enforced. Trash defaults are not a retention policy. Third-party laptop backups do not control server-side Gmail retention. Source: Check Source
Question #6 - Plan and Implement Google Workspace for Your Organization
An IT lead must migrate 3,000 mailboxes from Microsoft 365 to Google Workspace with minimal user disruption.
Which Google-provided tool is purpose-built for this migration?
A) Google Cloud Storage Transfer Service
B) Data Migration Service for Google Cloud databases
C) Google Workspace Migration for Microsoft Exchange
D) rsync over a Cloud Interconnect link
Show solution
Correct answers: C – Explanation:
Google Workspace Migration for Microsoft Exchange (and the Workspace Migrate tool) are designed for Exchange/M365 mailbox migrations. Storage Transfer Service moves objects, not mailboxes. Database Migration Service is for databases. rsync cannot move Exchange mail semantics. Source: Check Source
Question #7 - Configure Security and Access
A Workspace admin wants to allow Drive access only from managed laptops on a corporate IP range and block access from personal devices on public Wi-Fi.
Which feature expresses that policy?
A) Gmail confidential mode
B) Shared Drive membership lists
C) Drive link-sharing defaults
D) Context-Aware Access policies
Show solution
Correct answers: D – Explanation:
Context-Aware Access lets admins gate Google Workspace apps on device posture, IP, and other signals, which matches the requirement. Confidential mode is a Gmail feature for recipients. Shared Drive membership controls content scope, not device posture. Link-sharing defaults do not evaluate device or network. Source: Check Source
Question #8 - Manage Users, Resources, and Shared Drives
The helpdesk team must reset passwords for all non-executive users but should not be able to modify billing or delete OUs.
Which Admin console concept delivers that scoped capability?
A) Granting Super Admin role to the helpdesk
B) Creating a custom admin role with only Users > Reset Password rights
C) Making the helpdesk members of Groups with admin aliases
D) Giving the helpdesk access to the Google Cloud organization IAM
Show solution
Correct answers: B – Explanation:
Custom admin roles in the Admin console let you scope privileges precisely, such as reset password only. Super Admin is far too broad. Group aliases do not grant admin rights. Cloud IAM roles do not manage Workspace admin actions in the Admin console. Source: Check Source
Question #9 - Manage Core Services of Google Workspace
A school district wants to prevent external participants from joining Google Meet calls held by students.
Which Admin console setting applies at the student OU?
A) Restrict Meet meetings to participants in the organization
B) Disable Gmail for students
C) Mandate Calendar auto-accept
D) Block YouTube for all student Chrome users
Show solution
Correct answers: A – Explanation:
Meet has an org-level control that restricts meetings to internal participants, which can be applied at the student OU. Disabling Gmail, mandating Calendar auto-accept, and blocking YouTube do not govern who can join Meet. Source: Check Source
Question #10 - Configure Security and Access
An admin wants to automatically quarantine outbound Gmail messages that contain credit card numbers before they leave the organization.
Which Workspace capability enables that policy?
A) Gmail DLP rules in the Admin console
B) Alert Center read-only monitoring
C) Drive sharing defaults
D) Labels inside user inboxes only
Show solution
Correct answers: A – Explanation:
Gmail DLP rules scan outbound mail and can block or quarantine on sensitive patterns such as credit cards. Alert Center surfaces events but does not enforce outbound rules. Drive sharing defaults do not affect Gmail. User labels do not enforce DLP. Source: Check Source
Get 899+ more questions with source-linked explanations
Every answer traces to the exact Google documentation page — so you learn from the source, not just memorize answers.
Exam mode & learn mode · Score by objective · Updated April 21, 2026
Learn more...
What the Workspace Administrator exam measures
- Plan and Implement Google Workspace for Your Organization (30%): Apply Google Cloud practices to domain provisioning, DNS, mail routing, migration from legacy platforms.
- Manage Users, Resources, and Shared Drives (25%): Apply Google Cloud practices to organizational units, groups, delegated admin roles, Shared Drives governance.
- Manage Core Services of Google Workspace (25%): Apply Google Cloud practices to Gmail compliance, Calendar, Drive, Meet, Chat policy configuration.
- Configure Security and Access (20%): Apply Google Cloud practices to two-step verification, context-aware access, DLP, endpoint management.
How to prepare for this exam
- Review the Google Workspace Administrator official exam guide end to end before you commit a study plan, so every later hour is spent against the published blueprint.
- Complete the relevant Google Cloud Skills Boost learning path and treat its labs as non-optional rather than extra credit.
- Get hands-on practice in Qwiklabs sandbox, repeating the same tasks from memory until configuration feels routine.
- Apply what you learn in real-world project experience — your day job, a volunteer project, or an open-source contribution — so the concepts stick.
- Master one objective at a time, starting with the highest-weighted domain on the blueprint and moving down from there.
- Use PowerKram learn mode with feedback and sourced links to close gaps while the answer rationale is still fresh.
- Finish with PowerKram exam mode across all objectives under realistic time pressure before you book the real exam.
Career paths and salary outlook
Holding the Google Workspace Administrator certification typically supports roles such as:
- Google Workspace Administrator: roughly $ 85,000 to $125,000 USD per year in the US market (range varies by region, years of experience, and specialization). See current data on Glassdoor.
- Collaboration Engineer: roughly $ 100,000 to $140,000 USD per year in the US market (range varies by region, years of experience, and specialization). See current data on Levels.fyi.
- Digital Workplace Manager: roughly $ 110,000 to $150,000 USD per year in the US market (range varies by region, years of experience, and specialization). See current data on Payscale.
Official resources
Work directly from Google’s own preparation resources and treat third-party content as a supplement: