Google Cloud Intermediate

GCP-AGWA

Google Cloud Associate Google Workspace Administrator

The Google Cloud Associate Google Workspace Administrator certification validates the ability to configure, deploy, manage, and support Google Workspace environments. This certification is designed for IT administrators who are responsible for managing Google Workspace for their organization.

The exam covers object management including users, groups, and organizational units, service configuration for Gmail, Calendar, Drive, and other Workspace services, troubleshooting common issues, and managing data access and authentication. Candidates should have practical experience using the Google Admin Console, understanding of user lifecycle management, email routing and security, calendar delegation, file sharing permissions, and mobile device management.

This certification is ideal for IT professionals who administer Google Workspace on a daily basis. It validates the skills needed to provision users and groups, configure services, manage security settings, troubleshoot common problems, and implement best practices for Google Workspace deployment and management in business environments.

Updated Aug 2024 Business Applications

Questions

Practice Tests

70%

Pass Score

Views

Total Attempts

Avg. Score

Pass Rate

Discussions

Practice Tests Flash Cards Exam Topics Cheat Sheet

€5.00

GCP-AGWA Practice Exam 1

Comprehensive practice exam covering Google Workspace administration including user and group management, service configuration for Gmail Calendar and Drive, troubleshooting common issues, and implementing authentication and security controls.

50 Q 120 minutes 70%

Test Drive

€5.00

GCP-AGWA Practice Exam 2

Second practice exam for Google Workspace administration covering advanced user provisioning, email routing configuration, Drive sharing policies, authentication security, and troubleshooting complex multi-domain environments.

50 Q 120 minutes 70%

Test Drive

€5.00

GCP-AGWA Practice Exam 3

Third practice exam for Google Workspace administration focusing on mail routing and compliance, shared drive management, mobile device policies, advanced authentication configurations, and organizational unit inheritance.

50 Q 120 minutes 70%

Test Drive

€5.00

GCP-AGWA Practice Exam 4

Fourth practice exam for Google Workspace administration covering advanced email security with DKIM DMARC and SPF, Drive DLP rules, endpoint verification, admin audit log analysis, and multi-domain workspace management.

50 Q 120 minutes 70%

Test Drive

€5.00

GCP-AGWA Practice Exam 5

Fifth practice exam for Google Workspace administration covering Google Vault eDiscovery, data migration strategies, Workspace Add-ons management, alert center configuration, and advanced organizational structure design.

50 Q 120 minutes 70%

Test Drive

€5.00

GCP-AGWA Practice Exam 6

Final comprehensive practice exam integrating all Workspace administration domains with complex multi-scenario questions and advanced troubleshooting. Covers LDAP integration, Google Cloud Directory Sync, security investigation tool, password policies, session management, third-party SAML apps, API access control, data export tools, and license management.

50 Q 120 minutes 70%

Test Drive

Unlock All Content for GCP-AGWA

6 Practice Test(s) + Flash Cards — 3 months access

€39.99 €26.99 Save 30%

or included with Monthly subscription / Content Bundle

GCP-AGWA Cheat Sheet

Quick reference guide - 6 sections

Free Access

Google Cloud Associate Google Workspace Administrator (GCP-AGWA)

The Associate Google Workspace Administrator certification validates your ability to manage and configure Google Workspace for an organization. This certification covers provisioning users, managing organizational units, configuring security policies, managing Google Workspace services like Gmail, Drive, Calendar, and Meet, troubleshooting common issues, and ensuring compliance with organizational requirements. The exam is designed for IT administrators who manage Google Workspace environments on a day-to-day basis. Candidates should be proficient in using the Google Admin Console to manage users, groups, organizational units (OUs), and device policies. You should understand how to configure email routing, set up data loss prevention (DLP) policies, manage mobile devices, and troubleshoot service delivery issues. This certification is ideal for IT professionals who support end users in organizations that rely on Google Workspace as their primary productivity and collaboration suite.

Exam Details

Exam Code	Associate Google Workspace Administrator
Duration	120 minutes
Number of Questions	50-60 questions
Passing Score	70% (approximately)
Cost	$200 USD
Validity	2 years (recertification required)
Question Types	Multiple choice and multiple select
Testing Options	Kryterion testing center or online proctored
Recommended Experience	6+ months administering Google Workspace
Certification Level	Associate

Domain Weights

Domain	Weight
Domain 1: Managing Objects	~20%
Domain 2: Configuring Services	~15%
Domain 3: Troubleshooting	~25%
Domain 4: Data Access and Authentication	~25%
Domain 5: Supporting Business Initiatives	~15%

Study Tips

Get hands-on experience with the Google Admin Console; most exam questions are scenario-based and require you to know where specific settings are located and how to configure them
Understand the organizational unit (OU) hierarchy and how service settings are inherited and can be overridden at different OU levels
Study Gmail routing rules, compliance settings, and spam filtering in depth; email administration questions are heavily tested
Know how to configure and troubleshoot SSO, 2-Step Verification, and security key enforcement for different user groups
Practice using the Google Admin Console investigation tool, audit logs, and email log search to troubleshoot delivery and access issues
Review Google Vault for eDiscovery and data retention; understand holds, retention rules, and how they interact with deleted data
Familiarize yourself with endpoint management for mobile devices and Chrome OS, including device policies and remote wipe capabilities

User Lifecycle Management

Managing users is a core responsibility of a Google Workspace administrator. The user lifecycle encompasses provisioning new accounts, configuring their access and services, managing ongoing changes (name updates, department transfers, role changes), and ultimately deprovisioning accounts when employees leave the organization. Google Workspace supports multiple methods for user provisioning: manual creation through the Admin Console, bulk upload via CSV files, automatic provisioning through directory sync tools like Google Cloud Directory Sync (GCDS), and API-based provisioning for custom integrations. Understanding the full lifecycle and the tools available for each stage is essential for efficient and secure Workspace administration.

Action	Description	Key Considerations
Create User	Add individual users through Admin Console or bulk upload via CSV	Assign to correct OU; set initial password with forced reset; assign appropriate license
Suspend User	Temporarily disable access while preserving all data and settings	User cannot sign in; email continues to be received; does not free license; good for leave of absence
Archive User	Convert active user to archived state; preserves data; uses Archive User license	Frees active license; data accessible by admin; user cannot sign in; cheaper than keeping full license
Delete User	Permanently remove user account; 20-day recovery window	Transfer data first (Drive, Calendar ownership); emails cannot be transferred after deletion; cannot recover after 20 days

Organizational Units (OUs)

Concept	Description
OU Hierarchy	Tree structure starting from root OU; child OUs inherit settings from parent; settings can be overridden at any level; each user belongs to exactly one OU
Service Settings Inheritance	Service configurations (Gmail, Drive, Calendar, etc.) are applied per OU; child OUs inherit parent settings unless explicitly overridden; changes propagate to all child OUs unless overridden
Best Practices	Mirror your organizational structure; create OUs for departments, locations, or contractor types; use for differentiated security policies; keep the hierarchy manageable (avoid excessive nesting)

Exam Tip: A user can only belong to one OU, but they can belong to multiple groups. Use OUs for applying service settings and groups for granting access to resources. When you need a setting to apply based on job function rather than department, consider using configuration groups or access groups instead of OUs.

Groups Management

Group Type	Purpose	Example
Email Distribution	Send email to multiple recipients using a single address	[email protected] sends to all marketing team members
Access Groups	Control access to Google Workspace services and features	[email protected] gets early access to new Workspace features
Configuration Groups	Apply specific Workspace settings to a subset of users regardless of their OU	[email protected] requires advanced security settings
Collaborative Inbox	Shared mailbox where multiple users can manage, assign, and track messages	[email protected] where team members assign and resolve tickets

Directory Synchronization

Google Cloud Directory Sync (GCDS): Synchronizes users, groups, and organizational units from Microsoft Active Directory or LDAP to Google Workspace; runs on an on-premises server; one-way sync from directory to Google; scheduled or manual sync runs; does not sync passwords by default
Admin SDK Directory API: Programmatic user and group management; REST API for creating, reading, updating, and deleting users; automate provisioning from HR systems or custom applications; supports batch operations for efficiency
Third-Party Identity Providers: Integrate with identity providers like Okta, Azure AD, or Ping Identity using SAML SSO; provision and deprovision users automatically through SCIM protocol; centralize identity management across multiple SaaS platforms
Password Sync: Google Password Sync tool synchronizes Windows Active Directory passwords to Google Workspace; runs as a Windows service on domain controllers; enables users to use the same password for both systems; separate from GCDS

Gmail Administration

Gmail administration is one of the most heavily tested topics on the Google Workspace Administrator exam. As an administrator, you need to understand how to configure email routing, manage spam filters, set up compliance rules, and troubleshoot email delivery issues. Gmail in Google Workspace provides enterprise-grade email with features like confidential mode, email delegation, send-as configuration, and advanced phishing protection. The Admin Console provides granular control over Gmail settings at the organizational unit level, allowing you to apply different email policies to different groups of users within your organization.

Feature	Description
Email Routing	Configure default routing, split delivery (send some mail to external servers), dual delivery (deliver to Gmail and another server), and catch-all addresses; routing rules are evaluated in order of priority
Spam & Phishing Protection	Configure allowed/blocked senders lists; adjust spam aggressiveness; enable enhanced pre-delivery message scanning; configure inbound gateway settings for third-party filters
Compliance Rules	Content compliance (scan for sensitive content); objectionable content (block or quarantine); attachment compliance (restrict file types); append disclaimers to outgoing messages
Email Authentication	SPF (Sender Policy Framework) defines authorized sending servers; DKIM (DomainKeys Identified Mail) signs emails cryptographically; DMARC (Domain-based Message Authentication) defines policy for failed checks
MX Records	DNS records that direct email to Google servers; priority values determine order; must configure at domain registrar; Google provides 5 MX records with different priorities

Exam Tip: Know the order of email authentication: SPF verifies the sending server IP, DKIM verifies the message integrity with a cryptographic signature, and DMARC tells receiving servers what to do when SPF or DKIM checks fail (none, quarantine, or reject).

Google Drive and Shared Drives

Feature	Description
Drive Settings	Control sharing outside the organization (allow, warn, or block); set default link sharing; manage Drive for Desktop (formerly Drive File Stream); configure storage limits per user
Shared Drives	Team-owned storage where files belong to the organization, not individual users; members can leave without affecting files; 5 access levels: Manager, Content Manager, Contributor, Commenter, Viewer
Data Loss Prevention (DLP)	Scan Drive files for sensitive content (credit card numbers, SSNs, etc.); block external sharing of flagged files; custom detection rules with regex patterns; DLP rules applied per OU
Transfer Ownership	Admin can transfer file ownership when users leave; use Data Export tool for bulk transfers; Shared Drive files do not need ownership transfer since they belong to the organization

Calendar, Meet, and Chat Administration

Service	Key Admin Settings
Google Calendar	External sharing settings (free/busy only vs. full details); calendar resources (rooms, equipment); manage resource booking permissions; configure working hours and location defaults
Google Meet	Control who can create meetings; configure recording settings and storage; manage live streaming permissions; set meeting safety controls (host management, quick access); manage Meet hardware
Google Chat	Enable or disable Chat for the organization; control external chat permissions; manage Spaces creation; configure Chat apps (bots) access; history settings (on or off by default)

Google Workspace Marketplace and Third-Party Apps

Marketplace Management: Control which third-party apps users can install from the Google Workspace Marketplace; whitelist specific apps; block all apps except approved ones; review installed apps and their data access permissions
API Access Control: Manage which third-party applications can access Google Workspace data via APIs; configure OAuth app access control; trust or block specific OAuth client IDs; monitor API usage in the Admin Console
App Whitelisting: Create a list of approved third-party applications; restrict users to only install whitelisted apps; review and approve new app requests from users; essential for maintaining security and compliance
Add-Ons: Google Workspace add-ons extend functionality of Gmail, Drive, Calendar, and other core services; admin can deploy add-ons organization-wide; manage permissions and data access for each add-on

Email Troubleshooting

Email delivery problems are among the most common issues a Google Workspace administrator must resolve. The Admin Console provides several tools for diagnosing email issues, including the Email Log Search tool, which allows you to trace the path of individual messages and identify where they were delivered, rejected, or quarantined. Understanding email authentication (SPF, DKIM, DMARC), routing rules, and spam filtering logic is essential for effective troubleshooting. When users report missing emails, the first step is always to search the email logs to determine whether the message was received by Google servers and what happened to it during processing.

Issue	Common Causes	Resolution Steps
Email Not Received	Incorrect MX records; spam filter; routing rules; sender blocked	Check Email Log Search; verify MX records; check spam folder; review routing rules; check allowed/blocked senders list
Email Marked as Spam	Failed SPF/DKIM/DMARC checks; sender reputation; content triggers	Add sender to allowed list; verify authentication records; whitelist sending domain; review compliance rules
Bounce Messages	Invalid recipient; mailbox full; sending limits exceeded; authentication failure	Check bounce code (550 = permanent, 451 = temporary); verify recipient exists; check sending quotas; review SPF record
Email Routing Issues	Misconfigured routing rules; split delivery problems; inbound gateway issues	Review routing rules in order; test with Email Log Search; verify inbound gateway configuration; check compliance rules

Admin Console Investigation Tools

Tool	Description
Email Log Search	Search for messages by sender, recipient, date, message ID, or subject; view delivery status and routing path; data available for up to 30 days; essential for email troubleshooting
Security Investigation Tool	Advanced search across Gmail logs, Drive logs, device logs, and user logs; correlate events across services; take bulk actions (delete emails, suspend users); requires Enterprise edition
Audit Logs	Track admin actions (Admin audit log), user actions (Login audit log, Drive audit log), and SAML app access; retained for 6 months; export to BigQuery for long-term analysis
Google Workspace Status Dashboard	Public dashboard showing service status for all Google Workspace services; check for outages before troubleshooting; shows current and historical incident data
Reports Dashboard	Usage reports for apps (Gmail, Drive, Meet, etc.); user activity reports; security reports (2SV adoption, external sharing); highlights potential security risks

Exam Tip: The Security Investigation Tool is available only with Google Workspace Enterprise or Education editions. For Business editions, use Email Log Search and standard audit logs. Know the data retention periods: Email Log Search retains data for 30 days, audit logs for 6 months.

Authentication and Access Troubleshooting

Issue	Diagnosis & Resolution
User Cannot Sign In	Check if account is suspended or deleted; verify password is correct (admin can reset); check if 2SV is enrolled and if backup codes are available; review login audit log for error details; check if user is blocked by context-aware access policy
SSO Failures	Verify IdP configuration (entity ID, ACS URL, certificate); check certificate expiration; review SAML response for errors; test with HAR file capture; ensure user exists in both systems
2-Step Verification Issues	Generate backup codes for user; temporarily disable 2SV enforcement for specific user; provide backup phone registration; check if security key is registered; review grace period settings
App Access Denied	Check if service is enabled for user's OU; verify license assignment includes the service; review API access control settings; check if third-party app is blocked; review OAuth app whitelist

Common DNS Issues

MX Record Issues: Incorrect priority values cause email to route to the wrong server; missing Google MX records prevent email delivery; use dig or nslookup to verify records; allow up to 72 hours for DNS propagation
SPF Record Issues: Too many DNS lookups (max 10); missing include statements for third-party senders; multiple SPF records on a single domain cause failures; use SPF validator tools
DKIM Issues: Key not published in DNS; selector mismatch between Admin Console and DNS; key size insufficient (use 2048-bit); CNAME vs TXT record format differences between registrars
Domain Verification: TXT or CNAME record for verifying domain ownership; must be verified before using domain with Workspace; verification can fail if DNS propagation is incomplete

Security and Authentication

Securing a Google Workspace environment requires a defense-in-depth approach that combines strong authentication, access controls, data protection, and continuous monitoring. As an administrator, you are responsible for enforcing security policies that protect organizational data while maintaining productivity for end users. Google Workspace provides multiple layers of security, from basic password policies to advanced threat protection and zero-trust access controls. Understanding these security features and knowing when to apply each one is a significant portion of the exam.

Feature	Description
Password Policies	Set minimum password length (8-100 characters); enforce password strength requirements; configure password expiration; prevent password reuse; applied per OU or for the entire organization
2-Step Verification (2SV)	Require a second factor after password; methods include security keys, Google prompts, authenticator app, backup codes, phone verification; enforce or allow per OU; grace period for enrollment
Security Keys	Physical FIDO2/U2F keys providing the strongest phishing-resistant authentication; enforce security key only for high-risk users (admins, executives); built-in security key available on Android and iOS devices
Single Sign-On (SSO)	SAML 2.0-based SSO with third-party IdPs (Okta, Azure AD, ADFS); configure at the organization or OU level; Google as IdP for third-party SaaS apps; network masks for SSO bypass
Context-Aware Access	Control access based on user identity, device security status, IP address, and geographic location; create access levels with conditions; apply to specific apps; Enterprise edition required

Data Protection

Feature	Description
Data Loss Prevention (DLP)	Scan Gmail messages and Drive files for sensitive data (PII, financial data, health records); predefined detectors for common patterns; custom detectors with regex; actions include warn, block, or quarantine
Google Vault	eDiscovery and archiving for Gmail, Drive, Chat, Meet recordings, and Voice; create retention rules to keep data for specified periods; place legal holds to preserve data during litigation; search and export data
Retention Rules	Default retention (applies to all data without a specific rule); custom retention rules per OU or date range; held data is retained even if users delete it; retention rules do not delete data on hold
Legal Holds	Preserve data for specific users related to legal matters; overrides retention rules and user deletions; hold until explicitly released; apply to Gmail, Drive, Chat, Meet, and Voice
Client-Side Encryption (CSE)	Encrypt data before it reaches Google servers using customer-managed keys; available for Drive, Gmail, Calendar, and Meet; requires external key management service; Enterprise Plus feature

Exam Tip: Understand the difference between Google Vault retention rules and legal holds. Retention rules automatically purge data after the specified period (unless on hold), while legal holds preserve data indefinitely regardless of retention rules. A legal hold always takes precedence over retention rules.

Admin Roles and Delegation

Role	Description
Super Admin	Full access to all Admin Console settings and data; can manage other admin roles; at least 2 super admins recommended for recovery; should use security keys
Predefined Admin Roles	Groups Admin, User Management Admin, Help Desk Admin, Services Admin, Mobile Admin; each has specific permissions; assign to delegate specific tasks
Custom Admin Roles	Create roles with specific privileges; granular permission selection; scope to specific OUs; principle of least privilege; up to 750 custom roles per organization

Endpoint Management

Basic Mobile Management: Enforce screen lock; remote account wipe (not full device wipe); see device inventory; no agent installation required; included with all Workspace editions
Advanced Mobile Management: Enforce device policies (encryption, password complexity); approve or block devices; remote full device wipe; install managed apps; work profile on Android; requires MDM agent or profile installation
Chrome OS Management: Chrome Enterprise license for advanced management; configure Chrome policies (extension whitelist, URL filtering, Wi-Fi settings); kiosk mode; managed guest sessions; device enrollment
Windows Device Management: Google Credential Provider for Windows (GCPW); enables Google account login on Windows; enforces Google password policies; SSO to Windows devices; device inventory tracking
Context-Aware Access: Require managed devices, specific OS versions, or device encryption before granting access to Workspace services; combine with access levels for zero-trust security model

Google Workspace Editions and Licensing

Understanding Google Workspace editions and their feature differences is important for supporting business initiatives and recommending the right solution. Each edition targets different organizational needs, from small businesses to large enterprises with advanced security and compliance requirements. As a Workspace administrator, you should know which features are available in each edition so you can advise stakeholders on licensing decisions, plan feature rollouts, and ensure the organization is getting maximum value from its Workspace investment.

Edition	Target Audience	Key Features
Business Starter	Small businesses	30 GB storage per user; custom email; basic admin controls; 100-participant Meet
Business Standard	Growing businesses	2 TB storage per user; Meet recordings; Shared Drives; appointment scheduling; 150-participant Meet
Business Plus	Businesses needing security	5 TB storage per user; Vault; advanced endpoint management; enhanced security; 500-participant Meet
Enterprise Standard	Large organizations	5 TB pooled storage; DLP; Security Investigation Tool; advanced compliance; 1000-participant Meet
Enterprise Plus	Enterprises with advanced needs	5 TB pooled storage; client-side encryption; S/MIME; context-aware access; advanced compliance; 1000-participant Meet with noise cancellation and live translated captions

Migration Planning

Migration Source	Tool	What Migrates
Microsoft Exchange/365	Google Workspace Migration for Microsoft Exchange (GWMME) or Data Migration Service	Email, calendar, contacts; server-side migration; admin-initiated; supports staged migration
IMAP Servers	Data Migration Service in Admin Console	Email only; requires IMAP access; admin-initiated; batch processing
Other Google Workspace	Data Migration Service	Email, calendar, contacts; domain-to-domain; useful for mergers and acquisitions
User Self-Migration	Google Workspace Migration for Microsoft Outlook (GWMMO)	PST files from Outlook; user-initiated; installs locally; imports email, calendar, contacts

Change Management and Adoption

Phase	Activities
Rapid Release vs Scheduled Release	Rapid Release track gets new features immediately; Scheduled Release delays features by 1-2 weeks for testing; recommended to put most users on Scheduled and a test group on Rapid; configured per OU
Pilot Testing	Roll out changes to a small test group using OUs or groups; validate functionality and gather feedback before organization-wide deployment; use Rapid Release track for pilot groups
User Training	Leverage Google Workspace Learning Center; create custom training materials; appoint champions in each department; offer hands-on workshops; provide ongoing support resources
Monitoring Adoption	Use Admin Console usage reports to track adoption; monitor active users per app; compare usage across OUs; identify training gaps; set adoption targets and measure progress

Exam Tip: Google recommends the Scheduled Release track for production users and the Rapid Release track for IT administrators and early adopters. This approach allows admins to test new features before they reach the broader organization and prepare documentation or training materials in advance.

Compliance and Data Regions

Data Regions: Choose where data at rest is stored (United States, Europe, or no preference); applies to primary data for Gmail, Calendar, Drive, Docs, Sheets, Slides, Chat, and Vault; available in Business Plus and Enterprise editions
Access Transparency: View logs of Google staff accessing your data; available for Enterprise edition; provides near real-time transparency into admin access; includes reason for access and the specific data accessed
Access Approvals: Require Google staff to request your approval before accessing your data; approve, deny, or set automatic approval rules; provides maximum control over data access; Enterprise Plus feature
Compliance Certifications: Google Workspace holds ISO 27001, SOC 2/3, HIPAA BAA, FedRAMP, and GDPR compliance; compliance documentation available in the Google Workspace Trust Center; admin can configure settings to meet specific regulatory requirements

GCP-AGWA

Google Cloud Associate Google Workspace Administrator

GCP-AGWA Practice Exam 1

GCP-AGWA Practice Exam 2

GCP-AGWA Practice Exam 3

GCP-AGWA Practice Exam 4

GCP-AGWA Practice Exam 5

GCP-AGWA Practice Exam 6

Unlock All Content for GCP-AGWA

Preview (10 / 120)

Flash Cards

Available Languages

Exam Topics

GCP-AGWA Cheat Sheet

Google Cloud Associate Google Workspace Administrator (GCP-AGWA)

Exam Details

Domain Weights

Study Tips

User Lifecycle Management

Organizational Units (OUs)

Groups Management

Directory Synchronization

Gmail Administration

Google Drive and Shared Drives

Calendar, Meet, and Chat Administration

Google Workspace Marketplace and Third-Party Apps

Email Troubleshooting

Admin Console Investigation Tools

Authentication and Access Troubleshooting

Common DNS Issues

Security and Authentication

Data Protection

Admin Roles and Delegation

Endpoint Management

Google Workspace Editions and Licensing

Migration Planning

Change Management and Adoption

Compliance and Data Regions