EnglishDeutschFrançaisEspañolPortuguês

Google Cloud · GCP-AGWA · Intermediate

Associate Google Workspace Administrator — Practice Questions and Mock Exam

Practice with realistic GCP-AGWA questions aligned to the exam objectives. Alex explains every answer, and your readiness score shows what to study next.

55Questions
120minTime Limit

Checked against Google Cloud · August 2026Current exam version

About the exam

The Associate Google Workspace Administrator certification validates proficiency in managing Google Workspace environments for organizations. It covers user and group management, core service configuration (Gmail, Drive, Calendar, Meet), security policies, endpoint management, and troubleshooting.

This certification was introduced as the associate-level replacement for the retired Professional Google Workspace Administrator exam, making it the current standard for Workspace admin credentialing.

What's on the exam

Core Workspace service configuration is the single largest domain at 23%: routing and filtering mail, setting sharing defaults across Drive and Docs, configuring Calendar and Meet, and increasingly controlling how Gemini and generative AI features behave for the organization. User lifecycle and directory management ties with security policy at 20% each: the first covers onboarding, offboarding, SSO, and organizational-unit design; the second tests two-step verification rollout, password recovery configuration, context-aware access rules, and delegated admin roles. Data governance and compliance takes 15% of the exam (Vault retention, DLP, and Drive trust rules), monitoring and troubleshooting takes 13%, and endpoint management for mobile devices and Chrome browsers closes the blueprint at 10%.

The weighting mirrors daily admin work: most of the exam sits in service configuration and access control, while device management, the domain candidates from an MDM background expect to dominate, gets the smallest share.

Exam blueprint: GCP-AGWA

Managing user accounts, domains, and Directory~20%

Manage the user lifecycle including provisioning, deprovisioning, and SSO, and design organizational units and group structures for a Workspace domain. Also covers managing domains and configuring bookable buildings and resources.

≈ 12 h
Managing core Workspace services~23%

Configure core Workspace services including Gmail routing and security, Drive and Docs sharing settings, and Calendar and Meet configurations. Also covers configuring Chat, managing generative AI features like Gemini, and supporting Workspace development with AppSheet and Apps Script.

≈ 14 h
Managing data governance and compliance~15%

Hold and search organizational records through Google Vault, catch sensitive content before it leaves the domain with DLP and Drive sharing rules, and decide how data gets exported, stored, and labeled for classification.

≈ 9 h
Managing security policies and access controls~20%

Enforce password and two-step verification policies alongside context-aware access rules, dig into audit logs when something looks off, and control which Google and third-party applications users are allowed to connect.

≈ 12 h
Managing browsers and endpoints~10%

Choose the right tier of mobile management - basic, advanced, or third-party - for company and personal devices, and control Chrome through enrollment policies plus extension allow/block rules.

≈ 6 h
Monitoring and troubleshooting common issues~13%

Read audit logs and the Status Dashboard to spot what's actually broken, work through common failures in accounts, mail delivery, Calendar, Drive, and Meet, and escalate to Google support with the right log files when self-service runs out.

≈ 8 h

Exam format and question types

The exam draws 50–60 multiple-choice and multiple-select questions inside a 120-minute window, weighted roughly 80% single-answer to 20% multiple-select. Questions are scenario-based, walking through an admin-console task (provisioning a user, tightening a sharing policy, enrolling a Chrome device, or tracing a mail-delivery failure) and asking which setting or tool resolves it.

Question types: GCP-AGWA

Multiple Choice80%

Pick the single best answer from four or five options — the exam's bread and butter.

Multiple Response20%

More than one answer is correct and you need all of them; the question tells you how many to pick.

Google Cloud confirms these question types — a percentage split is not published; the shares reflect our exam-aligned question pool.

Try five GCP-AGWA questions

Five questions straight from our Associate Google Workspace Administrator pool. Answer one — Alex explains the why.

Managing browsers and endpoints1 / 5

You need to manage Chrome OS devices enrolled in your organization. A policy must be configured to prevent users from installing extensions outside of an approved list. Where do you configure this?

AlexFull explanation from Alex

Chrome OS device management in Google Workspace is handled through the Admin Console under Devices > Chrome > Apps & extensions. Administrators can configure extension policies at the organizational unit level, including allowlists (only approved extensions can be installed), blocklists (specific extensions blocked), and force-installed extensions (automatically deployed without user action). When an allowlist policy is set, users can only install extensions that appear on the approved list — all others are blocked by default. This is different from a blocklist approach, where everything is allowed except explicitly blocked items. User-level Chrome settings cannot override admin-enforced policies, and IAM roles are for Google Cloud resource permissions, not Chrome device management. Exam tip: Chrome policies are always managed under Devices > Chrome in the Admin Console, not under security or user settings.

Sourcecloud.google.com

Managing security policies and access controls3 / 5

An administrator is investigating a suspected data breach. They need to determine which files a specific user shared externally in the last 30 days and who accessed those files. Which tool should they use?

AlexFull explanation from Alex

The Investigation tool in the Google Workspace security center is the primary tool for analyzing security events across all Workspace services. For Drive-related investigations, it provides access to Drive audit logs that record: file creation, modification, and deletion; sharing events including who shared what with whom; external access events showing when external users viewed or downloaded files; file downloads, prints, and copies; and permission changes. Administrators can filter by specific users, date ranges, file types, and event types. This makes it ideal for investigating data breach scenarios where the administrator needs a complete picture of what a user shared externally. The Investigation tool is more powerful than standard reports because it supports complex queries, cross-referencing with other audit logs, and the ability to take remediation actions (like revoking file access) directly from the results. Exam tip: Investigation tool = detailed security event analysis with remediation; Reports = usage analytics; Vault = eDiscovery data preservation.

Sourcecloud.google.com

302 questions, built like the exam

Every domain of the GCP-AGWA exam has enough questions in the pool to practice it in depth. A mock exam asks 55 questions in one sitting, on the same 120-minute clock as the real thing.

Audit record: GCP-AGWA

Spec check against Google CloudAugust 4, 2026

last verified against the official Google Cloud source

Blueprint coverage26 official objectives

across 6 domains, from the official exam guide

Pool size302 questions

= 5 full practice exams of 55 questions each — never the same question twice

Domain coverageall 6 domains at official weight

Managing user accounts, domains, and Directory 54 · Managing core Workspace services 75 · Managing data governance and compliance 46 · Managing security policies and access controls 55 · Managing browsers and endpoints 27 · Monitoring and troubleshooting common issues 45

Canonically validated302 of 302

each verified against official Google Cloud documentation — answer, options and explanation, source cited

Methodology openly documented.How questions are made →

Preparing for GCP-AGWA

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

The exam runs through Pearson VUE, either online-proctored or at a testing center, and is offered in English and Japanese. The certification holds for 3 years, with renewal options available during the renewal eligibility period.

Your plan: GCP-AGWA

Preparation

Study time35–90 h

typically around 35 h if you already work with this stack, around 90 h coming to it fresh

LevelIntermediate
Worth having firstNo formal prerequisites. Recommended 6 months Google Workspace Super Admin experience with Business Plus or Enterprise edition.

Exam day & after

DeliveryOnline-proctored (Pearson VUE) or onsite-proctored at testing centers
Retake policy14-day wait after the first failed attempt, 60 days after the second, 365 days after the third. Maximum 4 attempts in a 2-year period.
Stays valid3 years

Certification valid for 3 years. Renewal options available within the renewal eligibility period.

The hours are our own planning estimate — Google Cloud publishes no preparation time for this exam. A starting point for your calendar, not a target.

Common pitfalls

Organizational-unit inheritance is the recurring trap: policies cascade down the OU tree in ways that surprise candidates who have only worked with a flat directory. Two-step verification enforcement, context-aware access, and third-party SSO configuration overlap in the Admin Console enough to blur together under exam time pressure. Drive sharing settings compound across org, OU, and individual levels rather than overriding cleanly, and data-region policy, which controls where Workspace data physically lives, gets less attention in most study plans than its exam weight deserves.

Watch list: GCP-AGWA

  1. 01OU Structure

    Misunderstanding organizational unit inheritance and how policies cascade

  2. 02Security Settings

    Confusing 2-Step Verification enforcement, context-aware access, and SSO configuration

  3. 03Drive Sharing

    Not understanding the interplay between sharing settings at org, OU, and individual levels

  4. 04Endpoint Management

    Overlooking mobile device management policies and Chrome device enrollment

  5. 05Data Regions

    Not knowing how data region policies affect where Workspace data is stored

Pass-IT trains you on exactly these weak spots — adaptive & spaced →

Frequently asked questions

What are common mistakes on the Associate Google Workspace Administrator exam?

Common pitfalls include: OU Structure, Security Settings, Drive Sharing, Endpoint Management, Data Regions. Focus study time on these areas to avoid losing points.

How do you get the Google Workspace administrator certification?

You sit the Associate Google Workspace Administrator exam, which runs 120 minutes and covers the admin console rather than end-user features. Google Cloud recommends six months as a Workspace super admin on a Business Plus or Enterprise edition, since several exam areas only exist in those tiers. The catalog budget is around 60 hours.

Which areas of the Workspace administrator exam carry the most marks?

Managing core Workspace services is the largest section at 23%, with user accounts, domains and Directory at 20% and security policies and access controls also at 20%. Data governance and compliance takes 15%, troubleshooting 13% and browser and endpoint management 10%. Identity and service configuration together are more than four tenths of the exam.

Do you need super admin access to prepare for this exam?

It is not required to book, but it is the recommendation, and it matters more here than on most exams. Several objectives cover console settings that only exist on Business Plus or Enterprise editions, so a free tenant will not show you them. If you have no admin console of your own, a trial tenant is the practical substitute.

How long does the Workspace administrator certification last?

Three years from the pass date. Renewal is handled inside an eligibility window that opens before expiry, so it has to be planned rather than left to the deadline.

How soon can you retake the Workspace administrator exam?

After 14 days for the second attempt, 60 days for the third and 365 days after that. Google Cloud allows a maximum of four attempts in any two-year period.

Pass-IT is an independent study tool, not affiliated with or endorsed by Google Cloud; Google Cloud and exam names are trademarks of their respective owners.

One certification. One payment.

Full GCP-AGWA access

Get the full question pool for this certification. Alex explains every answer, and your readiness score shows what to work on next.

Buy GCP-AGWA access for $29.99One payment. Lifetime access to this certification.
Take the free readiness check20 questions. No card. See what to study before you buy.

Reach 80% readiness and pass — or your money back.

How the score works →