Google Cloud Associate Google Workspace Administrator
225 practice questions
Last reviewed: April 2026
Personal notes and resource links for your study journey
Filter by Certification
The Google Cloud Associate Google Workspace Administrator (AGWA) validates the day-to-day skills of someone who provisions, configures, and supports Google Workspace (Gmail, Calendar, Drive, Meet, Docs, Chat) for an organization. Unlike the rest of the GCP track, AGWA does not test infrastructure or developer skills — it focuses on the Admin Console, OUs, group management, sharing policies, mobile-device management, security baselines, and Vault eDiscovery. The exam targets IT generalists, MSP staff, and enterprise messaging admins. It is the natural Google equivalent of the Microsoft 365 administrator track, and is commonly required by Google Workspace resellers and partners.
Largest domain at 22%. Provisioning users (manual, CSV, Directory Sync, Cloud Identity), organizational units, groups, suspending and offboarding accounts. Many scenarios involve nested OUs and inherited settings.
Configuring Gmail routing, Drive sharing defaults, Calendar resources, Meet recording, and Chat spaces. 18% — heavy on knowing which service-level toggle controls which user-visible behavior.
Vault retention rules, holds, eDiscovery exports; DLP rules; audit log review; data regions. 16% — distinguishing Vault from regular admin retention is a frequent stumbling block.
Context-Aware Access, 2-step verification enforcement, security keys, OAuth-app trust controls, password policies. 18%.
Basic and advanced mobile device management, endpoint verification, Chrome Enterprise policies. 12% — the smallest domain but with high-density questions.
Mail delivery (MX, SPF, DKIM, DMARC), shared drive permission edge cases, calendar sharing, Meet quality reports, log search. 14%.
Services you'll encounter on the exam and why each one matters.
Central administrative web app for managing users, groups, organizational units, services, devices, and security settings across a Workspace tenant.
Why it's on the exam: Every AGWA domain — Manage User Accounts, Core Services, Security, Endpoints — anchors on the Admin Console as the primary configuration surface.
Workspace mail service with admin-controlled routing, compliance, attachment, and spam policies plus delegated mailbox and BCC archiving.
Why it's on the exam: Manage Core Workspace Services tests Gmail routing, content compliance, and Safe Browsing settings administered from the Admin Console.
File storage and collaboration service with Shared Drives for team-owned content, sharing-policy controls, and admin-managed sharing scopes.
Why it's on the exam: Data Governance & Compliance questions cover Drive sharing restrictions, link-sharing defaults, and Shared Drive lifecycle — all configured per OU in the Admin Console.
Shared calendaring service with resource (room/equipment) booking, external-sharing policies, and delegation controls administered per organizational unit.
Why it's on the exam: Manage Core Workspace Services tests Calendar sharing scopes, resource setup, and Calendar Interop with Microsoft Exchange.
Workspace video conferencing with admin-controlled meeting policies, recording, attendance tracking, dial-in, and external-participant restrictions.
Why it's on the exam: Manage Core Workspace Services covers Meet policy sets — who can host, record, stream, or admit external guests — applied per OU or group.
Workspace messaging service with spaces, threaded conversations, external chat policies, and history/retention settings managed from the Admin Console.
Why it's on the exam: Data Governance & Compliance questions test Chat history retention, external-chat allow-lists, and Chat app installation policies.
Browser-based collaborative editors that ride on Drive for storage and share Drive-level access controls, version history, and Apps Script extensibility.
Why it's on the exam: Manage Core Workspace Services questions reach the Editors for sharing inheritance, comment-only access, and Microsoft Office file compatibility settings.
eDiscovery and retention service for Gmail, Drive, Chat, Meet recordings, and Groups — supports holds, searches, exports, and audit reports for legal/compliance teams.
Why it's on the exam: Data Governance & Compliance is the home of Vault questions — retention rules, holds vs. retention precedence, and search-export workflows.
On-prem agent that one-way syncs users, groups, calendar resources, and shared contacts from Microsoft Active Directory or LDAP into Workspace.
Why it's on the exam: Manage User Accounts and Objects tests provisioning patterns — GCDS is the named tool when source-of-truth identity lives on-prem.
Built-in SAML 2.0 identity provider (Workspace as IdP) plus configurable third-party IdP (Workspace as SP) with pre-integrated SAML apps for common SaaS.
Why it's on the exam: Manage Security Policies & Access Controls covers SSO architecture decisions — when Workspace is the IdP vs. when an external IdP fronts Workspace.
Enterprise migration tool that moves mail, calendar, contacts, Drive content, and shared resources from Microsoft 365 or other source platforms into Workspace.
Why it's on the exam: Manage User Accounts and Objects covers tenant onboarding scenarios — Workspace Migrate (and the older GWMME) is the named migration path.
REST APIs (Directory, Reports, Groups Settings, Calendar, Drive) plus the Admin SDK that script bulk user, group, role, and audit operations.
Why it's on the exam: Manage User Accounts and Objects expects scripted bulk operations — the Admin SDK is the named programmatic surface beyond the GUI.
Context-aware access broker that gates internal web apps and SSH/RDP traffic on user identity and device posture without a traditional VPN.
Why it's on the exam: Manage Security Policies & Access Controls touches on context-aware access scenarios where Workspace identity gates HTTPS or admin shell access.
Policy engine that gates Workspace app access on user identity, device posture (managed/unmanaged), IP subnet, and geography via access levels.
Why it's on the exam: Manage Security Policies & Access Controls is the home of access-level questions — Context-Aware Access is the named control beyond simple 2SV.
JavaScript-based runtime for automating Workspace — custom menus, sidebars, triggers, mail/calendar event handlers — with admin controls over execution scopes.
Why it's on the exam: Manage Core Workspace Services questions reach Apps Script for governance of script-based add-ons and quota or domain-execution policies.
Curated app store for third-party add-ons, with admin-controlled installation, allow/block lists, OAuth scope review, and tenant-wide deployment.
Why it's on the exam: Manage Security Policies & Access Controls tests OAuth scope governance — Marketplace settings are the named control for third-party-app risk.
Standalone identity-as-a-service (free and Premium tiers) shared with Workspace — users, groups, devices, SSO, and 2SV without the productivity apps.
Why it's on the exam: Manage User Accounts and Objects distinguishes Cloud Identity-only users from full Workspace users, and explains licensing of identity-only seats.
Unified security dashboard with the Security Health page, the Investigation Tool for queries across logs, and an Alert Center for actionable threat notifications.
Why it's on the exam: Manage Security Policies & Access Controls covers ongoing posture — the Security Center is the named surface for dashboards, investigations, and alerts.
Content-aware DLP for Drive, Gmail, and Chat that scans for predefined and custom detectors (PII, payment card, credentials) and enforces audit/warn/block actions.
Why it's on the exam: Data Governance & Compliance tests DLP rule design — predefined vs. custom detectors, scope by OU/group, and the audit-vs-block enforcement spectrum.
Workspace MFA surface — enforced 2SV with allowed factors (SMS, app, security key, passkey) and phishing-resistant FIDO2 passkeys as the recommended strong factor.
Why it's on the exam: Manage Security Policies & Access Controls covers MFA enforcement scope, allowed second-factor methods, and the migration to phishing-resistant authentication.
$75k–$110k–$165k USD annual
Range reflects US-based productivity / collaboration admin roles where Workspace is a primary platform. Senior Workspace engineers at large Google customers and partners can clear $180k. Pure help-desk and small-business admin roles trend lower; specialist consultants at Workspace-focused MSPs trend higher.
Source: levels.fyi 2025–2026 (Workspace and M365 admin roles, Google partner SE), U.S. BLS OEWS May 2024 (15-1244 network and computer systems administrators, 15-1232 computer user support specialists). Figures are approximate; actual compensation depends on role, region, and experience.
AGWA is the GCP track's most niche credential by absolute job-board volume, but demand is steady and well-defined. Google Workspace resellers and partners require it for technical staff, and large Workspace customers (advertising, media, retail, education) frequently list it on collaboration-engineer postings. The cert is roughly comparable in audience to the older "Google Workspace Administrator" Professional credential it replaced — Google split the track into Associate (this cert) and Professional tiers in 2024. AGWA is also valuable for Microsoft 365 admins moving into mixed-tenant environments and for IT generalists at companies that have standardized on Workspace.
There are no formal prerequisites. Google recommends six months or more of hands-on Workspace administration experience, but motivated candidates without prior Workspace experience can pass after working through the official Workspace Administrator Learning Path on Google Cloud Skills Boost (around 30–40 hours) plus daily practice in a free Workspace Business Starter trial tenant.
If you have no IT-administration background at all, expect to spend extra time learning DNS basics (MX, SPF, DKIM, DMARC), basic mobile-device management concepts, and the OU / group hierarchy model that Workspace shares conceptually with Active Directory. Microsoft 365 administrators making the switch will find the security and compliance domains map well; Workspace-specific UI flows and Vault are the main net-new material.
AGWA is associate-level and considered moderate. Plan on 50–80 hours of study over 6–8 weeks if Workspace administration is new to you, or 20–30 hours over 2–4 weeks if you are already an active Workspace admin. The exam is 50–60 multiple-choice / multiple-select questions in 120 minutes, delivered through Pearson VUE (Google migrated from Kryterion / Webassessor in early 2026).
The most common stumbling block is the Admin Console UI taxonomy — questions reward candidates who have actually clicked through every relevant settings page in a trial tenant. Distinguishing what Vault retention does vs. regular admin retention, and which security setting lives at OU level vs. group level vs. tenant level, is the highest-value study target. Google does not publish numeric scores — only pass/fail. The credential is valid for three years and recertification requires re-passing the current exam.
Initial general availability as the new Associate-tier replacement for the previous Professional Google Workspace Administrator track. Reduced infrastructure-style questions in favor of day-two Admin Console operations.
AGWA (Google Cloud Associate Google Workspace Administrator) is a a moderately difficult exam expecting practical hands-on experience plus solid understanding of best practices Associate-level exam. Most candidates need 80–150 hours of study spread over 6–12 weeks for associate-level exams. Most candidates who score consistently above the passing threshold on practice exams pass on their first attempt.
Most candidates need 80–150 hours of study spread over 6–12 weeks for associate-level exams. Time-to-pass varies widely by prior experience. Engineers with hands-on production experience in the underlying technology typically need less; candidates new to the platform should plan toward the upper end of that range.
AGWA is a recognized credential in the GCP ecosystem and signals validated knowledge to employers, recruiters, and clients. Whether it is worth the time and fee for you depends on your role and goals — it tends to pay off most for cloud engineers, architects, and consultants who work with GCP day-to-day or want to move into roles that do.
The passing score for AGWA is Not published. The exam contains 50 questions and lasts 2 hr.
The AGWA exam fee is $125 USD. Fees are set by GCP and may vary by region; always confirm the current price on the official GCP certification page before booking.
Google Cloud Foundational and Associate certifications are valid for 3 years. Recertify by re-passing the current version of the exam.
Yes. You can take the exam online (proctored via the provider's secure browser, available 24/7 in most regions) or at an in-person Pearson VUE test center during business hours. Both formats use the same questions, time limit, and passing score.
CertLabPro provides 15 study modes across the practice question bank for AGWA. The exam-simulation mode mirrors the real exam: 50 questions in 2 hr, with the same passing threshold of Not published. Browse mode lets you read every Q&A statically.