Google Workspace admin interview questions

Question 1

When do you use an organisational unit and when do you use a group?

Accepted Answer

OUs carry settings and policy. Groups carry access and permissions. A user sits in exactly one OU, and settings flow down the OU tree, so OUs are how you say "contractors cannot install Marketplace apps". A user can sit in many groups, and groups are how you say "this person can open the finance shared drive". Reaching for an OU to grant access is the usual mistake, and it forces you into a tree shaped like your permissions rather than your policy.

Question 2

How do you roll out mandatory 2-step verification across 1500 people without locking anyone out?

Accepted Answer

In stages. Turn on enrolment without enforcement first and watch the enrolment report climb. Communicate a date. Enforce on a pilot OU, then widen. Use the new user enrolment grace period so joiners are not locked out on day one. Keep backup codes as a supported recovery path with a verified identity check before you issue one. Enforce security keys for admins earlier and harder than for everyone else, because that is where the blast radius is. And have a break-glass account that is exempt from the conditional rules before you start, not after.

Question 3

What is a break-glass account and how do you protect one?

Accepted Answer

An emergency super admin account that is not tied to a person, kept so that a failure of your own controls cannot lock you out of your own tenant. It is excluded from the Context-Aware Access rules that could deny it, its credentials are long, random and split between two custodians or sealed in a safe, its hardware keys are stored physically rather than carried, and every sign-in raises an alert. Test it on a schedule, because an untested recovery path is not a recovery path.

Question 4

How many super admins should a 1500 person tenant have, and how do you keep that honest?

Accepted Answer

As few as can cover the on-call rota, typically a handful. Everyone else gets a delegated admin role scoped to what they actually do, help desk gets password reset and user read without Drive access. A custom role can also be scoped to a single organisational unit when you assign it, but only where every privilege in it is one that means something per OU, broadly user and Chrome management. Add a domain-level privilege such as a security setting and the assignment goes domain-wide, which is how a role that looks contained is not. Admins hold a separate admin account from their daily one, so a phished day to day session is not a phished tenant. Review the admin list on a schedule and treat it as an access certification with a named approver, because admin creep is silent.

Question 5

What does Context-Aware Access give you that 2SV does not, and how do you deploy it without an outage?

Accepted Answer

2SV proves who is signing in. Context-Aware Access decides whether that sign-in is allowed from this device, this network, this location, this OS state. Deploy it in monitor mode first, which evaluates an access level and shows you what it would block without blocking anything, then a pilot OU with yourself in it, and always exclude the break-glass account before the first rule goes live. It needs Enterprise Standard or above, or Cloud Identity Premium. The failure mode is not subtle: a badly scoped rule locks out a region on a Monday morning.

Question 6

A third-party tool asks your users to grant it Drive access. How do you control that?

Accepted Answer

App access control. Move the domain to blocking unconfigured third-party apps, then allowlist by OAuth client ID what the business actually needs, trusting apps rather than leaving the decision to each user. Review the granted scopes, not just the app name, because read-only Drive and full Drive are very different risks. Report on existing grants first so you know what you are about to break, then communicate, then enforce.

Question 7

Design the joiner flow for a new starter.

Accepted Answer

Trigger from the HR system rather than from an email to IT, because the trigger is what makes it reliable. Create the account to a naming convention, place it in the OU for its department, add it to the groups that carry its access so licences and app entitlements follow automatically, apply the signature template, provision the Drive folders and share the induction material, assign the licence. The person should be able to work on day one without a ticket. Anything that still needs a human is the next thing to automate.

Question 8

Design the leaver flow. What has to happen and in what order?

Accepted Answer

Order matters. Suspend first, because that stops the session and buys you time. Then sign out all sessions and revoke OAuth tokens and app passwords, because suspension blocks sign-in without ending active sessions, and a third-party OAuth grant stays valid until the app itself checks the account state, which some never do. Transfer Drive ownership to the manager. Set mail delegation or a forward for the agreed period. Remove from groups. Reclaim the licence, but only after the data moves, because reclaiming first can strand the data. Keep the account suspended rather than deleted until the retention period passes. Every leaver should look identical in the log, which is what makes it auditable.

Question 9

Everyone automates joiners and leavers. What about movers?

Accepted Answer

Movers are where access accumulates. Someone changes team, gains the new group, and keeps the old one, because nobody is incentivised to take access away. Handle it as a real event from the HR feed: recompute group membership from the new role rather than adding to it, move the OU so policy follows, and reset anything role derived. If you cannot automate the removal, at minimum surface the delta in an access review so a human approves it.

Question 10

Someone leaves. What actually happens to the files they owned?

Accepted Answer

Files in My Drive are owned by the person, so they leave with the account unless you transfer ownership. Worth being precise here, because it is commonly overstated: suspending the account does not cut off the people it was shared with, they keep their access, the user just cannot create anything new. The problem arrives at deletion, not suspension. Files in a shared drive belong to the drive, so nothing moves and nothing breaks either way. That difference is the argument for putting team work in shared drives in the first place. In the leaver flow, run the ownership transfer before the licence is reclaimed and before the account is deleted.

Question 11

Explain SPF, DKIM and DMARC and how they relate.

Accepted Answer

SPF publishes which servers may send for your domain, checked against the envelope sender. DKIM signs the message so the receiver can verify it was not altered and that it came from a holder of the key. DMARC ties them to the visible From address through alignment, tells receivers what to do when neither passes, and asks them to report back. SPF and DKIM without DMARC leave the address a user actually sees unprotected, which is the whole point of the exercise.

Question 12

How do you move DMARC from p=none to p=reject without losing legitimate mail?

Accepted Answer

Start at none and collect aggregate reports until you can name every sender for your domain, including the ones nobody told you about, the marketing platform, the ticketing system, the finance tool. Fix alignment for each, usually by signing with DKIM on a subdomain. Then move to quarantine with a low percentage and raise it. Then reject. The whole exercise is a discovery problem before it is an enforcement problem, and rushing it is how a company loses its invoices.

Question 13

A partner says the mail you send them is going to spam. How do you diagnose it?

Accepted Answer

Get the full headers of an actual message, because everything else is guessing. Check the authentication results for SPF, DKIM and DMARC alignment. Check whether the sending IP or domain is on a blocklist, and whether the mail was relayed by something that broke the signature. Look at your DMARC aggregate reports for the same receiver. Then check the content path, links, attachments and whether the sending tool is a shared platform with a poor reputation. Fix the authentication first, since reputation problems that are really alignment problems are common.

Question 14

What is content compliance used for and where does it bite you?

Accepted Answer

Content compliance and objectionable content rules let you match on sender, recipient, headers or body and then act: quarantine, modify, reject, add headers, route elsewhere. It is how you stop card numbers leaving or enforce an external warning banner. Where it bites is that every matching rule applies independently. There is no priority order you can set, so you cannot write a narrow exception that overrides a broad rule the way a firewall would let you. A broad rule high in the OU tree quietly acts on a whole department, and adding a second rule to carve someone out does not carve them out, it just adds a second action. The way through is narrower match conditions rather than more rules. Test on a single OU, log before you block, and keep the quarantine reviewed, because a quarantine nobody reads is data loss with extra steps.

Question 15

Shared drive or My Drive, and why does it matter for governance?

Accepted Answer

My Drive is owned by a person, so the data has the same lifecycle as their employment. A shared drive is owned by the organisation, membership is managed, and nothing breaks when someone leaves. For anything team owned, the shared drive is the correct answer, and moving teams onto them is one of the highest value pieces of governance work available because it removes an entire class of leaver problem.

Question 16

How do you find and fix external file exposure across a large domain?

Accepted Answer

You need an audit tool that can query sharing across every file, then act on the results in bulk. In GAT+ that is a filter on Drive for external or anyone-with-link sharing, run as a scheduled report with a relative date window so it re-evaluates itself, with bulk remediation applied straight from the result set. The important part is that it recurs, because a one time cleanup tells an auditor nothing while a monthly record of review and remediation is evidence.

Question 17

What does DLP in Workspace actually let you do?

Accepted Answer

Scan content in Drive and Gmail against detectors, built in ones for things like card numbers and national identifiers, or your own patterns, then act. Block the share, warn the user, quarantine the message, or just log. Start in audit-only so you learn your false positive rate before you block anything, because a DLP rule that blocks legitimate work gets switched off by management within a week and you do not get a second attempt.

Question 18

How do you build recurring reports, and what is the detail people get wrong?

Accepted Answer

Filter the data area you care about, Drive, Gmail, Events, users, then schedule the result to run daily, weekly or monthly and deliver to the people who need it. The detail people get wrong is using a fixed date range instead of a relative one. A fixed range means the scheduled report happily returns the same stale rows every week and nobody notices for months. Relative windows re-evaluate at run time, which is the entire point of scheduling it.

Question 19

The admin console reports are not enough at your scale. Then what?

Accepted Answer

Export the audit logs to BigQuery and query them there. The Admin console holds roughly six months, so BigQuery is how you keep it longer, and it also gives you joins across log types and the ability to answer a question nobody anticipated when the report was designed. It is also how you feed a dashboard for leadership without an admin manually exporting a CSV every month. For a security workflow rather than an analytics one, the Security Investigation Tool is the faster path since it can act on results directly.

Question 20

Which audit logs matter and what is each one for?

Accepted Answer

Admin for configuration changes, which is your change record. Login for authentication events and suspicious sign-in signals. Drive for access, sharing and deletion. Gmail for message level events. OAuth token and app access for what third parties are doing. Groups for membership changes, which is really access change. Devices for endpoint state. The point of naming them is that an investigation is usually a join across two or three, not a look at one.

Question 21

What is the Alert Center for and how do you keep it useful?

Accepted Answer

It surfaces Google generated signals, suspicious logins, malware, phishing reported by users, plus your own custom rules built on log events. Keeping it useful means tuning it, because an alert channel that cries wolf gets muted and then it is worse than nothing. Route the high fidelity alerts somewhere a human will see them, send the rest to a review queue, and delete rules that have never once produced an action.

Question 22

An account is compromised. Walk me through it.

Accepted Answer

Contain: suspend the account, force sign-out of all sessions, and revoke OAuth tokens and app passwords, noting that a password change does automatically revoke OAuth tokens for certain products, with no admin setting involved, so the manual step is about the ones it does not cover rather than about the reset failing. Investigate: login events for where and when, then what was touched. Check for mail forwarding rules and filters, because quiet exfiltration is the first thing an attacker sets up and it survives a password change. Check Drive sharing changes and group membership changes. Remediate: new credentials, re-enrol 2SV, restore access. Prevent: if it was phishing, tighten DMARC or block the lookalike domain, review app access. Evidence: export the log so there is an audit trail.

Question 23

Multiple people report the same phishing email in the last ten minutes. What now?

Accepted Answer

Treat it as a campaign, not as individual reports. Search for the message across the domain and remove it from every mailbox that has it. Work out who clicked and who submitted credentials, which is a login event question, and contain those accounts before doing anything else. Block the sender and the domain, and if it impersonates you, check your own DMARC posture. Then tell people, quickly and without blame, because the ones who have not reported yet are the risk.

Question 24

A senior person is leaving for a competitor and legal suspects data exfiltration. What do you do?

Accepted Answer

Stop and involve legal and HR before touching anything, because this is an investigation with an evidence chain, not an IT task, and acting alone can destroy the case. Once instructed, place a Vault hold so nothing is destroyed by retention, including their mail and Drive. Then investigate: download and copy activity, external sharing, files moved to personal accounts, forwarding rules, USB or browser signals if you have endpoint coverage. Report facts and timestamps, not conclusions. Preserve first, analyse second.

Question 25

Someone made a folder of 3000 files public by accident. Go.

Accepted Answer

Fix the exposure at the folder level first so the bleeding stops, then verify the inherited permissions on the children actually changed, since assumptions here are how it stays public. Work out whether it was accessed while exposed, which is a Drive log question, and what was in it, which decides whether this is an incident or a near miss. Then ask why it was possible: default sharing settings, a target audience that is too broad, or missing DLP. A fix that only addresses the one folder is not a fix.

Question 26

When do you write a script and when do you use a supported tool?

Accepted Answer

Use the supported tool first, because it leaves an audit trail, has its own access control, and does not depend on the person who wrote it still working here. Write a script when there is no supported path, and when you do, treat it like software: source control, least privilege service account, logging, and something another person can pick up. In a 1500 person company maintainability beats cleverness, and a clever script only you understand is a liability disguised as an achievement.

Question 27

How does a script authenticate to Workspace to act on behalf of users?

Accepted Answer

A service account with domain-wide delegation, authorised in the admin console for a specific set of OAuth scopes, which then lets it impersonate users for those scopes only. The risks are worth saying out loud: the scope list is the blast radius, so grant the narrowest set that works, keep the key material out of the repository, rotate it, and log what the account does. A widely scoped delegated service account is effectively a second super admin with no face.

Question 28

What makes an automation safe to re-run?

Accepted Answer

Idempotency. Running it twice should leave the same state as running it once, so check before you create, treat already-in-that-state as success rather than as an error, and never assume you got a clean run last time. Add a dry run mode that reports what it would do, rate limit against the API quotas, and make failures loud. Most damage from admin automation comes from a partial run being retried blindly.

Question 29

How do you run an access review at this size?

Accepted Answer

Pull entitlements from the source, groups, shared drive membership, admin roles, third-party app grants, and put the decision in front of the person who owns the system rather than in front of IT, because IT cannot know whether a finance analyst still needs that drive. Timebox it, make no-response mean revoke rather than keep, and record the approvals. Then close the loop by removing what was not approved, since a review with no revocations is theatre.

Question 30

The auditor asks you to evidence a control. What do they actually want?

Accepted Answer

That the control existed, applied to everything in scope, and was operating over the period, not just on the day they asked. So a screenshot of a setting is weak, and a scheduled report with a history of runs, a change record for when the policy was set, and evidence that exceptions were reviewed is strong. A control that is configured but cannot be evidenced is a finding, which is why the useful work is making the reviews repeatable rather than reconstructing them the week before the audit.

Question 31

Which Workspace controls map to ISO 27001, in your own words?

Accepted Answer

Access control and identity management sit on groups, OUs and SSO. Authentication sits on 2SV and security keys. Privileged access sits on delegated admin roles and super admin hygiene. Access rights and their removal sit on the joiner mover leaver process. Information access restriction and data leakage sit on Drive sharing settings and DLP. Logging and monitoring sit on the audit logs and Alert Center. Responsibilities on termination sit on the offboarding routine. The framing that matters is that compliance owns the standard and you own the controls that feed it.

Question 32

How would you approach reducing SaaS spend without breaking anything?

Accepted Answer

Measure before you cut. Pull last sign-in and last activity per licensed user, find the unused seats, the duplicate tools that do the same job, and the people on a tier they do not need. Reclaiming licences from leavers should already be automatic through offboarding, so if it is not, that is the first fix and it pays for itself. Then take the rightsizing to the team owner with the data rather than switching things off, because the second time you break someone's workflow you stop being invited to the conversation.

Question 33

Is Workspace your identity provider or your service provider, and why does the answer matter?

Accepted Answer

It can be either and often both. Workspace as IdP means it authenticates users into other SaaS through SAML, which is the common pattern when Workspace is the centre of gravity. Workspace as SP means an external IdP authenticates people into Workspace instead. The answer matters because it decides where lifecycle lives, where MFA is enforced, and what breaks when that system is down. Running both directions without deciding which is authoritative is how you end up with two half-managed sources of truth.

Question 34

How do you add a SAML application, and what usually goes wrong?

Accepted Answer

Exchange metadata, map the name ID to the right attribute, map any attributes the app needs for roles or grouping, then control who gets it by turning it on per OU or group rather than for everyone. What usually goes wrong is the name ID: if the app keys users on primary email and someone changes their email, the link breaks. After that it is attribute mapping for role assignment, and forgetting that turning the app on does not provision an account inside it unless you have also configured auto-provisioning.

Question 35

With 2SV enforced, does password policy still matter?

Accepted Answer

Yes, because 2SV is not on every path. Legacy protocols, app passwords, service accounts and recovery flows can all bypass what you assume is universal. Set length and reuse rules, block the obviously weak, and more importantly turn off less secure app access so basic authentication cannot be used to sidestep the second factor entirely. The password stops being the only control, it does not stop being a control.

Question 36

How do you control session length, and what is the tradeoff?

Accepted Answer

Session control sits under Security, access and data control, and it takes an organisational unit, which is the part that makes it useful: you can set hours for the admin OU and a working day for everyone else rather than picking one number for the company. Force reauthentication for sensitive admin actions on top. The tradeoff is real: too short and you train people to click through prompts without reading them, which is exactly the reflex a phishing page needs. Pair it with device trust so a managed laptop can hold a longer session than an unmanaged browser. This is also a practical argument for admins living in their own OU, since otherwise you have nothing to point the shorter session at.

Question 37

Your external identity provider goes down and nobody can sign in. What do you do?

Accepted Answer

First, confirm the blast radius, since an IdP outage can look identical to a network problem. Communicate early on a channel that does not depend on the thing that is down, which means it needs to exist before the incident. If Workspace is the SP, you may be able to fall back to Workspace authentication for a scoped group to restore critical functions, which is a decision to agree with security in advance rather than improvise. Use the break-glass account if admin access itself is gone. Afterwards, the review question is whether the dependency was documented and whether the fallback was ever tested.

Question 38

How do you handle contractors and other non-employees?

Accepted Answer

Give them their own OU so policy differs from staff, and an expiry date on the access from the day it is created, because the failure mode with contractors is not a bad offboarding, it is no offboarding at all when nobody tells IT the engagement ended. Restrict what they can share externally, keep them out of the default company-wide groups, and review the population monthly. If your HR system does not carry contractors, that gap is the root cause and worth fixing before automating anything downstream.

Question 39

The business asks for a shared mailbox. What do you actually give them?

Accepted Answer

A Google Group with collaborative inbox for most cases, since it needs no licence, membership is auditable, and nobody shares a password. A full user account is justified when it needs its own Drive, calendar or third-party sign-ins, and then it is a licensed account with a named owner, 2SV enrolled, and credentials in the password manager rather than in someone's head. The answer to avoid is an unlicensed shared account with a password three people know, because it is unattributable in the log.

Question 40

Your company acquires another one with its own Workspace tenant. How do you approach it?

Accepted Answer

Decide the end state first: merge into one tenant, or run both with federation for a period. Then inventory the other side, users, groups, shared drives, third-party apps and their SSO, and mail routing, because mail is where users notice breakage first. Sequence it so identity moves before data, run a pilot group end to end, and keep the old domain as an alias with routing so nothing bounces. The technical migration is the easy half; the communications plan and the calendar of cutovers is what makes it survivable.

Question 41

Split delivery or dual delivery, and when would you use either?

Accepted Answer

Split delivery routes each address to whichever system holds that mailbox, so a user exists in one place only. Dual delivery sends a copy to both, which is useful during a migration or when a legacy system needs to keep seeing mail. Dual delivery is a transition state, not a destination, because two systems holding the same mail means two places to search, two retention stories and a confused reply-all. Set an end date when you turn it on.

Question 42

How do you run a quarantine that people actually review?

Accepted Answer

Keep it small enough to be reviewable, which means tuning the rules that feed it rather than adding reviewers. Give it a named owner and a service level, notify senders and recipients where policy allows so a held message surfaces without someone digging, and report on the queue depth. A quarantine nobody empties is data loss with an audit trail, and the usual cause is one broad rule catching a category of legitimate mail that nobody has revisited since it was written.

Question 43

What does an external sender banner buy you, and what are its limits?

Accepted Answer

It gives users a consistent signal that a message came from outside, which raises the cost of impersonating an internal colleague and gives your phishing training something concrete to point at. The limits are habituation, since a banner on every external mail becomes invisible within weeks, and the fact that it does nothing about a compromised internal account, where the message genuinely is internal. It is a cheap layer, not a control you lean on.

Question 44

Someone sends a malicious attachment that is not yet in any signature database. What in Workspace helps?

Accepted Answer

The security sandbox executes attachments in a virtual environment and judges them on behaviour rather than signature, which is the mechanism that catches genuinely new payloads. It is Enterprise Plus and Education Plus only, so check the edition before promising it. Alongside it, enable the advanced settings for encrypted attachments, scripts from untrusted senders, and anomalous attachment types, and turn on link protection so URLs are evaluated at click time rather than at delivery, because an attacker can arm a link after the mail is delivered.

Question 45

What are target audiences and why are they better than the default?

Accepted Answer

A target audience lets you offer a scoped default sharing option, for example this department rather than the whole company, when a user shares a file. It matters because the alternative default is everyone in the organisation, and people take the default. Defining audiences that match how teams actually work turns the path of least resistance into the safer choice, which is more effective than training people to choose correctly under time pressure.

Question 46

How would you stop people bulk exporting company data through Takeout?

Accepted Answer

Control the Takeout service per OU, so it is off by default and enabled only where there is a reason. It is one of the few one-click bulk exfiltration paths a legitimate user has, and it is often left on because it is on by default and nobody looked. Pair it with monitoring, since the leaver investigation question almost always includes whether an export ran in the final weeks.

Question 47

Legal asks where the company's data physically lives. What can you tell them?

Accepted Answer

Data regions let you set a policy for where covered data is stored at rest, for example within Europe, applied per OU so different populations can differ. Be precise about the limits: it covers primary data at rest and its backups for the supported services, but not metadata, not logs, and not data in transit. It needs Enterprise Plus, Education Plus or the add-on. The honest answer names what is covered and what is not, because a confident overstatement here is the kind that surfaces in an audit.

Question 48

Where does Google endpoint management stop and a real MDM begin?

Accepted Answer

Fundamental management gives you inventory, remote wipe of the account, and basic policy without an agent, which is enough to know what is signing in. Advanced management adds device level policy and stronger enforcement. Neither replaces a full MDM for a Mac fleet, where you want configuration profiles, app deployment, patch enforcement and OS update control, which is what Mosyle, Jamf, Kandji or Intune are for. The clean split is that the MDM owns the device build and its compliance state, and Workspace consumes that state to make access decisions.

Question 49

How does device state end up affecting whether someone can open a document?

Accepted Answer

Through Context-Aware Access. The MDM enforces and reports compliance, encryption on, screen lock set, OS at a supported version, and Workspace uses that signal as a condition on access. That is the practical meaning of zero trust in this stack: the account is not enough, the device has to be in a known good state too. It also gives you a real answer to the lost laptop question, because a non-compliant device stops being able to reach data without you touching the account.

Question 50

What is Chrome browser management and why would you use it alongside MDM?

Accepted Answer

It manages the browser rather than the machine: extension allowlisting, policy, and reporting on what is installed and where people are signing in. It matters because the browser is where the work happens and where a lot of the risk sits, and because it reaches contractor and personal machines that will never be enrolled in your MDM. Extension control alone is worth it, since a malicious extension has a view of everything on the page including your admin console.

Question 51

A laptop is stolen from a car. Walk me through the first hour.

Accepted Answer

Treat the account as exposed, not just the hardware. Sign the user out of all sessions and revoke tokens, then decide on suspension based on whether they need to keep working from another machine. Issue a remote wipe from the MDM and confirm it actually executes rather than sits queued, since a powered-off laptop will not receive it, which is why full disk encryption is the control that really saves you. Check what was cached locally, mark the asset lost in the inventory, and if the device held anything regulated, hand it to whoever owns breach assessment. Then order the replacement, because the person still has a job to do.

Question 52

What goes on a monthly slide for leadership, and what does not?

Accepted Answer

Things they can act on or be accountable for: 2SV and device compliance coverage as a percentage with the trend, licences reclaimed and the money that represents, open access review exceptions with an owner and an age, and incident count with time to contain. What does not belong is raw ticket volume with no denominator, and any metric you cannot explain the movement of, because the first question will be why it moved and there is no recovering from not knowing.

Question 53

How do you prove that 2SV enforcement is actually complete?

Accepted Answer

Enrolment status per user against the full user list, not against the people who happen to appear in a report, and reconciled against the exclusions you deliberately made. The gap is usually in the edge cases: service accounts, shared role accounts, recently created users inside their grace period, and anyone in an OU the enforcement policy does not reach. Coverage claimed from a policy setting is weaker evidence than coverage measured from the enrolment data.

Question 54

How would you report on licence utilisation?

Accepted Answer

Join licence assignment to last sign-in and to meaningful activity, since sign-in alone flatters the numbers, then bucket into never used, dormant beyond a threshold, and on a tier above what they use. Run it monthly rather than at renewal, because at renewal you have no time to act and no leverage. Attribute by team so the conversation happens with the budget holder rather than with everyone at once.

Question 55

Files are disappearing across a shared drive in bulk. What is your first move?

Accepted Answer

Contain before you diagnose: work out which account is doing it and suspend it, because whatever the cause, the deletion continuing is the worst outcome. Then establish whether it is malicious, a misconfigured sync client, or someone tidying up with more permission than judgement, since all three look the same in the first minutes. Restore from the retention window, remembering that this is where the difference between Vault retention and an actual backup becomes real. Afterwards, look at who had manager rights on that drive and whether they needed them.

Question 56

A user deliberately shared a confidential document externally and says it was necessary for their job. Now what?

Accepted Answer

Separate the security question from the people question and do not try to own both. Contain the exposure, establish who accessed it, and hand the conduct part to HR with facts rather than an opinion. Then ask the more useful question: was there a supported way to do what they needed. If sharing externally was genuinely required and the sanctioned path was slow or did not exist, you have a process problem wearing a security incident costume, and punishing the user fixes nothing.

Question 57

How do you decide something is an incident rather than just a problem?

Accepted Answer

Have the criteria written down before the day, because deciding under pressure means deciding inconsistently. Typically it is an incident when confidentiality, integrity or availability of data is affected, when a control failed rather than merely being tested, or when it may be reportable. The value of the definition is not tidiness, it is that declaring an incident invokes a process, brings in the right people, and starts a clock. The failure mode is not over-declaring, it is three days of someone quietly hoping it was nothing.

Question 58

Onboarding could be a workflow in your admin tooling or a script you write. How do you choose?

Accepted Answer

Default to the workflow tooling, because it is visible to the rest of the team, it logs what it did, it survives you being on holiday, and it does not need a credential sitting in a repository. Write the script for the part the tool genuinely cannot reach, and keep it narrow so the supported path stays the backbone. The instinct to script everything is the one to resist at this size, since the cost is not writing it, it is the two years of maintaining it.

Question 59

Your bulk job starts failing partway through with rate limit errors. What is wrong and how do you fix it?

Accepted Answer

You are exceeding the API quota, and the naive retry makes it worse by adding load exactly when the service is asking you to back off. Fix it with exponential backoff and jitter, batch where the API supports it, and spread the work rather than firing everything at once. The deeper fix is to make the job resumable, so a partial run can be re-entered without redoing or duplicating work, because the failure will happen again on a bigger dataset.

Question 60

How do you test something that will change 1500 accounts?

Accepted Answer

Run it read-only first and diff what it would do against what you expect, on the full population, because scale surprises live in the data, not in the logic. Then run it for real on a pilot OU of a handful of accounts including your own. Then widen in stages with a check between each. Have the reverse worked out before you start, and if there is no reverse, that is the most important thing to know before rather than after. Announce it, because half of the incident is people not knowing why something changed.

Question 61

Vault retention is not a backup. Explain the difference to a sceptical stakeholder.

Accepted Answer

Vault governs how long data is kept and holds it against deletion for legal reasons, and it lets you search and export. It is built for discovery and compliance, not for restoring a working state quickly. It will not give you a clean point-in-time restore of a shared drive after a bad sync, and it is not designed for speed of recovery. If the business needs recovery, that is a separate capability with its own tooling and its own test. Saying this out loud early is much cheaper than discovering it during an incident.

Question 62

A team wants to buy a new SaaS tool that connects to Workspace. What is your process?

Accepted Answer

Find out what data it touches and what OAuth scopes it wants, since that is the actual risk and it is usually broader than the use case needs. Check whether it supports SSO and automated deprovisioning, because a tool without those becomes a permanent orphan account problem. Check where data is stored and what the vendor's own security posture looks like. Then check whether an existing tool already does the job, which is the question that saves the most money. Approve through app access control by client ID rather than leaving it to individual consent.

Question 63

How do you document an estate this size so it survives you?

Accepted Answer

Document decisions and their reasons, not screenshots of settings, because settings drift and screenshots rot. Keep a current map of what is integrated with what and how identity flows, runbooks for the things that happen under pressure, and the exceptions register with an owner and a review date. Put it where people already work rather than in a place only IT visits. The test is whether someone competent could cover your on-call week from what you have written.

Question 64

Security wants a control that will visibly slow down the business. How do you handle that?

Accepted Answer

Agree on the risk being addressed before arguing about the control, since most of these disputes are actually about an unstated difference in risk appetite. Then bring an alternative that reaches the same outcome with less friction, or propose staging it so the impact is measured rather than predicted. If it still lands and I disagree, I implement it properly and log the friction with evidence, because a control argued down on a hunch and one revised on data are very different conversations, and the second one you win.

Google Workspace admin interview questions

Longer reads

The stack behind these answers