Google Cloud Associate Google Workspace Administrator — knowledge map
The 38 core concepts of Google Cloud Associate Google Workspace Administrator and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (38)
Investigation tool
A tool that searches logs across data for security incidents (e.g., phishing spread) and takes bulk actions such as bulk-deleting messages or addressing devices; confirm scope before running powerful bulk actions.
Prerequisites: User lifecycle and compromise response
Google Drive (sharing settings)
Workspace's file storage. Admins control sharing scope (internal/external, link sharing), allow/restrict sharing, and shared-drive usage—configurable per OU or group.
Related: Shared drives
Gmail (administration)
Workspace's email service. Admins configure routing/receiving rules, content and attachment restrictions, check delivery status, and analyze message headers (to investigate spoofing).
Related: Gmail routing
DLP rules (Workspace)
Rules that detect sharing/sending of sensitive information in Drive or Gmail and warn or block. You configure detectors (predefined/custom) and actions (warn, block, audit).
Prerequisites: Google Drive (sharing settings)、Gmail (administration)
Passkeys (Google Workspace)
A phishing-resistant authentication method that verifies identity via a cryptographic key pair bound to a device's biometrics (fingerprint/face) or screen-lock PIN, with no password involved. Google Workspace admins can allow or require passkeys per organizational unit (OU), configuring them as one method under 2-step verification (2SV).
Prerequisites: Organizational Unit (OU)
Related: 2-step verification (2SV)
2-step verification (2SV)
Authentication strengthening that requires a second factor in addition to a password; enforceable per OU/group, with methods ranging from SMS/prompts to the strongest security keys/passkeys (FIDO).
Related: Passkeys (Google Workspace)
Context-aware access
A zero-trust control that allows/restricts access by conditions like device posture, location/country, IP range, and whether a corporate device; a layer combined with auth strengthening (2SV/SSO).
User lifecycle and compromise response
Creating, suspending, and deleting user accounts and responding to compromise. Suspend / password reset / session revocation contain incidents quickly; bulk actions handle many users; account recovery guards against mistakes.
SAML SSO (single sign-on)
Members authenticate at the IdP (Entra ID, Okta, etc.) before accessing GitHub. It handles authentication and lets you cut departed users centrally; auto-removal of accounts is SCIM’s job, not SAML alone.
Prerequisites: Single sign-on (SSO)
Organizational Unit (OU)
A unit for hierarchically grouping accounts within AWS Organizations. SCPs apply at the OU level, separating guardrails by environment (prod/dev) or department.
Single sign-on (SSO)
Signing in once to access multiple applications.
Audit logs and sign-in logs
Audit logs record user and admin activity; sign-in logs record authentication events. They track who did what and when, used for investigation and troubleshooting.
Data regions
A setting that confines Workspace stored data to a geography (e.g., US/EU) to meet residency regulations; a different axis from content-based DLP or domain-based trust rules.
Prerequisites: Trust rules
Workspace editions
Subscription tiers such as Business (Starter/Standard/Plus) and Enterprise. The advanced security/compliance features available (DLP, Vault, context-aware access, etc.) depend on the edition.
Prerequisites: Context-aware access、Google Vault (retention rules and holds)
Email Log Search
A tool to track a specific message delivery status (delivered, rejected, marked spam, delayed); pair with header analysis (route, SPF/DKIM/DMARC results) for root cause. Cross-data investigation and bulk action use the investigation tool.
Prerequisites: Investigation tool、Sender domain authentication (SPF/DKIM/DMARC)
Gmail routing
A Gmail setting that forwards/routes mail matching conditions to another destination/server; used with content/attachment restrictions for compliance.
Related: Gmail (administration)
Security dashboard and alert center
The security dashboard overviews the org security posture (sharing, spam, auth); the alert center receives notifications (suspicious logins, phishing) and links to the investigation tool. Different roles, used together.
Prerequisites: Investigation tool
Trust rules
Defines which external organizations (domains) sharing is allowed/restricted with, governing external sharing; domain-based, a different axis from content-based DLP.
Google Vault (retention rules and holds)
Handles retention rules (retain for a period, then delete) and holds (preserve data for litigation/investigation). A hold overrides retention deletion; preserved data is searched/exported via eDiscovery.
Related: eDiscovery
Sender domain authentication (SPF/DKIM/DMARC)
The three pillars of sender domain authentication. SPF lists which IPs may send for a domain; DKIM cryptographically signs mail to prove it's unaltered and from the claimed source; DMARC declares a policy (quarantine/reject) based on SPF/DKIM results plus where to send reports. Set via TXT records to fight spoofing/phishing, and it strongly affects spam filtering on the receiving side, including Google Workspace.
Apps Script
A JavaScript-based automation and extension platform for Google Workspace to build scripts and add-ons across Gmail/Drive/Sheets and more.
Prerequisites: Google Drive (sharing settings)、Gmail (administration)
HTTPS
HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.
Related: TLS
TLS
A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.
Prerequisites: Managed services (management boundary)
Related: HTTPS
Cloud Identity
A Google service that manages users and groups and federates external IdPs via SAML SSO and Directory Sync / GCDS.
Prerequisites: SAML SSO (single sign-on)
App access control (API access management)
Controls whether Marketplace and third-party connected apps may access Workspace data, limiting access to trusted apps and blocking unverified ones; a layer separate from service on/off.
Endpoint (device) management
Basic management applies minimal protection (e.g., screen lock); advanced management adds device approval, finer policy, and remote wipe. Company-owned gets strong management; personal (BYOD) uses account wipe to protect only work data.
Log export to BigQuery
Continuously exports audit logs/usage data to BigQuery for SQL-based cross-analysis, long-term retention, and custom reporting.
Prerequisites: Audit logs and sign-in logs
Device management levels (basic / advanced)
The strength of endpoint management. Basic = minimal control without enrollment; advanced = strong control (screen lock, encryption, wipe) after enrollment. Applied differently to company-owned vs personal (BYOD) devices.
Related: Endpoint (device) management
Marketplace apps / third-party app governance
Governs access to Google Workspace Marketplace apps and OAuth-connected third-party apps. Per-app allow/block, API access management (app access control), and trust/restrict settings for unconfigured apps prevent risky integrations.
eDiscovery
Searches, preserves (holds), collects, and exports relevant content for litigation or investigations.
Encryption at rest
Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.
Encryption in transit
Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.
Prerequisites: Encryption at rest
Security center (Workspace)
A security analytics dashboard in the Google Workspace Admin console; the security health page, investigation tool, and alerts help surface and remediate risk.
Prerequisites: Investigation tool
JSON
A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.
Managed services (management boundary)
A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.
Port number
A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.
Prerequisites: HTTPS
YAML
A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.
Prerequisites: JSON