CCNA User Accounts Domains And Directory Questions

A user can hold up to 30 custom aliases in Microsoft Entra ID, satisfying the stem's maximum-count constraint. This limit applies to additional email addresses beyond the primary address, and each alias must be unique across the tenant's verified domains.

Job title and Department are built-in user profile fields that are visible to the entire domain by default and appear on the Contacts card. Bulk CSV upload or the Directory API users.update method can load the HR data for all staff at once, satisfying the requirement with minimal manual effort and consistent visibility.

Creating user accounts on the verified secondary domain within your existing Workspace account makes those users part of the same directory and service pool as your primary domain users. They can send and receive mail as @acme-parts.com while sharing directory, Drive, and other services. This is the correct path once the secondary domain is verified and no longer needed as a separate account.

Suspending the account immediately blocks sign-in and access to services while preserving all data and settings. You can unsuspend the account at any time if the user returns. This meets the requirement to prevent access immediately and allows easy restoration without a time limit, unlike deletion.

Adding studiobright.example as a secondary domain creates a distinct namespace within the same Workspace account, so acquired users can keep their existing addresses while still being managed centrally. Google requires you to prove ownership of the domain by placing a verification record in its DNS before it can be used for Gmail or sign-in.

The admin.directory.user scope grants full read/write access to user resources in the Directory API, which is precisely what user creation requires. Read-only scopes such as admin.directory.user.readonly cannot create accounts, and the broader admin.directory.user.alias scope only manages aliases, so this scope satisfies the stem's write requirement.

The Admin audit log records administrative actions, including organizational unit creation, modification and deletion, with actor, timestamp and affected resource. It is the report that surfaces OU changes, unlike the login audit or user reports.

An alias address routes mail to an existing user's mailbox without being a separate account, so messages sent to it land in the same inbox. This satisfies the stem's requirement of providing an alternative email address for an existing user.

GCDS lets you control what happens to Google accounts that are not found in the LDAP directory, including rules that stop them from being deleted and exclusion rules that make the sync ignore specific users or units entirely. That protects accounts that exist only in Google, such as service accounts or external administrators. Always run a simulated sync first, because its report lists every deletion it would perform.

GCDS does not act on users that disappear from the source directory unless the administrator explicitly enables the option to suspend or delete them. With that setting off, the sync treats the missing user as out of scope and leaves the Google account untouched, which explains why repeated syncs change nothing.

Shared contacts are governed by the organisation's external sharing policies, so the control lives under Directory > Directory settings > Sharing settings, where you toggle contact sharing across the domain rather than editing individual contact records.

The support contact phone number is editable under Company Profile, satisfying the stem's requirement for modifiable settings. This field controls the number displayed to users on the support page, and administrators can update it directly without contacting support, distinguishing it from read-only directory attributes such as primary domain name.

Self-service password reset only appears when the admin has enabled it in Security settings. If that toggle is off, the Forgot Password link cannot authenticate the user or send a reset code, which precisely matches the reported failure.

Verifying domain ownership is mandatory because Google must confirm you control the DNS before it will provision the secondary domain. Adding the domain in the Admin console only creates a pending entry; verification via a TXT or CNAME record activates it, satisfying the requirement that ownership be proven before the domain becomes usable.

Directory profile editing settings control whether users may change their own profile data, including photos. Disabling photo editing there removes the user-facing option, satisfying the requirement to prevent users from changing their profile photo without affecting other services.

A domain can only be verified in one Google Workspace account at a time. The 'Domain already in use' error therefore indicates the domain is verified elsewhere, which is exactly the cause the stem asks for.

The Directory API requires OAuth 2.0 bearer tokens for authorisation; service accounts with domain-wide delegation or user consent flows issue these tokens. API keys and basic authentication are not supported, satisfying the authentication requirement stated in the option.

GCDS allows you to specify what happens to users removed from the LDAP source: you can suspend them instead of deleting. By enabling suspension and disabling deletion, terminated employees are suspended, preserving their data for eDiscovery. This matches the HR policy and avoids irreversible deletion.

The primary domain is the identity foundation: it forms the user's primary email address and underpins the account itself. Secondary domains are additional domains hosted in the same tenant, used for alternate addresses or aliases rather than defining the account's core identity.

Suspending rather than deleting users who disappear from the source directory preserves their data and allows recovery if the removal was a mistake. This setting directly addresses the requirement to avoid accidental data loss from source-side deletions while still reflecting legitimate departures by blocking their sign-in.

A secondary domain is a distinct domain added to a Workspace account that shares the same user directory and administrative console as the primary domain, satisfying the stem's requirement for a recognised domain type. Unlike a domain alias, it can host its own users and is treated as a separate domain for routing and identity.

The group resource's `name` field stores the group's display name, a core attribute returned by the Directory API. Satisfying the stem's requirement for a genuine group resource component, it is distinct from membership or metadata fields, and administrators rely on it to identify groups during provisioning and licence assignment.

The Directory API exposes programmatic user provisioning, and a service account authenticates without interactive consent, enabling event-driven automation via Pub/Sub or scheduled scripts. This satisfies the requirement to create accounts automatically in response to a specific trigger.

Creating the user account, setting its organizational unit to Sales, and assigning a license directly satisfies both requirements. The organizational unit placement controls policy inheritance and the license enables Gmail and other services. This is the standard workflow in the Admin console and ensures the mailbox is provisioned in the correct location with the right service access.

The Two-step verification enforcement setting is located under Security > Authentication in the Admin console. From there, you can set enforcement to 'On' for the entire organization or for specific organizational units, requiring users to enroll in 2-Step Verification. This is the correct control for mandating two-step verification across users.

Disabling Google Meet at the OU level prevents contractors from using Meet while leaving the service enabled for other OUs. This satisfies the requirement to block Meet for the Contractors OU specifically and is a valid configuration step.

A custom admin role scoped to the Marketing OU grants management rights only within that organisational unit, satisfying the requirement to limit the user's authority to that OU alone. Built-in roles cannot be scoped this narrowly, so a custom role with OU scope is required.

Google requires proof of ownership before a domain can be used. Adding the provided TXT record to the domain's DNS configuration verifies that the administrator controls the domain. Without verification, the domain remains unverified and cannot be used for user accounts or mail delivery. This step is mandatory for every new domain added to Google Workspace.

A verified secondary domain needs its own MX records before Google will accept inbound mail for it. Verification alone proves ownership but does not route mail, so without MX records for example.net, messages to the new hires bounce with a DNS error even though the accounts exist and can send outbound mail.

GCDS syncs only directory objects matching its configured LDAP query, so a malformed or over-narrow filter excludes users from the sync scope entirely. Correcting the query restores the expected object set, directly resolving the sync failure described.

Google Workspace requires an OU to contain no users or child OUs before deletion, preventing orphaned accounts. You must first move or delete all contained objects, so the delete operation is blocked until the OU is genuinely empty.

The Admin console's Restore User tool recovers accounts deleted within the 20-day retention window, satisfying the 10-day constraint. Restoration reinstates the account with its prior data and group memberships, unlike recreating it manually. This is the native Google Workspace recovery path for recently deleted users.

The Admin console's bulk upload feature allows you to update user profiles, including standard fields like Department and Manager, using a CSV file. It is designed for bulk operations and minimizes manual effort. You can download a template, populate it with the HR data, and upload it to apply changes across all users.

The Admin SDK Directory API allows programmatic access to user data, including the 'recoveryEmail' field. By writing a script to list all users and check for the absence of a recovery email, administrators can efficiently generate a compliance report. This method is scalable and can be automated, making it the most efficient way to monitor the policy.

The bulk user management tool accepts a CSV upload and applies the chosen action across all listed accounts, including suspending them. Suspension is one of the supported operations, satisfying the stem's requirement for a valid bulk action.

Custom roles let you grant a narrow privilege set and bind it to a specific organisational unit, which is precisely the least-privilege model required. Assigning the role at the department OU limits each team lead to resetting passwords only for users inside that OU, without exposing any other administrative capability.

Custom attributes are defined under Directory > Users > Manage custom attributes in the Admin console, where schemas and fields are created. This satisfies the stem's requirement to add a custom attribute to user profiles.

The Admin console provides a straightforward workflow to add a user manually, including specifying the OU and assigning a license during creation. This ensures the user is placed correctly and has the necessary services from the beginning, matching the requirement.

Google Workspace allows creating custom roles with specific privileges and scoping them to an organizational unit. Assigning the Users > Reset Password privilege scoped to Support grants exactly the needed capability without broader access. This follows least privilege and meets the requirement precisely, making it the correct choice for this scenario.

Organizational units exist as directory objects the moment you save them in the Admin console, independent of membership. Because the OU path is persisted immediately, dynamic group rules, device policies, and access policies can reference it before anyone is moved in, and users who are later moved in automatically inherit the applied settings.

Users whose primary email address is in a secondary domain appear in the Global Directory under that secondary domain. Because example.net remains a secondary domain in the same account, setting primary addresses there produces the desired listing without changing the account's primary domain or disrupting users whose addresses remain in example.com.

In SAML SSO, the IdP is responsible for authenticating users. To redirect users to the correct login page based on their email domain, the IdP can use the 'domain_hint' parameter or a discovery service like the SAML Discovery Service. This is configured on the IdP side, not in Google Workspace. The administrator should work with the IdP to set this up, ensuring users are routed to the correct authentication endpoint.

Assigning a user to a group is available directly within the Users section, satisfying the stem's requirement for tasks performed there. Group membership changes are made from the user's detail page, which lists the groups the account belongs to and allows additions or removals without navigating to the separate Groups section.

Creating the user in the Admin console and assigning a Google Workspace licence provisions the account and grants access to services. This single action satisfies the minimum requirement, since an unlicensed user cannot access Workspace core services.

Google Cloud Directory Sync connects directly to on-premises Active Directory via LDAP and provisions users into Google Workspace, satisfying the requirement to sync local AD accounts. It maps AD attributes to Workspace fields and runs scheduled synchronisations, unlike Microsoft Entra ID, which targets Microsoft 365 rather than Google's directory.

Suspending the account immediately blocks sign-in and stops new mail delivery, but the mailbox, Drive files, and calendar data remain intact and can be restored or migrated later. This matches the retention requirement exactly, and the user still counts against your licence until you delete it or assign a Cloud Identity Free licence.

Resetting a password for one user requires the per-user credential control found under Directory > Users. Selecting the individual account exposes Reset password, which invalidates the existing credential and forces a change at next sign-in, satisfying the single-user constraint rather than a bulk organisational reset.

Suspension status is a writable boolean on the Directory API user resource, letting administrators suspend and restore accounts programmatically. This satisfies the stem's requirement for a genuine user-resource aspect, since the field is exposed directly through the resource's schema rather than through a separate endpoint or Microsoft Entra ID sign-in policy.

The 'Add user' dialog includes a domain dropdown listing every verified domain in the account, so selecting the target sub-domain creates the user there directly. This satisfies provisioning into a specific sub-domain without separate admin accounts.

PATCH applies partial updates, modifying only the phone number field while leaving other user attributes untouched. This satisfies the requirement to update phone numbers without overwriting unrelated profile data, unlike PUT, which replaces the entire resource.

After adding and verifying a secondary domain, you can create users whose primary email address uses that domain. This allows alice@subsidiary.com to sign in and receive mail under the same subscription. The secondary domain is not automatically assigned to existing users, so you must specify the subsidiary.com domain when creating each account.

Suspension preserves all mailbox content, Drive files and account data while blocking authentication, satisfying the scenario's requirement that access stops without deletion. Unlike deletion, which removes data after a retention window, suspension is reversible: the account and its data remain intact, and access can be restored by reactivating the user.

Migrating the user to the primary domain changes their primary address, so the former secondary-domain address is retained as an alias. Mail sent to the old address still reaches the same mailbox, preserving continuity and preventing lost messages during the transition.