CCNA Troubleshooting Questions

If the user is signed into Chrome with a personal Google Account while trying to join a meeting that requires their Workspace account, Meet may block access because the meeting is restricted to the organization. The mobile app likely has the correct Workspace account signed in. This mismatch commonly causes 'You cannot join this call' errors in browsers. The administrator should verify which account is active in Chrome and ensure the user signs in with their Workspace account.

The Admin console has settings that control whether users can join meetings hosted by external organizations or allow external participants to join internal meetings. If these settings are restrictive, the user may be blocked from joining an external partner's meeting. Adjusting these settings can resolve the issue. This is a key check for external access problems.

Calendar has a setting that controls whether invitations are automatically added to the calendar. If recipients have this disabled, they receive the email but the event does not appear until they manually respond. Checking the recipients' Calendar settings is the most direct way to explain why invitations are not showing up despite being delivered.

Google Workspace allows administrators to set sharing policies per organizational unit. If the user's OU has a policy that restricts access to files shared with 'Anyone in the organization', they will be blocked even if the file's sharing settings allow it. This is a common cause of permission errors when sharing settings appear correct. The administrator should check the OU's sharing settings in the Admin console.

The Users list in the Admin console displays all users and their status, including whether they are suspended. Administrators can filter by status to see only suspended users. This is the most direct and efficient way to identify suspended accounts in the domain.

Drive sharing settings inherited from the user's organisational unit override broader domain policies, so an OU-level restriction on external sharing blocks the share even when the partner's address is valid. This directly satisfies the stem's constraint that the cause sits within the Admin console rather than the recipient's configuration.

A suspended account is denied all Google services, so Drive access fails regardless of sharing or licence settings. Confirming the account status first rules out the most common administrative cause before investigating Drive-specific sharing or OU policy issues.

Shared drives use access levels assigned to users and groups. If the Google Group was removed from the shared drive's membership or its access level was downgraded, members of that group would lose access even though the drive still appears. The error 'You need permission' indicates the user's account no longer has an access level on the shared drive. The admin should verify the shared drive's membership in the Admin console or Drive and re-add the group with appropriate access.

Suspending the account immediately invalidates active sessions and blocks further authentication, containing the suspected compromise before investigation. This satisfies the stem's requirement to prevent further unauthorised access, since password resets alone leave existing tokens valid.

SAML application metadata supplies the entity ID, ACS URL and signing certificate that Microsoft Entra ID relies on when issuing assertions. Inspecting it verifies the service provider's configuration matches the trust established in Entra ID, directly satisfying the stem's requirement to check causes of SAML application errors.

Approved senders bypass the spam filter entirely, so messages from that sender are delivered rather than rejected. Adding the address to this allowlist directly resolves the rejection shown in the logs, satisfying the requirement to receive mail from the specific sender.

Data Migration Service transfers Drive files owned by the departing user to another user, satisfying the requirement to migrate their data. It preserves sharing permissions and folder structure during the transfer, unlike simple ownership reassignment or manual downloads. This makes it the appropriate tool for migrating a leaver's Drive content to a colleague.

The Account Activity report in the Admin Console exposes each user's recent security events, including sign-in timestamps, device details and access type. This directly satisfies the requirement to show a user their own login history, since the report surfaces authentication events tied to that specific account without needing separate audit log queries.

If the Calendar app lacks permissions for background data or storage, it may not sync properly. On Android, background data restrictions or battery optimization can prevent the app from syncing in the background. The administrator should check the app's permissions and ensure background data is allowed. This is a frequent cause of sync issues on mobile devices, especially after OS updates or battery-saving modes are enabled.

The SPF record authorises the third-party gateway's sending IP addresses to send on the domain's behalf. If it omits the gateway, Google's receiving servers see unauthorised senders and flag messages as spam. Updating the SPF record to include the gateway satisfies the requirement that Google trusts mail routed through it.

A recent password reset invalidates existing refresh tokens, so the mobile client's cached credentials fail and mail stops syncing until re-authentication. This directly satisfies the stem's non-syncing device constraint, since Microsoft Entra ID revokes tokens on password change, forcing the profile to prompt for updated sign-in details.

Email Log Search queries Google's mail infrastructure directly, showing whether inbound messages from the vendor reached Google's servers and what happened afterwards. This satisfies the need to verify server-side delivery before investigating the recipient's mailbox or vendor-side sending issues.

Gmail filters can automatically archive, delete, or label messages based on sender or subject. If the user has a filter that affects messages from the group's address, those messages may not appear in the inbox. The administrator should check the user's Gmail settings under Filters and Blocked Addresses. This is a common cause when group settings and spam filters are ruled out, as the issue is specific to the user's mailbox configuration.

Mobile sync halts when a device falls out of compliance: Google Mobile Management blocks Exchange ActiveSync and Drive access once policy checks fail, such as a missing passcode or failed device attestation. The reported loss of corporate data sync therefore points to a compliance-state change rather than a network fault.

The SMTP relay service accepts mail from allowed IP addresses, but it also requires either SMTP authentication with a valid Workspace account or explicit configuration to permit unauthenticated messages from those IPs. If the relay settings do not allow unauthenticated senders and no credentials are supplied, the server rejects the message with an authentication error, matching the symptom.

The most common cause of this error is that the user is signed in with a personal Google account instead of their Workspace account. The file is shared with the organization, so only the Workspace account has access. Checking the signed-in account is the quickest and most likely resolution. This directly addresses the access request prompt.

When a file owner's account is suspended or the owner's Drive service is disabled, files owned by that user can become inaccessible to others even if permissions remain listed. Checking the owner's account status and Drive service enablement is a logical first step because it directly explains why previously shared files stopped working while other files remain accessible.

The error 'Service not enabled for this account' often indicates that the user lacks the necessary license to access the service. Even if Drive is enabled for the OU, the user must have a license that includes Drive, such as Google Workspace Business Standard or higher. If the user is unlicensed or has a license without Drive (e.g., a Cloud Identity Free license), they will see this error. Checking the user's license is the next logical step.

Suspending a user in the Admin console immediately blocks sign-in and produces exactly this 'Account temporarily unavailable' error. Checking the account status there confirms whether the account is active, suspended or archived, which is the primary cause to verify before investigating password or device issues.

Gmail Audit logs record transport rule evaluation and message routing decisions, revealing whether the rule matched, was bypassed, or errored. Checking them first confirms the rule's actual behaviour against live mail flow, isolating configuration faults before altering the rule itself.

SMTP code 550 5.1.1 signals a permanent failure because the recipient address does not exist on the destination server. This directly satisfies the scenario: the mailing list address is invalid, so Google's outbound server rejects delivery rather than retrying.

Resetting the password and revoking sessions immediately halts the attacker's access, since a compromised account sending spam requires the intruder to be evicted first. Signing out all sessions invalidates existing refresh tokens in Microsoft Entra ID, preventing the attacker from re-establishing access with the old credentials.

The Security Investigation Tool queries message metadata across Gmail, letting you trace delivery, search for the missing message by sender, recipient or subject, and confirm whether it was quarantined, blocked or routed elsewhere. This directly satisfies the stem's requirement to track a reported missing email through its full delivery path.

Context-Aware Access access levels can require device trust, screen lock, or OS version compliance. If the sales OU has an access level that the new Android devices do not satisfy, sign-in is denied even with correct credentials. Reviewing the assigned access level and the device compliance signals for those devices is a direct way to find why laptop sign-in works but mobile sign-in fails.

Email Log Search provides detailed delivery status, including rejection reasons. Since the emails are not in spam, they might be rejected by Google's servers due to DMARC failures or other policies. Checking the logs will reveal if the messages are being blocked and why. This is the most direct way to diagnose why the emails are not being delivered.

Messages delivered to the mailbox but not visible in the inbox are often filtered by user-created Gmail filters or blocked senders. The admin should impersonate or ask the user to check Settings > Filters and Blocked Addresses for rules that archive, delete, or mark as spam messages from notifications@crmvendor.com. This aligns with the message trace showing successful delivery to the mailbox, indicating the issue is post-delivery.

The first step is to investigate the source of the failed attempts. By checking the login audit logs, the administrator can identify the IP addresses and determine if they are malicious. This information can then be used to block those IPs or take other mitigation steps. Understanding the attack is crucial before applying a fix. This is the most direct and informative first action.

External sharing in Google Drive is governed at the organisational unit level, so a policy disabling outside sharing for that user's OU would block the attempt regardless of file ownership. Reviewing Drive sharing policies in the Admin console directly tests the constraint causing the reported failure.

The Device Management dashboard in Microsoft Entra ID surfaces per-device policy compliance state, letting you confirm whether the mobile app's access is blocked by a failed or unapplied device policy. This directly satisfies the stem's requirement to check device policy status for the managed device.

Calendar sharing permissions directly govern whether a shared calendar appears for the user, so verifying the grant on the calendar's sharing settings resolves the visibility failure. This satisfies the stem's constraint: the user cannot see the calendar, which sharing permissions control. Confirm the user holds at least Reviewer or higher, since insufficient rights hide it.

The 5.7.1 SMTP code signals a message rejected due to a policy, permission, or security decision rather than a missing address or full mailbox. In Gmail, content compliance rules, attachment compliance rules, blocked sender lists, or DLP policies that reject matching mail all surface as 5.7.1 in Email Log Search, which matches this scenario exactly.

Incorrect MX records directly break inbound routing: sending servers query DNS for the domain's MX and deliver to whatever host is published. If those records are missing, malformed, or point to the wrong server, external mail never reaches the Gmail mailbox, satisfying the stem's "not receiving external mail" constraint.

A 550 5.7.1 rejection typically indicates the receiving server refused the message due to authentication failure. If the sending domain's SPF, DKIM, or DMARC alignment fails, the recipient's policy rejects it, satisfying the scenario of bounces to one external domain.

Checking Drive for Desktop's status and error logs first isolates whether the fault lies in the client itself — authentication, cache corruption, or a stalled sync process — before touching network or account settings. This satisfies the stem's requirement for the initial diagnostic step, since the application's own telemetry pinpoints the failing component directly.

Group posting permissions default to allowing only members or owners to send messages. If the sender falls outside the group's 'Who can post' configuration, delivery is rejected. Adjusting this setting to include the user or a broader audience resolves the restriction directly.

The Drive audit log records all sharing events, including external sharing, with timestamps and actor details. It shows exactly when a file was shared outside the domain and by whom. This is the correct tool because it provides the granular event data needed to pinpoint the user action and time.

The error 'Your account is not allowed to sign in from this device' typically appears when a device policy in the Admin console restricts sign-in to managed devices or specific platforms. The admin should check the organizational unit's device settings under Security > Access and data control > Device management, or Context-Aware Access policies. These policies can block unmanaged devices or require device approval. Adjusting the policy or enrolling the device would resolve the issue.