Okta-Certified-Administrator Okta Certified Administrator Exam Questions and Answers

When a user's Okta password is changed:

Solution: All apps that are Provisioning-enabled and have Sync Password option active under Provisioning settings - will begin to sync the password in respective apps, but only if JIT Provisioning is enabled as well as it has to be a just-in-time action, the moment the user resets the password

As an Okta best-practice / recommendation: Okta encourages you to switch from Integrated Windows Authentication (IWA or DSSO) to agentless Desktop Single Sign-on (ADSSO). Okta is no longer adding new IWA functionality and offers only limited support and bug fixes.

Solution: Only the first statement is true

With agentless DSSO (Desktop Single Sign-on), you still have a need of deploying IWA Agents in your Active Directory domains to implement DSSO functionality.

Solution: The statement is true, but not for the part about: the deployment of IWA Agents into Active Directory domains. The IWA Agents can now be deployed on whichever machine, it's a unique functionality that only agentless DSSO has and not on-prem DSSO.

With agentless DSSO (Desktop Single Sign-on), you still have a need of deploying IWA Agents in your Active Directory domains to implement DSSO functionality.

Solution: The statement is false

If you want to remove an attribute's value in Okta, for example a value coming from AD that is not useful in any way, you have to:

Solution: Delete the mapping by the help of which the value came into Okta User Profile

You just re-enabled IWA DSSO and notice it's not behaving as it should. What is an aspect you should keep in mind?

Solution: That when re-enabling IWA DDSO a new set of Identity Provider (IDP) routing rules have to be created

On a Windows machine, which is the right behavior if you try to sign into your Okta org and agentless DSSO is properly configured for it?

Solution: You will be automatically redirected to The Okta Sign In page for your organization, where you need to fill in with your AD credentials

What does it mean: "Mapping Direction AD to Okta"?

Solution: Indicates a schema of attribute values flowing Okta towards AD

How can SAML provision attributes via JIT? Or even create users?

Solution: By including specific information in the assertion

The Okta On-Prem MFA Agent acts as a Radius client and communicates with the RADIUS enabled On-Prem server, including RSA Authentication manager for RSA SecurIDs. This basically allows your organization to leverage Second Factor from a variety of On-Premises multifactor authentication tools.

Solution: The statement is true

Regarding policies, Okta recommends:

Solution: Include a final catch-all rule that denies access to anything that does not match any of the preceding rules

Whenever you make an API call, you will then get back:

Solution: A new object (a user, group or app object)

In an agentless DSSO (Desktop Single Sign-on) scenario Okta is the one decrypting the Kerberos ticket, finds then the user name, authenticates the user and passes back a session to the browser.

Solution: The statement is valid, but Okta is not the one doing decryption - the browser is doing that

As an Okta best-practice / recommendation: Okta encourages you to switch from Integrated Windows Authentication (IWA or DSSO) to agentless Desktop Single Sign-on (ADSSO). Okta is no longer adding new IWA functionality and offers only limited support and bug fixes.

Solution: Only the second statement is true

Once brought into Okta, LDAP roles are represented as:

Solution: Email lists

Speaking of Okta Template App and Okta Pluin Template App, which of the following RegEx can you create for an allow list of URLS so that both endpoints for /login or /change_password are accepted under example.com domain?

Solution: https://example.com/(login|change_password)