2023 Okta Okta Certified Consultant Exam Dumps Questions

Page 1 of 4

1. You cannot:

Have multiple authorization servers in Okta

Edit the access policy in Okta, when Okta is the Default Authorization Server

Have custom scopes when Okta is the authorization server

2. Per Okta Retention Policy, API calls of type GET cannot retrieve data older than:

10 days

30 days

90 days

180 days

It has no limit and can retrieve data since the creation of the specific org from which the token authorizing the API call got issued

3. Optional user account fields include a 'secondary email address' and a 'security image'.

Statement is False, as the 'secondary email address' is mandatory to have a value assigned

Statement is False, as the 'security image' is mandatory to have a value assigned

Statement is True

Statement is False, as both aforementioned attributes would need to have a value assigned

4. Which is / are true about Okta ThreatInsight:

This feature is needed in order to not have a limit on the Network Zones you are allowed to have by default (LegacyIPZone and Block List zone)

Is a detection process that takes place prior to authentication evaluation

Requests blocked by this feature allows Okta to prevent user accounts lockouts from suspicious IP addresses

5. Can Okta rate-limit requests and if so, can it do it under different limits depending on the endpoint requested?

Okta can restrict requests to an endpoint to a specific unique number that applies on the whole Okta cloud no matter the type of endpoint (resource requested)

Okta can restrict requests to an endpoint with different limits based on the API endpoint reached

Okta cannot restrict requests to an endpoint as it may cause 404s / 500s on the end-user's page showing either "Resource Not Found" or "Internal Server Error" - depending on the endpoint reached

Okta can restrict requests and is doing so throwing '429 (Too Many Requests)' HTTP status code when happening

6. In order to successfully deploy an Advanced Server Access server, you must:

Simply install the server agent

Simply enroll the server

Install the server Agent and enroll the server

7. The "access token" is issued by the authorization server (Okta) in exchange for the grant.

Statement is False

Statement is True

Statement is True, but for the Access Token part, as the Refresh Token is the one exchanged, which then creates Access Tokens

8. In regards to OpenID Connect & OAuth 2.0 API, '/authorize' is the endpoint which has the following use:

End the session associated with the given ID token

Return claims about the authenticated end user

Interact with the resource owner and obtain an authorization grant

Return OpenID Connect metadata related to the specified authorization server

9. Can you set up via API a limited and non-refreashable Okta session lifetime?

Yes

Yes, but refreshable once a user does anything in the browser on his Okta Dashboard, which will refresh the token, thus extending the session time

10. You can register multiple AD domains to a single Okta AD Agent, if:

They are or not in the same forest

They have trust settings implemented between them

They are in the same forest

Page 2 of 4

11. The Okta RADIUS Server agent:

Communicates via UDP, over default port 1812 and does not support multiple ports simultaneously

Communicates via TCP, over default port 636 and does not support multiple ports simultaneously

Communicates via UDP, over default port 1812 and supports multiple ports simultaneously

Communicates via TCP, over default port 443 and does not support multiple ports simultaneously

12. Which of the following is / are true?

'Group Push' option exists on every app having Provisioning standard supported

'Group Push' option exists on few apps, not all having Provisioning supported to begin with

'Group Push' option exists on every app having SAML 2.0 enabled

13. In a SAML Trace, you can see that on an [Okta (IDP) App SAML request towards an App (SP side)] where you've already configured some regex-matching custom SAML attributes (not set in Mappings, but directly in the SAML App's config) to be passed over, these (which are named in the App's config as 'User attributes' or 'Group attributes') are send:

As an API header

Encrypted

Unencrypted

Back to Okta

14. If a Network Zone is blocked, clients from those blocked list zone cannot access:

Any org URL and are blocked prior to any type of policy evaluation

Any org URL but are blocked after they face policy evaluations, for them to not think they got on the block list, hence not possibly knowing this step of a reversed engineering at a Networking level

The Org through Inbound SAML SSO or any app through SP-initiated SSO, but can log into their End-User Panel in Okta and that's about it

15. You can use Okta org. as an authorization server.

This is used with the issuer being https://okta.com

This is used for OIDC use cases

This is used for Authentication use cases

This is used with an issuer being https://.okta.com

You cannot use Okta org as an authorization server

16. You can pass a different value as a 'username' or 'email' for user A, towards a SAML 2.0 app he is assigned to, by:

Assigning the app to another user (user B) - so that it will take user B's username for both users and let them in

Assigning user A a different licence in the app (SP side)

Using Okta SpEL (Spring Expression Language)

Manually changing the value(s) in the user's Okta profile and make sure Mappings for this App are set to update on such changes

17. You don't have the same possibility you have for an On-Prem MFA Agent or AD Agent, to increase the logging level, in the case of an Okta Radius server.

Statement is True

Statement is False

Statement is False and you even have 4 modes that you can simply enable via GUI: INFO, DEBUG, WARN, ERROR

18. There is a 'User type' attribute in the Okta schema.

This attribute is unrelated to the custom user types feature

This attribute is the setting that appears when custom user types feature is enabled for your org

Is one of the custom attributes you can have in the Okta schema

19. Access tokens are returned if 'response_type' included:

'nonce'

'none'

'access'

'token'

'access_token'

20. You can create Users via API calls. More than that, you can use Okta APIs in a 'customized' way, so that it is possible to create already activated and random password assigned Users into Okta Universal Directory.

FALSE

True, but for the Random Password assignment / provisioning option via API call. Those users will always be passwordless

TRUE

Page 3 of 4

21. The LDAP Incremental import relies on the 'modifyTimestamp' attribute to determine whether an LDAP entry has been imported. But, there are times when some on-prem LDAP servers's system clock could go backward / be delayed - hence Okta missing some updates on an LDAP import. Okta has an option to deal with these issues, called:

Incremental Imports

Maximum clock skew

This statement is false in its entirety as such option does not exist. All clock work very well, according to the NTP (Network Time Protocol)

LDAP clock measurements

LDAP clock delay timeframe

22. You should use Okta RADIUS Server agent for authentication, when authentication is being performed by:

VPN devices that don’t support SAML

AD DCs that don't support SAML

Virtual Desktops and Reverse Proxies that don’t support SAML

23. Okta implemented a way to receive reports (Okta usage, Okta Password Health, MFA Usage, etc.) via email. True?

Yes, even for 'Current Assignments' report

No and will never be implemented, as sending via email is not that secure

No and you can only view those in the Admin Console, as an admin

24. What is CORS?

Cross-Origin Resource Sharing

Mechanism that allows another domain to request specific restricted resources on a web page with the condition that the domain requesting it is not a subdomain in this case, but a total different one apart from the first one where the resources are hosted on

Mechanism that allows JavaScript hosted on your website to make XMLHttpRequests to Okta API via session cookie authorization

Cross-Origin Restricted Source

25. What is a Relative Distinguished Name (RDN)? (for example in an LDAP context)

The leftmost portion of the user Distinguished Name

The email address value without the "@domain.xxx" part

The rightmost portion of the user Distinguished Name

26. Can you specify in Okta an amount of time after which a 'Locked' account becomes 'Unlocked'?

Yes

Yes, only for AD sourced users

No, unless it's for Office 365 sourced users

27. Which of the following Okta Expressions checks whether the middle initial is not empty, then includes it as part of the full name, using just the first character and appending a 'period'?

firstName + " " + (String.len(middleInitial) == 0 ? "" : (String.substring(middleInitial, 0, 1) + ". ")) + lastName

firstName + "." + (String.len(middleInitial) == 0 ? "" : (String.substring(middleInitial, 0, 1) + ", ")) + lastName

firstName + " " + (String.len(middleInitial) == 0 ! "" : (String.substring(middleInitial, 1, 3) + ". ")) + lastName

firstName + " " + (String.len(middleInitial) == 0 ? "" : (String.substring(middleInitial, 0, 1) + " ")) + lastName

28. Is it alright, as a best-practice with Okta, to install at least two AD Agents for the same AD domain?

No, as Okta always uses either one of them to communicate to AD and handle requests, hence rendering the other useless. Thus this can't be a best-practice

No, as it will cause latency on the requests

Yes, as when one goes down due to various reasons, the other may be able to take and process the requests

29. In terms of security, is Okta allowing you to revoke an API token?

Yes

No, unless you have never used it

Yes, API tokens are revocable only if the Okta Agent using the specific token is still active, so that the token still exists to be revoked

No, unless you are the Group Admin in the Okta Org

30. In an Inline Hook scenario, your 'custom code / app' is referred to in Okta KB articles as being:

Your external endpoints

Your external service

Your webapp

Page 4 of 4

31. What is / are best-practice(s) with Okta?

LDAP-sourced users to always stay LDAP-sourced. Same applying for AD-sourced users

To not import attribute values from multiple applications and combine them under the same user profile in Okta UD

Okta's AD and LDAP password complexity requirements to match the actual AD and LDAP instances' password complexity requirements

32. Can you configure both SSO and Provisioning on the same app integration?

Yes, but only for Office 365 and G Suite apps

Yes, but only if you specifically enable the tenant-wide option "Enable SSO and Provisioning on same instances of applications"

Yes

[email protected]

Mon - Sat 9:00am - 6:00pm

2023 Okta Okta Certified Consultant Exam Dumps Questions

Related

Posts

About Us

EMAIL

Services

Opening Hours