Free Salesforce Certified Tableau Server Administrator Sample Questions

Correct answer: B — It handles web application requests, user authentication, and content permissions.

• A. Incorrect. Translating user interactions into SQL or MDX queries and rendering visualizations is the primary role of the VizQL Server, not the Application Server.
• B. Correct. The Application Server (VizPortal) handles the web application interface, coordinates user authentication, manages user sessions, and enforces content permissions and administrative functions via the web UI and REST API.
• C. Incorrect. Storing the server's metadata, including user definitions and workbook metadata, is the responsibility of the Tableau Server Repository (a PostgreSQL database).
• D. Incorrect. Managing the extraction of data and storing extracts locally is handled by the Data Engine (Hyper) for query processing and the Backgrounder for the execution of extract refreshes.

Correct answers: A, C — The Coordination Service (ZooKeeper) loses quorum because it binds to specific IP addresses during installation.; The internal pg_hba.conf file in the PostgreSQL repository rejects connections from the new IPs of the worker nodes.

• A. The Coordination Service (based on Apache ZooKeeper) is configured to bind to specific node addresses used during installation or configuration. If these IP addresses change dynamically, nodes cannot communicate with the ensemble, leading to a loss of quorum and preventing cluster coordination. This results in worker nodes appearing as 'Down' in TSM.
• B. The Tableau Server Run As Service Account is a set of credentials managed by the administrator. The operating system does not automatically reset or change these credentials based on an IP address change.
• C. Tableau Server’s internal PostgreSQL repository uses the pg_hba.conf file to whitelist and restrict connections to specific IP addresses within the cluster. When worker nodes receive new IPs, they are no longer recognized by the repository's access control list, causing connection rejections and process failures.
• D. Tableau Server does not delete published extracts as a safety measure for network or IP changes. While extract refreshes may fail due to connectivity issues, the data remains on the File Store.
• E. Active Directory SPNs are generally tied to service accounts and DNS hostnames rather than specific IP addresses. While DNS resolution issues might occur if records aren't updated, this is not an immediate, permanent failure caused solely by the internal dynamic IP assignment in the context of TSM node status.

Correct answer: B — It increases the time required to fetch data over the network, prolonging the overall duration of the extract refresh task.

• A. Incorrect. High network latency does not directly cause the Backgrounder process to consume exponentially more RAM. Memory usage is determined by the volume of data being processed and the complexity of the extract, whereas latency primarily affects I/O wait times and task duration.
• B. Correct. High network latency increases the time required for the Backgrounder to fetch data from the source over the network. This directly prolongs the duration of extract refresh tasks, which can lead to job timeouts or schedules overlapping.
• C. Incorrect. Tableau Server does not automatically downgrade extract formats from Hyper to legacy TDE based on network performance. The extract format is determined by the Tableau version and administrative configuration, not bandwidth or latency.
• D. Incorrect. While high latency increases wait times and can lead to connection timeouts, it does not inherently cause the Data Engine (Hyper) process to crash due to thread starvation. Crashes are typically caused by software bugs or severe resource exhaustion (CPU/Memory) rather than network delays.

Correct answer: B — The firewall is blocking outbound traffic on port 1433 from the node running the Backgrounder process to the SQL Server.

• A. If the Run As Service Account lacked Active Directory permissions, the error would typically be an authentication or 'Access Denied' failure rather than a network timeout. Because the live connection renders successfully, it indicates that the account/credentials used have the necessary database-level permissions.
• B. In a distributed Tableau Server deployment, extract refreshes are performed by the Backgrounder process, which often resides on a different node than the VizQL process (used for live connections). A network timeout indicates that the Backgrounder node cannot establish a connection to the database, which is a classic symptom of a firewall blocking outbound traffic on the specific database port (e.g., TCP 1433 for SQL Server) from that specific server node.
• C. The VizQL Server process is responsible for rendering visualizations for users and does not handle background extract refreshes. While extreme resource exhaustion can affect server stability, it would not manifest as a network timeout error for a Backgrounder task.
• D. A missing driver would result in a 'Driver not found' or 'Database error' message, not a network timeout. Additionally, if the live connection works, the driver exists on the VizQL nodes; if the driver is already present on the Backgrounder node (as the option suggests), the refresh should technically function.

Correct answer: B — It is based on physical cores, where 1 physical core typically equates to 2 vCPUs (hyper-threads) in standard cloud environments.

• A. Incorrect. Tableau's published minimums and core-based licensing are specified in terms of physical CPU cores rather than logical processors (vCPUs). Tableau specifically differentiates between physical cores and logical processors.
• B. Correct. Tableau defines requirements and core-based licensing in terms of physical CPU cores. In standard cloud and hyper-threaded environments, 1 physical core is generally equivalent to 2 vCPUs (logical processors/hyper-threads). This is a critical distinction for sizing cloud instances to meet Tableau's minimum hardware requirements.
• C. Incorrect. The total combined GHz clock speed is a performance characteristic, but it is not used to define minimum core counts or calculate core-based licensing requirements.
• D. Incorrect. While server hardware involves sockets, Tableau licensing and minimum specifications are based on the number of physical cores within those sockets, not the number of sockets themselves.

Correct answer: B — 4 physical cores, 16 GB RAM, 15 GB free disk space

• A. Incorrect. This configuration is below the minimum hardware specifications enforced by the Tableau Server installer. The setup program will fail the pre-install checks if it detects fewer than 4 physical cores or less than 16 GB of system memory (RAM).
• B. Correct. These are the absolute minimum hardware specifications required by the Tableau Server setup program to allow an installation to proceed for a Proof of Concept (PoC) or test environment. The installer specifically checks for at least 4 physical cores, 16 GB of RAM, and 15 GB of free disk space. Note that these are significantly lower than the requirements for a production environment.
• C. Incorrect. While this configuration meets and exceeds the minimum requirements, it is not the absolute minimum. 8 physical cores and 32 GB RAM are often viewed as a starting point for production environments, but the installer threshold for a test environment is lower.
• D. Incorrect. These specifications represent a standard production-ready machine and are significantly higher than the absolute minimum threshold enforced by the setup program for a PoC installation.

Correct answer: B — Creator

• A. Incorrect. Explorer licenses are designed for users who interact with and explore existing data but do not need full creation or server-wide administrative capabilities. While an Explorer can be granted the Site Administrator Explorer role, they cannot be assigned the Server Administrator role.
• B. Correct. A Creator license is the minimum license type required to be assigned the Server Administrator site role. Server Administrators require the full suite of creation, publishing, and server-level management capabilities that are only available under the Creator license.
• C. Incorrect. Site Administrator Creator is a specific site role, not a license type. While users in this role do possess a Creator license, the question asks for the fundamental license type required.
• D. Incorrect. The Data Management Add-on is a separate platform-level feature set (including Tableau Catalog and Tableau Prep Conductor) and is not a user-based license type required for assigning administrative roles.

Correct answer: B — Configure the AV software to exclude the Tableau Server installation directory and the data directory.

• A. Disabling anti-virus entirely violates enterprise security compliance and best practices, exposing the server nodes to malware and other security risks. This is not a recommended remediation for a production environment.
• B. Tableau documentation specifically recommends configuring exclusions for the Tableau Server installation, data, and temporary directories. This prevents the AV software from locking files during critical operations like extract refreshes or backup processes (causing 'file in use' errors), while still maintaining protection for the rest of the operating system.
• C. Changing the Run As Service Account to a local administrator does not prevent file-locking by AV software, which typically operates at the kernel or process level. Furthermore, elevating the service account undermines the principle of least privilege and introduces significant security risks.
• D. Tableau Server expects high-performance local storage for its data directory. Moving data to a network share can introduce performance bottlenecks, reliability issues, and supportability concerns. Additionally, the network share may still be subject to scanning by network-based security tools.

Correct answers: A, C — Download the installer from the Tableau Customer Portal or Tableau Release Notes page.; Verify the file integrity by comparing the SHA-256 checksum provided on the release page.

• A. Downloading the installer from official sources like the Tableau Customer Portal or the Tableau Release Notes page ensures you are obtaining an authentic, supported build directly from Tableau. These pages also provide the necessary metadata (like checksums) required for security validation.
• B. Tableau Public is a community platform for sharing and exploring visualizations; it is not a repository for Tableau Server installation files.
• C. Comparing the SHA-256 checksum provided on the official release page with the checksum of your downloaded file is the standard method to verify integrity. This process ensures the file was not corrupted during the download or tampered with during transfer to an air-gapped environment.
• D. The `tsm verify --installer` command is not a valid Tableau Services Manager (TSM) command. TSM commands are used to manage an existing server installation and configuration, not to verify standalone installer files prior to installation.
• E. Searching for a 'signature.txt' file within the installer archive using third-party tools is not a documented or reliable method for verifying Tableau software. Use the official SHA-256 checksums or official PGP signatures provided by Tableau.

Correct answer: B — Install the Repository on Node 1 and Node 2, where one acts as Active and the other as Passive.

• A. Incorrect. Tableau Server does not support a three-way active-active repository cluster. The internal PostgreSQL Repository is deployed as a primary (active) instance with a single standby (passive) instance.
• B. Correct. In a high-availability configuration, the Repository is installed on two nodes. One functions as the Active node while the other is Passive (standby). If the active node fails, the Cluster Controller promotes the passive instance to active to ensure continuity.
• C. Incorrect. The File Store and Repository are distinct processes with different roles. The File Store manages extracts and workbook files, while the Repository is the internal PostgreSQL database. File Store processes cannot act as a passive database for the Repository.
• D. Incorrect. While the Coordination Service (ZooKeeper) and Cluster Controller handle the health monitoring and election process for failover, they do not store Repository data. If the Repository is only installed on Node 1, there is no standby instance for the system to fail over to.

Correct answers: A, B, C — Server level (All users on the server); Site level (All users on a specific site); Group level (All users within a specific group)

• A. Correct. Tableau Server Administrators have the authority to set a server-wide default start page that applies to every user across all sites on the server instance.
• B. Correct. Both Server and Site Administrators can set a specific start page at the site level, ensuring all users within that specific site land on the same page upon signing in.
• C. Correct. Tableau allows administrators to designate a default start page for specific groups. This is managed via the 'Groups' page, where the administrator can select a group and use the 'Set as Start Page' action.
• D. Incorrect. Projects are organizational containers for content (workbooks, data sources, etc.). While users can manually set a project page as their personal start page, administrators cannot globally scope a start page based on project access.
• E. Incorrect. Tableau Server does not currently provide a native UI setting to automatically assign default start pages based on a user's Site Role (e.g., Creator vs. Viewer).

Correct answer: B — The OIDC provider is not returning the 'sub' claim or the configured claim mapping does not match the Tableau Server username.

• A. Incorrect. If the vizportal.openid.client_id did not match the IdP, the OIDC provider would reject the authentication request from Tableau Server immediately. Users would not be able to successfully authenticate with the provider because the initial redirect or client validation would fail.
• B. Correct. Tableau Server relies on a specific claim (commonly the 'sub' claim or a custom claim mapped via vizportal.openid.username_claim) to map the identity from the OIDC token to a user account in its repository. If the claim is missing or if the value provided does not match the Tableau Server username, Tableau cannot identify which user is logging in and will reject the session despite successful authentication at the IdP.
• C. Incorrect. OIDC is compatible with both Local and Active Directory identity stores. Since the scenario confirms the user exists in Tableau Server, the type of identity store is not the cause of the rejection during the OIDC claim mapping process.
• D. Incorrect. If the OIDC provider's SSL certificate were not trusted by the browser or the server, the flow would typically fail during the initial redirect or the backend token exchange. This would prevent the user from reaching a 'successfully authenticated' state with the provider.

Correct answer: C — Existing users' site roles are updated to match the CSV, provided the new role does not exceed available licenses.

• A. The import process in Tableau Server does not fail globally due to row conflicts. It processes users individually and provides error reporting per row rather than rolling back the entire batch.
• B. Existing users are not ignored during the import process. If a user is already a member of the site, Tableau attempts to update their site role to match the value provided in the CSV.
• C. According to Tableau's documentation for CSV imports, if you import a user who already exists on the server and is already a member of the target site, their site role will be updated to match the role specified in the CSV file, provided sufficient license capacity exists.
• D. Tableau enforces unique usernames within the environment and does not create duplicate accounts with numeric suffixes. It either updates the existing user record or reports an error for that specific CSV entry.

Correct answer: C — The highest site role among the groups.

• A. Incorrect. Tableau does not prioritize the most recent group membership or timestamp to determine the site role. Site roles are resolved based on privilege levels rather than recency or order of addition.
• B. Incorrect. Tableau does not default to the lowest role to save licenses. Instead, it ensures the user has sufficient access by granting the highest role assigned to any of their groups during synchronization.
• C. Correct. In scenarios where a user belongs to multiple groups with different minimum site roles, Tableau Server (and Tableau Cloud) grants the highest site role among those groups during synchronization. This ensures the user receives the maximum level of access allowed by their memberships.
• D. Incorrect. Role conflicts do not result in the user becoming Unlicensed. Tableau has a built-in resolution mechanism to assign the highest role rather than failing or restricting access due to a conflict.

Correct answer: B — Creator

• A. Incorrect. The Explorer (can publish) site role allows users to publish workbooks using existing data sources on the server, but it does not permit the creation or publication of new, standalone data sources from Tableau Desktop.
• B. Correct. The Creator site role is the minimum role required to connect to external data and publish new data sources to Tableau Server. This role provides full authoring capabilities, including the ability to create and manage data connections.
• C. Incorrect. Site Administrator Explorer is an administrative role based on the Explorer license. While it has elevated site management permissions, it does not inherently allow the creation and publication of new data sources, as that requires Creator-level authoring capabilities.
• D. Incorrect. Project Leader is a set of permissions applied to a user for a specific project, not a site role. To publish any content, including data sources, a user must first be assigned a compatible site role like Creator, regardless of their Project Leader status.

Correct answer: A — Project B must also be locked and inherits permissions directly from Project A.

• A. Correct. In Tableau Server/Cloud, when permissions are locked at the parent project level, the lock status is inherited by all nested projects within it. You cannot set a child project to 'Customizable' if its parent is 'Locked to the project'; therefore, Project B must be locked and uses the permissions defined in Project A.
• B. Incorrect. While a child project typically copies permissions from its parent upon creation, the 'Locked' status of a parent project prevents the child from being 'Customizable'. If Project A is locked, Project B is forced into a locked state as well.
• C. Incorrect. Nested projects are specifically designed to inherit the permission baseline and lock status of their parent project to ensure consistent security management across the hierarchy.
• D. Incorrect. Permissions for a nested project are derived from its immediate parent project (Project A), not the site-level 'Default' project, unless the project is at the top level of the site.

Correct answer: B — Deny, because 'Unspecified' acts as a Deny if no other rule grants an Allow.

• A. Incorrect. 'Unspecified' (None) does not default to Allow for unlocked projects. Unlocked projects simply mean permissions can be managed at the project level and applied to all content, but it does not change the core evaluation logic where a lack of 'Allow' results in no access.
• B. Correct. This is the 'Implicit Deny' rule in Tableau. If a capability is not explicitly set to 'Allow' at the user level or via any of the groups the user belongs to, the effective permission is 'Denied' (unless a higher-level admin role applies).
• C. Incorrect. While 'Unspecified' results in no effective permission, 'None' is the state of the setting, whereas the effective result is 'Denied'. Furthermore, Tableau does not have a native, built-in automated workflow that prompts users to request access from the Project Owner upon a permission failure.
• D. Incorrect. Belonging to multiple groups only grants access if at least one of those groups has an 'Allow' permission. Multiple 'Unspecified' settings across different groups are neutral and do not aggregate into an 'Allow'.

Correct answers: A, D — If the user is in Group A (Allow) and Group B (None), the effective group-level permission is Allow.; If the user is in Group A (Allow) and Group B (Deny), the effective group-level permission is Deny.

• A. Correct. According to the Tableau Security Model, 'None' (Unspecified) is a neutral state. If a user belongs to multiple groups where one grants 'Allow' and others are 'None', the 'Allow' prevails at the group level.
• B. Incorrect. In the Tableau permission hierarchy, if a user is in multiple groups and there is a conflict between 'Allow' and 'Deny' at the group level, the 'Deny' rule takes precedence.
• C. Incorrect. If all group rules for a capability are set to 'None', the result is 'None'. This results in a final effective permission of Denied unless the user has an explicit 'Allow' set at the individual user level.
• D. Correct. Tableau's evaluation logic states that an explicit 'Deny' in any group rule overrides an 'Allow' from another group rule for the same user on the same capability.
• E. Incorrect. User-level explicit permissions actually take precedence over group-level permissions. If a user is explicitly allowed a capability at the user level, it overrides group-level Deny rules.

Correct answer: B — The subscription failed to render consecutively, reaching the server's configured failure threshold.

• A. Changing a user's site role to Viewer does not trigger an automatic suspension. While a change in permissions might eventually cause a rendering failure, the role of Viewer is sufficient for receiving subscriptions; it is the repeated failure to render, not the role itself, that triggers suspension.
• B. Tableau Server automatically suspends subscriptions when they fail to render repeatedly and reach a pre-configured consecutive failure threshold (the default is often 5 failures). This prevents the Backgrounder from wasting resources on content that is broken or inaccessible.
• C. Tableau Server does not track whether a user opens their subscription emails. Suspension is based strictly on the server's ability to render and deliver the email, not on user engagement or interaction metrics.
• D. While exceeding a site's storage quota affects the ability to publish new content or refresh extracts, it is not the direct mechanism for suspending an individual subscription. The specific trigger for an automatic suspension state is always consecutive rendering failures.

Correct answers: A, C, E — Site-specific SAML authentication; Customizing the site logo and name; Managing web authoring capabilities for the site

• A. Correct. If the Server Administrator enables site-specific SAML at the server level, Site Administrators can then independently manage the authentication configuration for their specific site, including uploading metadata and mapping attributes.
• B. Incorrect. The maximum number of licenses (site quotas) for Creator, Explorer, and Viewer roles is defined and allocated by the Server Administrator. Site Administrators can manage users within these limits but cannot change the limits themselves.
• C. Correct. Site Administrators have the authority to manage the visual identity of their site, which includes customizing the site name and uploading a custom logo in the site settings.
• D. Incorrect. SMTP (Simple Mail Transfer Protocol) settings for email notifications, alerts, and subscriptions are global server settings managed by the Server Administrator via Tableau Services Manager (TSM).
• E. Correct. Site Administrators can enable or disable web authoring capabilities for their site, allowing or restricting users' ability to create and edit workbooks directly in the browser.
• F. Incorrect. Backgrounder and task timeout limits are infrastructure-level performance settings managed at the server level by the Server Administrator and cannot be modified per site.

Correct answer: A — They lack the 'Save' permission capability on the workbook.

• A. Correct. To overwrite an existing workbook (the 'Save' action) in Web Authoring, a user must have the 'Write' permission capability (frequently referred to as 'Save' in user-facing documentation). If a user has 'Web Edit' and 'Download Workbook/Save As' permissions but lacks the 'Write' capability, they are restricted to using 'Save As' to create a new copy.
• B. Incorrect. The 'Explorer (can publish)' site role is designed to allow users to publish and overwrite content. This ability is not exclusive to the Creator site role, as long as the user has the appropriate item-level permissions.
• C. Incorrect. Web Authoring fully supports the ability to overwrite existing workbooks. The visibility of the 'Save' versus 'Save As' options depends on the user's permissions and site role, not a technical limitation of the web environment.
• D. Incorrect. A locked project simply ensures that permissions are managed at the project level for all content within it. It does not block overwriting functionality unless the 'Write' permission is specifically omitted or denied in the project's permission template.

Correct answers: A, C, E — Create a new workbook using a published data source.; Download a workbook they have saved in their Personal Space.; Edit an existing workbook saved in their Personal Space.

• A. Correct. Users can create new workbooks via Web Authoring using existing published data sources and save them directly into their Personal Space for private analysis.
• B. Incorrect. Personal Space is private by design. Content within it cannot be shared with other users. To share a workbook, it must be moved or published to a standard project where permissions can be granted to others.
• C. Correct. Users have full ownership rights over the content in their Personal Space, which includes the ability to download their workbooks to a local machine.
• D. Incorrect. Tableau's Personal Space is specifically for workbooks. Standalone data sources cannot be published to Personal Space; they must be hosted in shared projects.
• E. Correct. Users can edit workbooks saved in their Personal Space using web authoring, allowing them to refine their work privately before potentially moving it to a public project.

Correct answers: B, D — A user cannot be removed if they own any workbooks, data sources, or projects.; If a user is removed from a site but belongs to other sites, their server account remains active.

• A. Incorrect. Tableau Server does not automatically reassign content to an administrator upon user removal. Content ownership must be manually transferred or the content deleted before the user can be removed from the system.
• B. Correct. This is a fundamental constraint in Tableau Server administration. To prevent orphaned content, the system blocks the removal of any user who is currently the owner of a project, workbook, or data source.
• C. Incorrect. Historical audit events and activity records are retained in the PostgreSQL repository (Workgroup database) even after a user is removed. This ensures that historical reporting and audit trails remain intact for compliance purposes.
• D. Correct. Because Tableau Server manages users at the server level, a user can be a member of multiple sites. Removing them from one site only removes their access to that specific site; their global server account remains active as long as they belong to at least one other site or are not explicitly deleted from the server.

Correct answer: B — sub

• A. The 'iss' (issuer) claim identifies the principal that issued the JWT. It is used to validate the token's origin and should match the expected issuer when verifying a JWT, but it does not represent the user.
• B. The 'sub' (subject) claim identifies the principal that is the subject of the JWT. In authentication contexts, including Tableau integrations like Connected Apps or OIDC, the 'sub' claim is used to map the token to a specific user identity.
• C. The 'exp' (expiration time) claim identifies the time on or after which the JWT must not be accepted for processing. It is used for security and session management rather than user identification.
• D. The 'jti' (JWT ID) claim provides a unique identifier for the JWT. It is typically used to prevent replay attacks by ensuring a specific token cannot be used multiple times, but it does not indicate the token's subject.

Correct answers: B, D — Connect to a new, unpublished flat file (e.g., Excel or CSV) directly in the browser.; Create a new data source connection to an external database (e.g., SQL Server) in the browser.

• A. Incorrect. Both Creator and Explorer (Can Publish) roles have the ability to create new workbooks based on data sources that have already been published to Tableau Server.
• B. Correct. Only users with the Creator role can connect to new, unpublished data sources, such as uploading local flat files (Excel, CSV) directly through the browser interface.
• C. Incorrect. Both roles are allowed to edit existing published workbooks in the web authoring environment, provided they have the necessary content permissions.
• D. Correct. The Creator role is required to establish new connections to external databases (like SQL Server or Oracle) from within the web authoring environment. Explorers (Can Publish) are restricted to using existing published connections.
• E. Incorrect. Saving a customized (custom) view is a standard feature available to many roles, including Explorers and even basic Viewers, to save their specific filter settings without altering the original workbook.

Correct answers: A, B, C — Create a Subscription; Create a Data-Driven Alert; Share the view via a link or email

• A. The Tableau Server view toolbar includes a 'Watch' or 'Subscribe' button that allows users with the appropriate permissions to create subscriptions, ensuring they receive the view or workbook via email on a scheduled basis.
• B. Data-driven alerts can be created directly from the toolbar (typically under the 'Watch' menu). This feature allows users to set thresholds on numeric continuous axes and receive notifications when those specific conditions are met.
• C. The 'Share' button is a standard feature on the view toolbar, allowing users to copy the view link, obtain embed code, or send an email with the link to distribute the dashboard to others.
• D. Changing a data source connection is an authoring or administrative task. It requires using Web Authoring mode or Tableau Desktop, rather than the interactive toolbar provided for viewing published content.
• E. Certifying a workbook is a data governance action. It is performed at the content or project level by administrators or designated users via the Tableau Server interface (Explorer/Project view), not from the toolbar of an active view.

Correct answer: B — False

• A. The statement is true because Site Administrators are granted high-level permissions to manage content, users, and groups within their specific site environment.
• B. The statement is false because the ability to create, delete, or modify sites is a server-level configuration task that is strictly reserved for the Server Administrator role.

Correct answers: A, C — TSM Administrator activates the license keys on the server.; Tableau Server Administrator sets the site role limits (Creator seats) for the site.

• A. Correct. Activating and managing product license keys is a server-level configuration task performed via the Tableau Services Manager (TSM) web UI or CLI. This requires TSM administrator permissions.
• B. Incorrect. While a Tableau Server Administrator can view license usage within the Server UI, the actual activation of license keys is a TSM-level operation. Only a user with TSM access (TSM Administrator) can perform activations.
• C. Correct. Tableau Server Administrators are responsible for managing settings across all sites, which includes setting 'Site Role Limits.' They allocate the specific number of Creator, Explorer, and Viewer seats that each site is permitted to use.
• D. Incorrect. Site Administrators manage users and assign site roles within the limits established for their site, but they do not have the authority to set or increase the site's overall seat limits. This requires Server Administrator privileges.
• E. Incorrect. Site Administrators are restricted to managing content and users within their specific site and do not have access to TSM or server-wide licensing tools.

Correct answer: A — tsm configuration set -k wgserver.session.apply_same_site_if_secure -v true

• A. Correct. Modern browsers require that cookies used in a third-party or cross-site context be marked with 'SameSite=None' and 'Secure'. Setting wgserver.session.apply_same_site_if_secure to true ensures Tableau Server adds the 'SameSite=None' attribute to session cookies when SSL is enabled, which allows the browser to send the cookie to Tableau when it is embedded on a different domain, resolving the login loop.
• B. Incorrect. Disabling the secure flag on cookies is a security risk. Furthermore, modern browsers require cookies to be marked as 'Secure' in order to accept the 'SameSite=None' attribute. Disabling security would not resolve the third-party cookie blocking issue and would likely make the site non-compliant with browser standards.
• C. Incorrect. The vizportal.rest_api.cors.allow_origin setting is used to manage Cross-Origin Resource Sharing (CORS) specifically for REST API requests. It does not affect the SameSite or Secure attributes of the session cookies used for standard web-based embedding.
• D. Incorrect. The wgserver.domain_allow_list setting is part of Tableau's clickjacking protection (controlling which domains can frame Tableau content). While it is a requirement for embedding to work, it does not influence how the browser handles third-party cookies or the SameSite attribute.

Correct answer: C — tsm maintenance ziplogs

• A. Incorrect. 'tsm system ziplogs' is not a valid TSM command. Tableau Services Manager (TSM) commands are strictly organized into namespaces, and log archiving is not located under a 'system' namespace.
• B. Incorrect. While 'tsm logs' contains subcommands for tasks like listing log levels or gathering server versions, 'tsm logs export' is not the standard command for creating a support archive. The correct utility resides within the maintenance namespace.
• C. Correct. 'tsm maintenance ziplogs' is the specific and documented TSM command used to collect and compress log files from all nodes in a Tableau Server cluster. This command generates a .zip archive that can be used for troubleshooting or shared with Tableau Support.
• D. Incorrect. 'tabcmd' is a client-side command-line utility used for automating administrative tasks related to site content, users, and groups (such as publishing workbooks or exporting views). It does not have access to server-level system logs.

Correct answer: B — To change the underlying structure of how user identities are stored and managed, moving them to the new Identity Service tables.

• A. Incorrect. Identity Migration is not intended to switch the identity store type (e.g., from Local to Active Directory). Changing authentication providers is a separate administrative process; the Identity Migration focuses on internal data structure changes regardless of the external source.
• B. Correct. Starting with Tableau Server 2022.1, a new Identity Service was introduced. The Identity Migration process moves and reorganizes user identity data from legacy tables to new Identity Service tables in the repository. This ensures user records and relationships are preserved under the new architecture.
• C. Incorrect. Synchronizing permissions with external SAML identity providers is handled through authentication configuration and attribute mapping. The Identity Migration focuses specifically on the internal storage and mapping of identity records during the upgrade.
• D. Incorrect. The migration is a structural architectural change for identity records (UUIDs, usernames, etc.) in the PostgreSQL repository. It is not designed to encrypt passwords, as password handling depends on the specific authentication method used.

Correct answers: A, C — Tableau Server can run flows published from any older version of Tableau Prep Builder.; Tableau Prep Builder will display a compatibility warning and prevent publishing if a flow utilizes features not supported by the target Tableau Server version.

• A. Tableau Server (specifically Tableau Prep Conductor) is designed to be forward-compatible with older flow files. This means a newer version of Tableau Server can run flows created in older versions of Tableau Prep Builder without issue.
• B. This statement is incorrect because Tableau does not 'silently ignore' incompatible steps. If a flow contains features unsupported by the destination server version, the publishing process will typically be blocked, or the execution will fail entirely to prevent incorrect data output.
• C. Tableau Prep Builder performs a version check against the target Tableau Server. If it detects features (like specific connectors or functions) that the server does not support, it displays a compatibility warning and may prevent the flow from being published until the server is upgraded or the flow is modified.
• D. Exact version parity is not required. While it is a best practice to keep versions aligned, Tableau Server is generally capable of running flows from older versions of Prep Builder as long as the Server version is equal to or greater than the version where the flow was authored.
• E. The tsm maintenance command is intended for server-level administrative tasks such as backups, restores, and cleanup. It is not used for upgrading individual flow files created in older Prep Builder versions.

Correct answer: A — The new Tableau Server was initialized with a local identity store, but the backup was taken from a server using Active Directory.

• A. Correct. An identity store mismatch error occurs when the user directory configuration (Local vs. External/Active Directory) of the target server does not match the configuration stored in the backup file. Tableau Server requires the target environment to be initialized with the same identity store type as the source environment before a restore can proceed.
• B. Incorrect. Differences in the Run As Service account may lead to permissions issues or service start failures, but it does not define the identity store configuration. This setting is independent of the user directory type.
• C. Incorrect. While topology differences (such as node counts) must be considered during a restore, they typically manifest as topology mapping errors rather than an identity store mismatch. The restore process is generally capable of mapping the backup data to a different number of nodes.
• D. Incorrect. Running TSM commands without a configured administrative user would typically result in authentication or permission errors. It would not specifically trigger an identity store mismatch error, which refers to the structural way users are authenticated (Local vs. AD/LDAP).

Correct answer: B — It requires the `-y -y -y` switches to bypass all confirmation prompts for an unattended removal.

• A. Incorrect. The `tableau-server-obliterate` script performs system-level removal of packages, directories, and configuration files, which requires elevated privileges (root or sudo). The `tableau` system user is unprivileged and lacks the permissions necessary to perform these actions.
• B. Correct. To prevent accidental data loss, the script is interactive by default. The `-y -y -y` switches are the standard method to bypass all confirmation prompts, allowing the script to run in an unattended or automated fashion.
• C. Incorrect. The obliterate script is a destructive tool meant to wipe the environment completely. It does not automatically create a backup. Administrators must manually create and move a `.tsbak` file to an external location before running the script if they wish to preserve data.
• D. Incorrect. The script is often used specifically when the TSM controller is unresponsive or corrupted. It removes the software at the operating system level and does not require the TSM services to be in a running state.

Correct answer: B — Manually configure the topology on the new hardware to optimize for the new resource profile rather than importing the old topology.

• A. Importing the original topology on significantly different hardware is not recommended. While the Tableau Resource Manager (TRM) helps manage resource contention among running processes, it does not automatically redesign the topology or scale the number of process instances to match a different hardware profile.
• B. This is the best practice. When moving to hardware with different core counts or memory profiles, the administrator should manually configure the topology to optimize process counts (such as VizQL and Backgrounders) for the new resources. This ensures optimal performance and stability tailored to the specific capabilities of the new hardware.
• C. There is no standard 'tsm topology rebalance' command that automatically optimizes overall process distribution for hardware changes. While some specific services have balancing functions, they are not a substitute for the manual design and configuration of a server topology during hardware migration.
• D. Modifying a .tsbak file directly with a ZIP utility is unsupported and dangerous. Tableau backups are not intended for manual editing, and attempting to modify internal configurations this way can lead to file corruption, restore failures, or an unsupported system state.