OKTA ADMIN CERT -DM EXAM
QUESTIONS AND ANSWERS
Is this a requirement for a company using DSSO to sync AD passwords to SWA apps? -
Correct Answers -The AD Password Sync Agent must be installed and configured on all
domain controllers
(not an okta sign on policy must be created specifically for AD mastered users)
(not delegated auth must be disabled)
(not the okta username must be an email address)
An Okta admin needs to transform email addresses into usernames. The email
addresses are in this format "" and the new username must be in
the format Jsmith. Is this the syntax that the admin should use? - Correct Answers -
String.substringBefore("", "@")
An okta admin needs to prevent mastered users from changing their passwords for at
least 5 days. Is this the password policy feature the admin should use? - Correct
Answers -Minimum password age
(not password expiration, password complexity, session lifetime)
An Okta Admin enabled DSSO mode in an Okta org. Is this the standard sign on page
regardless of Zone? - Correct Answers -https://(oktatenant).okta.com/login/default
An Okta Admin needs to configure SSO for a web app that doesn't support federation.
Is this the sign on method needs to integrate the web app? - Correct Answers -SWA
(not SAML, SPA single page app, OIDC)
Is this a task that can be performed using HR as a master? - Correct Answers -create
users, update users, deactivate users
Universal Directory attributes are sent in.. - Correct Answers -SAML Assertions + WS-
Fed claims
Expression Attributes can be sent - Correct Answers -Okta to App OR App to Okta
Username override can be used with - Correct Answers -Attribute Push
Is this true about profile attributes? - Correct Answers -Attributes can be modified with
the Profile Editor
, (not attributes are static after they are mapped)
(not attributes are mapped but cannot be modified)
Is this a functionality of Enhanced Group Push? - Correct Answers -Allows admins to
push specific groups from Okta that already exist in specific applications
(Help Desk Admins can't push groups)
(Groups can only be pushed from Okta)
Is this the type of MFA rule that an Okta Admin can use for behavior sign on? - Correct
Answers -location, device, IP address
(not user profile attributes)
(email address)
Is this the Okta Admin role you should use to create an API key that CANNOT change
configurations in Okta? - Correct Answers -Read Only
(not help desk)
(not API Access Management Admin)
What admin roles can reset MFA and passwords? - Correct Answers -Super, Org,
Group, Help Desk
What admin roles can view System Log Events? - Correct Answers -Super, Org, app,
read only, report, API Access Mgmt.
(group + help desk cannot read view)
Which admin role can only view & run reports? - Correct Answers -Report admin
Which admin role can only view users, password resets, MFA resets & clear user
session? - Correct Answers -Help Desk
What admin roles can deactivate a user? - Correct Answers -Super, Org, Group
which admin role can add and configure applications? - Correct Answers -super, app
which admin role can delete groups? - Correct Answers -super, org
is this a requirement to configure delegate authentication w/an AD Domain? - Correct
Answers -AD password sync + Service Acccount in AD
Where can attributes can be modified? - Correct Answers -Profile Editor
In an existing org an Okta admin needs to automate activation of new users during an
import from AD to Okta. Is this the option the admin needs to configure? - Correct
Answers -auto-activate new users
QUESTIONS AND ANSWERS
Is this a requirement for a company using DSSO to sync AD passwords to SWA apps? -
Correct Answers -The AD Password Sync Agent must be installed and configured on all
domain controllers
(not an okta sign on policy must be created specifically for AD mastered users)
(not delegated auth must be disabled)
(not the okta username must be an email address)
An Okta admin needs to transform email addresses into usernames. The email
addresses are in this format "" and the new username must be in
the format Jsmith. Is this the syntax that the admin should use? - Correct Answers -
String.substringBefore("", "@")
An okta admin needs to prevent mastered users from changing their passwords for at
least 5 days. Is this the password policy feature the admin should use? - Correct
Answers -Minimum password age
(not password expiration, password complexity, session lifetime)
An Okta Admin enabled DSSO mode in an Okta org. Is this the standard sign on page
regardless of Zone? - Correct Answers -https://(oktatenant).okta.com/login/default
An Okta Admin needs to configure SSO for a web app that doesn't support federation.
Is this the sign on method needs to integrate the web app? - Correct Answers -SWA
(not SAML, SPA single page app, OIDC)
Is this a task that can be performed using HR as a master? - Correct Answers -create
users, update users, deactivate users
Universal Directory attributes are sent in.. - Correct Answers -SAML Assertions + WS-
Fed claims
Expression Attributes can be sent - Correct Answers -Okta to App OR App to Okta
Username override can be used with - Correct Answers -Attribute Push
Is this true about profile attributes? - Correct Answers -Attributes can be modified with
the Profile Editor
, (not attributes are static after they are mapped)
(not attributes are mapped but cannot be modified)
Is this a functionality of Enhanced Group Push? - Correct Answers -Allows admins to
push specific groups from Okta that already exist in specific applications
(Help Desk Admins can't push groups)
(Groups can only be pushed from Okta)
Is this the type of MFA rule that an Okta Admin can use for behavior sign on? - Correct
Answers -location, device, IP address
(not user profile attributes)
(email address)
Is this the Okta Admin role you should use to create an API key that CANNOT change
configurations in Okta? - Correct Answers -Read Only
(not help desk)
(not API Access Management Admin)
What admin roles can reset MFA and passwords? - Correct Answers -Super, Org,
Group, Help Desk
What admin roles can view System Log Events? - Correct Answers -Super, Org, app,
read only, report, API Access Mgmt.
(group + help desk cannot read view)
Which admin role can only view & run reports? - Correct Answers -Report admin
Which admin role can only view users, password resets, MFA resets & clear user
session? - Correct Answers -Help Desk
What admin roles can deactivate a user? - Correct Answers -Super, Org, Group
which admin role can add and configure applications? - Correct Answers -super, app
which admin role can delete groups? - Correct Answers -super, org
is this a requirement to configure delegate authentication w/an AD Domain? - Correct
Answers -AD password sync + Service Acccount in AD
Where can attributes can be modified? - Correct Answers -Profile Editor
In an existing org an Okta admin needs to automate activation of new users during an
import from AD to Okta. Is this the option the admin needs to configure? - Correct
Answers -auto-activate new users
