Okta-Certified-Consultant Exam PDF [2025] Tests Free Updated Today with Correct 107 Questions
Okta Okta-Certified-Consultant Exam Preparation Guide and PDF Download
NEW QUESTION # 27
Are Routing Rules providing security enhancements?
- A. Yes
- B. They improve end-user sign-in experience, but they do not provide security enhancements
- C. Not for Okta, only for the IDPs Okta is configured with
Answer: B
NEW QUESTION # 28
Can you specify in Okta an amount of time after which a ''Locked'' account becomes ''Unlocked''?
- A. No
- B. No, unless it,s for Office 365 sourced users
- C. Yes
- D. Yes, only for AD sourced users
Answer: C
NEW QUESTION # 29
Is it alright, as a best-practice with Okta, to install at least two AD Agents for the same AD domain?
- A. No, as it will cause latency on the requests
- B. Yes, as when one goes down due to various reasons, the other may be able to take and process the requests
- C. No, as Okta always uses either one of them to communicate to AD and handle requests, hence rendering the other useless. Thus this can,t be a best-practice
Answer: B
NEW QUESTION # 30
''grant_type'' can take value(s) out of the following:
- A. ,authorization_code,
- B. ,refresh_token,
- C. ,nonce,
- D. ,password,
- E. ,client_credentials,
Answer: A,B,D,E
NEW QUESTION # 31
In a SAML Trace, you can see that on an [Okta (IDP) App SAML request towards an App (SP side)] where you''ve already configured some regex-matching custom SAML attributes (not set in Mappings, but directly in the SAML App''s config) to be passed over, these (which are named in the App''s config as ''User attributes'' or ''Group attributes'') are send:
- A. Unencrypted
- B. As an API header
- C. Back to Okta
- D. Encrypted
Answer: A
NEW QUESTION # 32
The request fails if you haven''t created a rule in a policy on the authorization server to allow the combination of:
- A. Scopes
- B. Nonce
- C. Client
- D. Server
- E. User
Answer: A,C,E
NEW QUESTION # 33
In an Inline Hook scenario, your ''custom code / app'' is referred to in Okta KB articles as being:
- A. Your external service
- B. Your webapp
- C. Your external endpoints
Answer: A
NEW QUESTION # 34
Which Okta feature / solutions offers the admin the possibility to redirect desktop users to Integrated Windows Authentication (IWA) and mobile users to Okta for authentication?
- A. On-Prem MFA Agent
- B. Desktop Single-Sign On
- C. Org to Org
- D. Agentless DSSO
- E. Device Trust
- F. Routing Rules
Answer: F
NEW QUESTION # 35
In regards to Inline Hooks, you can have with Okta:
- A. Password Import Inline Hooks
- B. Registration Inline Hook
- C. Token Inline Hook
- D. User Export Inline Hook
- E. SAML Assertion Inline Hooks
Answer: A,B,C,E
NEW QUESTION # 36
The authorization server also acts as an:
- A. OpenID Connect Provider, which means you can request ID tokens in addition to access tokens from the authorization server endpoints
- B. OpenID Connect Provider, which means you can request Open ID Connect tokens in addition to access tokens from the authentication server endpoints
- C. OpenID Connect protocol, which means you can request ID tokens in addition to OIDC or OAuth 2.0 tokens from the authorization server endpoints
- D. OpenID Connect Provider, which means you can request ID tokens in addition to access tokens from the authentication server endpoints
Answer: A
NEW QUESTION # 37
You can use Okta org. as an authorization server.
- A. This is used with an issuer being https://<subdomain>.okta.com
- B. This is used for OIDC use cases
- C. This is used for Authentication use cases
- D. This is used with the issuer being https://okta.com
- E. You cannot use Okta org as an authorization server
Answer: A,B,C
NEW QUESTION # 38
How do you ensure high-availability for the On-Prem MFA Agent?
- A. You can ensure high-availability by ensuring this On-Prem MFA Agent works on multiple AD forests / domains
- B. By installing another one on another Windows Server host
- C. You can only have one such Agent, so high-availability doesn,t apply in this scenario, but only for AD Agents, IWA Agents, so on
- D. By configuring another Service Account on the same On-Prem MFA Agent so that if you lose one, to have another available
Answer: B
NEW QUESTION # 39
There is a property named ''uid'', which is the user ID. This parameter is returned:
- A. Only if the token is an access token and the subject is an end user
- B. Only if the token is an refresh token and the subject is a resource server
- C. Only if the token is a refresh token and the subject is an end user
- D. Only if the token is an access token and the subject is an admin
- E. Only if the token is an access token and the subject is a authorization server
Answer: A
NEW QUESTION # 40
Can you configure both SSO and Provisioning on the same app integration?
- A. No
- B. Yes, but only if you specifically enable the tenant-wide option "Enable SSO and Provisioning on same instances of applications"
- C. Yes
- D. Yes, but only for Office 365 and G Suite apps
Answer: C
NEW QUESTION # 41
The Okta RADIUS Server agent:
- A. Communicates via UDP, over default port 1812 and does not support multiple ports simultaneously
- B. Communicates via UDP, over default port 1812 and supports multiple ports simultaneously
- C. Communicates via UDP, over default port 1812 and supports multiple ports simultaneously
- D. Communicates via TCP, over default port 636 and does not support multiple ports simultaneously
- E. Communicates via TCP, over default port 443 and does not support multiple ports simultaneously
Answer: C
NEW QUESTION # 42
''unsupported_grant_type'' error is thrown when the ''grant_type'' isn''t:
- A. ,authorization_code,
- B. ,client_credentials,
- C. ,refresh_token,
- D. ,password,
Answer: A,C,D
NEW QUESTION # 43
After you''ve created your external service, you have to register its endpoint in Okta.
- A. Statement is False, as you are using Header-Based authentication and the token you provide in API calls acts as an API token, token which is in fact received from the external service itself, hence there is no need to register the service,s endpoint in Okta as on each and every call the authorization header is passed on and it will know exactly which Okta domain is calling the service, so there is no need for a trust to be established in the Okta side as well
- B. Statement is False, as only users are registered, not services
- C. Statement is True
Answer: C
NEW QUESTION # 44
What is true for SWA, SAML, OIDC?
- A. SWA is an SSO standard developed by Okta
- B. OIDC is an authentication protocol sitting on top of OAuth 2.0 authorization standard
- C. In a SWA login action the credentials and passed to the third party app
- D. In a SAML / OIDC scenario credentials never leave Okta
- E. SWA needed a plugin to complete the SSO tasks
Answer: A,B,C,D,E
NEW QUESTION # 45
Can you set up via API a limited and non-refreashable Okta session lifetime?
- A. No
- B. Yes, but refreshable once a user does anything in the browser on his Okta Dashboard, which will refresh the token, thus extending the session time
- C. Yes
Answer: C
NEW QUESTION # 46
How can you let users from external Identity Providers SSO (Single Sign On) into Okta?
- A. By creating an Inbound SAML connection with that IdP
- B. Okta is an IdP, hence it cannot be an SP to allow such a flow
- C. By only enabling JIT (Just-in-Time) Provisioning at an org-level
Answer: A
NEW QUESTION # 47
In an Inline Hook scenario, if the external service responds with a redirect, Okta follows it.
- A. Okta does follow the redirect, but with a different request to the service
- B. Okta does not follow the redirect
- C. Okta does follow the redirect on the very same request
Answer: B
NEW QUESTION # 48
Access tokens are returned if ''response_type'' included:
- A. ,access,
- B. ,none,
- C. ,token,
- D. ,nonce,
- E. ,access_token,
Answer: C
NEW QUESTION # 49
Which Okta feature / solution offers you the possibility to maintain alternate authentication for off-network users, while keeping Okta for on-network users'' authentication requests?
- A. On-Prem MFA Agent
- B. Desktop Single-Sign On
- C. Org to Org
- D. Agentless DSSO
- E. Device Trust
- F. Routing Rules
Answer: F
NEW QUESTION # 50
You should use Okta RADIUS Server agent for authentication, when authentication is being performed by:
- A. AD DCs that don,t support SAML
- B. VPN devices that don't support SAML
- C. Virtual Desktops and Reverse Proxies that don't support SAML
Answer: B,C
NEW QUESTION # 51
When speaking about Security Behavior Detection, in which of the following case(s) does Okta prompt for MFA the user that tries to sign in, considering MFA is configured as required for the rule that validates this Sign In attempt:
- A. When behavior is detected and we have POSITIVE results in the rule matching
- B. When there is not enough history to detect behaviors, hence UNKNOWN results are present in policy rule matching
- C. When there is not enough information from the sign-in attempt to even detect behavior as when no device identifier was provided, so Okta will treat this a a BAD_REQUEST, which results in the policy rule matching
Answer: A,B,C
NEW QUESTION # 52
......
Verified & Correct Okta-Certified-Consultant Practice Test Reliable Source Mar 19, 2025 Updated: https://www.examcollectionpass.com/Okta/Okta-Certified-Consultant-practice-exam-dumps.html
Free Okta Okta-Certified-Consultant Exam Files Downloaded Instantly: https://drive.google.com/open?id=1PmfJ6jiJNu_tACjgaysc1avFKbst9H2g