Single Sign-On (SSO) allows users to authenticate once (e.g., via a corporate identity provider) and access Tableau Server without re-entering credentials. Tableau Server supports several SSO methods:

OpenID Connect (OIDC) : An OAuth 2.0-based protocol for SSO, configured via Tableau’s SAML settings with an OIDC-compatible IdP (e.g., Google, Okta).

Kerberos with Active Directory : A ticket-based SSO protocol, widely used in Windows environments with AD integration.

SAML : A flexible SSO standard using XML assertions, supporting various IdPs (e.g., ADFS, PingFederate).

Let’s evaluate:

Option A (OpenID Connect) : Correct. OIDC is an SSO method, implemented as a SAML variant in Tableau Server, enabling seamless login.

Option C (Kerberos with Active Directory) : Correct. Kerberos provides SSO in AD environments, delegating authentication to the domain controller.

Option D (Security Assertion Markup Language - SAML) : Correct. SAML is a core SSO method in Tableau, widely adopted for enterprise integrations.

Option B (Local Authentication) : Incorrect. Local Authentication uses Tableau’s internal user database, requiring manual credential entry—no SSO support.

Why This Matters : SSO enhances user experience and security by leveraging existing identity systems, reducing password fatigue.

Tableau Server’s licensing ties product keys to specific machines. Moving an environment requires managing activations to stay compliant. Let’s break this down:

Licensing Rules :

A product key can be activated on multiple machines (e.g., Dev, Test, Prod), but only up to the licensed limit (typically 3 for such setups).

Deactivation frees the key for reuse elsewhere.

Recommended Workflow :

Deactivate first : Use tsm licenses deactivate on the old Test machine to release the key.

Then activate : Install on the new hardware and activate with tsm licenses activate -k < key > .

Why : Ensures compliance and avoids activation conflicts (e.g., exceeding the key’s limit).

Option B (Deactivate on Test, then install/activate on new hardware) : Correct.

Steps :

On old Test: tsm licenses deactivate.

Install Tableau Server on new hardware.

On new Test: tsm licenses activate -k < key > .

Benefit : Clean, compliant transfer—preserves license integrity.

Option A (Activate new, then deactivate old) : Incorrect.

Risk : If the key’s limit is reached (e.g., 3 activations), the new activation fails until deactivation occurs. Order matters.

Option C (Activate new, keep old as backup) : Incorrect.

Issue : Exceeds license limit (4 activations) and risks non-compliance. Backup requires deactivation or a separate key.

Option D (Activate new, obliterate old) : Incorrect.

Details : tableau-server-obliterate.cmd wipes the entire install (data, config)—overkill and doesn’t formally deactivate the key via TSM, potentially leaving licensing inconsistent.

Why This Matters : Proper license management prevents activation errors and ensures legal use across environments.

Tableau Server’s user-based licensing model assigns licenses to individual users (Creator, Explorer, Viewer) rather than machines or cores. Key features include:

Subscription license : Licenses are typically subscription-based, renewed annually or monthly, aligning with Tableau’s pricing model.

Distinct user roles : It supports three roles (Creator, Explorer, Viewer), each with specific capabilities, enabling granular access control.

Option A (A subscription license) : Correct. User-based licenses are subscription-based by default.

Option B (Enables distinct user roles) : Correct. The model defines Creator, Explorer, and Viewer roles.

Option C (Restricts the number of machine cores) : Incorrect. This applies to core-based licensing, not user-based.

Option D (A perpetual license) : Incorrect. Perpetual licenses were phased out; user-based licenses are subscription-based as of recent models.

When Tableau Server uses Active Directory (AD) for authentication, group synchronization imports AD groups and assigns a minimum site role (e.g., Viewer, Explorer) to users in that group. This ensures users meet a baseline access level. The behavior for existing users during sync is:

If the user’s current site role provides more access than the minimum (e.g., Explorer vs. Viewer), their role remains unchanged .

If the user’s current role provides less access than the minimum (e.g., Unlicensed vs. Viewer), their role is upgraded to the minimum.

This preserves higher privileges while enforcing a floor. “Reduces access” means the minimum role is lower than the current role (e.g., Viewer vs. Explorer), in which case the existing role stays.

Option A (It will change to the minimum site role only if the minimum site role reduces access) : Correct. The user’s role changes only if the minimum increases access (e.g., Unlicensed to Viewer); otherwise, it stays higher.

Option B (It will change only if the minimum provides more access) : Incorrect wording. This is the inverse of the actual behavior—change occurs when needed to meet the minimum, not to exceed it.

Option C (It will always change) : Incorrect. Existing higher roles are preserved.

Option D (It will never change) : Incorrect. It changes if the current role is below the minimum.

To force Tableau Server to require the setup of a new administrator account (e.g., resetting the server to an initial setup state), the tsm reset command is the appropriate tool. This command resets Tableau Server’s administrative configuration, including the TSM administrator account, while preserving content like workbooks and data sources.

Option B (Run the tsm reset command): Correct. Running tsm reset clears the current TSM administrator credentials and configuration settings. The next time you access TSM (e.g., via the web interface or CLI), it prompts you to set up a new administrator account, mimicking the initial setup process. Command: tsm reset --username < new-username > --password < new-password > .

Option A (Edit tabsvc.yml): Incorrect. The tabsvc.yml file contains service configuration data, but manually editing it is not supported or recommended for resetting the administrator account. It could also corrupt the installation.

Option C (Run the tsm register command): Incorrect. The tsm register command is used to register Tableau Server with a new product key or identity store, not to reset the administrator account.

Option D (Reinstall Tableau Server): Incorrect. Reinstallation wipes the entire server, including content, and is overkill for this task. The tsm reset command achieves the goal without data loss.

Data-driven alerts in Tableau Server allow users to receive notifications when data in a view meets certain conditions (e.g., a sales metric exceeds a threshold). By default, this feature is disabled for a site unless explicitly enabled by an administrator.

Option C (Change the data-driven alerts setting on the new site ' s Settings page): This is the correct answer. In the Tableau Server web interface, a site administrator can navigate to the site’s Settings > General page and enable the option " Let users create data-driven alerts. " This must be done manually because the default setting for a new site is disabled. Once enabled, users with appropriate permissions (e.g., Viewer, Explorer, or Creator roles) can create alerts on views they have access to.

Option A (Enable data-driven alerts on the TSM Configuration page): This is incorrect because the TSM Configuration page (accessed via the TSM web UI or CLI) manages server-wide settings like ports, authentication, and processes, not site-specific features like data-driven alerts.

Option B (Run the tsm configuration set -k dataAlerts.checkIntervalInMinutes -v 60 command): This is incorrect. The dataAlerts.checkIntervalInMinutes key controls how frequently Tableau Server checks alert conditions (default is 60 minutes), but it does not enable the feature itself. The feature must first be turned on at the site level.

Option D (No action is necessary): This is incorrect because the default setting for data-driven alerts is off for new sites, requiring explicit action to enable it.

In an HA Tableau Server cluster, the Coordination Service (ZooKeeper ensemble) maintains cluster state—let’s find the best way to check it:

Coordination Service :

Runs on multiple nodes (3 or 5 in HA) to ensure quorum and failover.

Status indicates if it’s running and synced—critical for cluster health.

Option C (Run tsm status -v) : Correct.

Details : tsm status --verbose lists all processes across nodes, including Coordination Service (e.g., " Coordination Service: RUNNING " ).

Why Best : Provides detailed, node-specific status in the CLI—e.g., " Node 1: RUNNING, Node 2: RUNNING. "

Use : Run on the initial node; -v ensures full output.

Option A (TSM web client Status page) : Incorrect.

Why : The TSM UI ( Server > Status ) shows process counts (e.g., " Coordination Service: 3 instances " ), but not detailed per-node status—less granular than CLI.

Option B (tsm maintenance ziplogs) : Incorrect.

Why : Generates log archives for troubleshooting, not a real-time status check.

Option D (Tableau Server Status page) : Incorrect.

Why : The Server Status page ( Server > Status in the web UI) monitors application processes (e.g., VizQL), not TSM’s Coordination Service.

Why This Matters : Coordination Service health ensures HA stability—tsm status -v is the admin’s go-to for precision.