Analytics-Admn-201 Salesforce Certified Tableau Server Administrator Questions and Answers

When Tableau Server uses Active Directory (AD) for authentication, group synchronization imports AD groups and assigns a minimum site role (e.g., Viewer, Explorer) to users in that group. This ensures users meet a baseline access level. The behavior for existing users during sync is:

If the user’s current site role provides more access than the minimum (e.g., Explorer vs. Viewer), their role remains unchanged.

If the user’s current role provides less access than the minimum (e.g., Unlicensed vs. Viewer), their role is upgraded to the minimum.

This preserves higher privileges while enforcing a floor. “Reduces access” means the minimum role is lower than the current role (e.g., Viewer vs. Explorer), in which case the existing role stays.

Option A (It will change to the minimum site role only if the minimum site role reduces access): Correct. The user’s role changes only if the minimum increases access (e.g., Unlicensed to Viewer); otherwise, it stays higher.

Option B (It will change only if the minimum provides more access): Incorrect wording. This is the inverse of the actual behavior—change occurs when needed to meet the minimum, not to exceed it.

Option C (It will always change): Incorrect. Existing higher roles are preserved.

Option D (It will never change): Incorrect. It changes if the current role is below the minimum.

Tableau Server supports multiple authentication methods, including Local Authentication, Active Directory, Kerberos, SAML, and OpenID Connect. OpenID Connect (OIDC) is an identity layer built on OAuth 2.0, commonly used for single sign-on (SSO). In Tableau Server, OIDC is implemented as a variant of SAML (Security Assertion Markup Language) authentication because both are SSO protocols managed through the same configuration workflow.

To use OpenID Connect:

Configure Tableau Server for SAML/SSO.

Provide an OIDC-compatible identity provider (IdP) configuration (e.g., Google, Okta).

Set up the IdP metadata and certificates in TSM.

Option D (SAML): Correct. Tableau Server treats OIDC as a subset of its SAML authentication framework, so you configure it under the SAML settings in TSM.

Option A (Local Authentication): Incorrect. Local Authentication uses Tableau’s internal user database, not an external SSO protocol like OIDC.

Option B (Kerberos): Incorrect. Kerberos is a network authentication protocol for Windows environments, unrelated to OIDC.

Option C (Active Directory): Incorrect. AD uses LDAP or Kerberos, not OIDC, for authentication.

Tableau Server uses a PostgreSQL database as its repository to store metadata, user information, and permissions. In a high-availability (HA) setup with multiple nodes, there are typically two repository instances: one active and one passive. The "preferred active repository" refers to designating which repository instance should take priority as the active one. This is managed through Tableau Services Manager (TSM).

The correct method to set the preferred active repository is by using the tsm configuration set command. Specifically, you would use a command like:

tsm configuration set -k pgsql.preferred_host -v

This command allows an administrator to specify the preferred host for the active repository, ensuring control over which node takes precedence in an HA environment.

Option B (tabcmd set command) is incorrect because tabcmd is a command-line utility primarily used for administrative tasks like managing users, groups, and content (e.g., publishing workbooks), not for configuring server topology or repository settings.

Option C (TSM browser client's Maintenance page) is incorrect because the Maintenance page in the TSM web interface is used for tasks like backups, restores, and cleanup, but it does not provide an option to set the preferred active repository.

Option D (TSM browser client's Configuration Topology page) is partially relevant since the Topology page displays the current configuration of services across nodes, including the repository. However, it does not allow direct modification of the preferred active repository; this must be done via the tsm command line.

TSM is Tableau Server’s management layer, accessible via CLI or web UI (port 8850). HTTPS secures this access—let’s identify the responsible process:

TSM Architecture:

Administration Controller: Core TSM process, running on the initial node, handling configuration, UI, and CLI commands.

HTTPS: Enabled by default on port 8850 with a self-signed certificate (configurable to custom certs).

Option B (Administration Controller): Correct.

Details: Hosts the TSM web UI (https:// :8850) and processes CLI requests. It manages the HTTPS listener, serving the interface securely.

Why: It’s the central hub for TSM operations, including secure access.

Option A (License Manager): Incorrect.

Why: Validates licenses, not responsible for HTTPS or UI access.

Option C (Administration Agent): Incorrect.

Why: Runs on additional nodes in multi-node setups to relay commands to the Controller—no direct HTTPS role.

Option D (Coordination Service): Incorrect.

Why: ZooKeeper manages cluster state, not TSM’s web interface or HTTPS.

Why This Matters: Secure TSM access protects server administration—Administration Controller is the linchpin.

Installing Tableau Server on Windows requires an account with sufficient privileges to configure services, write to the file system, and manage registry settings. Let’s analyze this in depth:

Installation Requirements:

The installer creates services (e.g., Tableau Server Gateway), writes to Program Files and ProgramData, and configures TSM.

It needs local administrative privileges on the machine to perform these tasks.

Post-install, a "Run As" account can be set for services (e.g., NT AUTHORITY\NetworkService), but this is separate from the install account.

Option C (An account in the local administrator group): Correct.

Why: The account must be in the local Administrators group to:

Install software (UAC elevation).

Configure services and ports.

Write to protected directories (e.g., C:\Program Files\Tableau).

Examples: A local admin (e.g., Administrator) or a domain user added to the Administrators group (e.g., DOMAIN\AdminUser).

Process: Log in as this account, run the installer, and provide TSM admin credentials during setup.

Option A (A local user account): Incorrect.

A standard local user (not in Administrators) lacks permissions—installation would fail with "Access Denied" errors.

Option B (A domain user account): Incorrect unless clarified.

A domain user without local admin rights can’t install. If it’s in the Administrators group, it qualifies, but C is more specific.

Option D (NT AUTHORITY\NetworkService): Incorrect.

This is a built-in service account for running services (default "Run As" post-install), not for executing the installer—an interactive user account is required.

Why This Matters: Using the right account prevents install failures and ensures secure configuration—critical for production setups.

Single Sign-On (SSO) allows users to authenticate once (e.g., via a corporate identity provider) and access Tableau Server without re-entering credentials. Tableau Server supports several SSO methods:

OpenID Connect (OIDC): An OAuth 2.0-based protocol for SSO, configured via Tableau’s SAML settings with an OIDC-compatible IdP (e.g., Google, Okta).

Kerberos with Active Directory: A ticket-based SSO protocol, widely used in Windows environments with AD integration.

SAML: A flexible SSO standard using XML assertions, supporting various IdPs (e.g., ADFS, PingFederate).

Let’s evaluate:

Option A (OpenID Connect): Correct. OIDC is an SSO method, implemented as a SAML variant in Tableau Server, enabling seamless login.

Option C (Kerberos with Active Directory): Correct. Kerberos provides SSO in AD environments, delegating authentication to the domain controller.

Option D (Security Assertion Markup Language - SAML): Correct. SAML is a core SSO method in Tableau, widely adopted for enterprise integrations.

Option B (Local Authentication): Incorrect. Local Authentication uses Tableau’s internal user database, requiring manual credential entry—no SSO support.

Why This Matters: SSO enhances user experience and security by leveraging existing identity systems, reducing password fatigue.

Tableau Server’s user-based licensing model assigns licenses to individual users (Creator, Explorer, Viewer) rather than machines or cores. Key features include:

Subscription license: Licenses are typically subscription-based, renewed annually or monthly, aligning with Tableau’s pricing model.

Distinct user roles: It supports three roles (Creator, Explorer, Viewer), each with specific capabilities, enabling granular access control.

Option A (A subscription license): Correct. User-based licenses are subscription-based by default.

Option B (Enables distinct user roles): Correct. The model defines Creator, Explorer, and Viewer roles.

Option C (Restricts the number of machine cores): Incorrect. This applies to core-based licensing, not user-based.

Option D (A perpetual license): Incorrect. Perpetual licenses were phased out; user-based licenses are subscription-based as of recent models.

Tableau Server uses internal secrets (tokens) for secure communication between its processes (e.g., Repository, File Store). These are automatically generated during installation and can be regenerated if compromised or for security maintenance. The command to update these is:

tsm security regenerate-internal-tokens: This regenerates the internal security tokens, ensuring all processes use the new tokens after a restart.

Option C (tsm security regenerate-internal-tokens): Correct. This is the documented command for updating internal secrets.

Option A (tsm data-access caching set -r 1): Incorrect. This command configures caching behavior, not security tokens.

Option B (tsm licenses refresh): Incorrect. This refreshes license data, unrelated to internal secrets.

Option D (tsm security validate-asset-keys): Incorrect. This validates encryption keys for assets, not internal tokens.

Tableau Server can record performance metrics for workbooks to troubleshoot slow-loading views. This feature must be enabled at the site level (via Settings > General > Allow Performance Recording). Once enabled, you can trigger recording for a specific view by modifying its URL.

The correct syntax is to append :record_performance=yes& to the view URL, immediately after the session ID. For example:

Original URL: http://server/#/site/my-site/views/workbook/view?:iid=1

Modified URL: http://server/#/site/my-site/views/workbook/view?:iid=1:record_performance=yes &

After loading the view with this parameter, a performance recording is generated and accessible via the Performance option in the toolbar.

Option B (Type :record_performance=yes& at the end of the view URL, immediately after the session ID): Correct. This follows Tableau’s documented method for enabling performance recording.

Option A (Click the Performance link in the toolbar): Incorrect. The Performance link appears only after recording is triggered via the URL; it’s not the method to enable it.

Option C (Type :record_performance=yes& immediately before the session ID): Incorrect. The parameter must follow the session ID (e.g., :iid=1) to function correctly.

Option D (Delete the session ID in the URL and reload the view): Incorrect. The session ID is required for the view to load properly; removing it breaks the URL.

Tableau Server’s licensing ties product keys to specific machines. Moving an environment requires managing activations to stay compliant. Let’s break this down:

Licensing Rules:

A product key can be activated on multiple machines (e.g., Dev, Test, Prod), but only up to the licensed limit (typically 3 for such setups).

Deactivation frees the key for reuse elsewhere.

Recommended Workflow:

Deactivate first: Use tsm licenses deactivate on the old Test machine to release the key.

Then activate: Install on the new hardware and activate with tsm licenses activate -k .

Why: Ensures compliance and avoids activation conflicts (e.g., exceeding the key’s limit).

Option B (Deactivate on Test, then install/activate on new hardware): Correct.

Steps:

On old Test: tsm licenses deactivate.

Install Tableau Server on new hardware.

On new Test: tsm licenses activate -k .

Benefit: Clean, compliant transfer—preserves license integrity.

Option A (Activate new, then deactivate old): Incorrect.

Risk: If the key’s limit is reached (e.g., 3 activations), the new activation fails until deactivation occurs. Order matters.

Option C (Activate new, keep old as backup): Incorrect.

Issue: Exceeds license limit (4 activations) and risks non-compliance. Backup requires deactivation or a separate key.

Option D (Activate new, obliterate old): Incorrect.

Details: tableau-server-obliterate.cmd wipes the entire install (data, config)—overkill and doesn’t formally deactivate the key via TSM, potentially leaving licensing inconsistent.

Why This Matters: Proper license management prevents activation errors and ensures legal use across environments.

Abandoned workbooks—those no longer actively used—can clutter Tableau Server and consume resources (e.g., disk space for extracts). Identifying them efficiently requires leveraging built-in administrative tools rather than manual or destructive methods. Let’s explore this in depth:

Tableau Server Admin Views: Tableau provides pre-built administrative views to monitor server health, usage, and content. The Stale Content view, accessible under Server > Status > Administrative Views, is specifically designed to identify content (workbooks, data sources) that hasn’t been viewed or modified recently. It shows:

Content name, owner, and project.

Last viewed date and last modified date.

View count over a period.This view uses Repository data to track usage metrics, making it ideal for spotting abandoned workbooks.

Option A (Use the Stale Content administrative view): Correct. This is the most efficient and non-invasive method. You can filter by last viewed date (e.g., >30 days ago) to identify workbooks with large extracts that users have stopped accessing. From there, you can contact owners or delete the content if policy allows. It’s a server administrator’s go-to tool for content management.

Option B (Examine extract files in ProgramData/.../extract): Incorrect and impractical. The ProgramData/Tableau/Tableau Server/data/tabsvc/dataengine/extract directory stores .hyper extract files, but:

File names are cryptic (e.g., GUIDs), not tied directly to workbook names.

It doesn’t indicate usage or abandonment—only file presence and size.

Manual inspection is time-consuming and error-prone compared to the Stale Content view.

Option C (Delete all extracts and allow them to be re-generated): Incorrect and risky. Deleting extracts (e.g., via tsm maintenance cleanup) removes them without identifying usage. Regeneration only occurs if a schedule or user triggers it, potentially disrupting active users and losing historical data unnecessarily.

Option D (View all workbooks, and sort by the Modified date): Partially effective but inefficient. In the Tableau Server UI (e.g., under Content > Workbooks), you can sort by "Last Modified," but:

It doesn’t show viewership (a workbook might be modified recently but unused).

It’s manual and doesn’t scale for large deployments compared to the Stale Content view.

Why This Matters: The Stale Content view leverages Tableau’s metadata to provide actionable insights, saving time and reducing risk compared to manual or destructive alternatives. It’s part of Tableau’s governance toolkit.

Importing an AD group into Tableau Server syncs user management—let’s analyze the process and options:

AD Group Import Process:

How: In the UI (Users > Groups > Add Group > Active Directory), enter the AD group name, set a site role, and sync.

Behavior:

Existing Users: If a user is already in Tableau Server, their site role remains unchanged unless manually adjusted—sync applies the minimum role only if it upgrades access.

New Users: Added to Tableau with the site role specified during import.

Config: Requires AD authentication enabled in TSM.

Option D (New users created are assigned the site role specified during import): Correct.

Details: When importing (e.g., "SalesTeam" group, site role: Explorer):

New users get Explorer.

Existing users keep their role unless it’s below Explorer (e.g., Unlicensed → Explorer).

Why: Ensures consistent onboarding—new users align with the group’s intended access.

Option A (Existing users’ roles change to match import): Incorrect.

Why: Existing roles persist unless lower than the minimum—e.g., Viewer stays Viewer if import sets Explorer, but Unlicensed upgrades. Not a full overwrite.

Option B (Requires a .csv file): Incorrect.

Why: AD import uses live sync via LDAP—no .csv needed (that’s for local auth imports).

Option C (Change group name during import): Incorrect.

Why: The AD group name is fixed—you can’t rename it in Tableau during sync (it mirrors AD). Post-import renaming is possible but not part of the process.

Why This Matters: Accurate AD sync ensures seamless user management—missteps can disrupt access or licensing.

Tableau Server uses a role-based licensing model with three primary license levels: Creator, Explorer, and Viewer. Each license level corresponds to specific site roles that define what users can do on the server.

Viewer License: This is the most restrictive license, allowing users to view and interact with published content (e.g., dashboards and visualizations) but not to create or publish new content.

Site Role: The Viewer license can only be associated with the Viewer site role. This role restricts users to viewing capabilities, aligning with the license’s purpose.

Option A (Creator): Incorrect. The Creator license is for users who can create, edit, and publish content using Tableau Desktop and the web interface. It corresponds to the Creator site role, not Viewer.

Option B (Explorer (can publish)): Incorrect. This is a variation of the Explorer license, which allows users to edit and publish content within limits. It’s more permissive than Viewer.

Option C (Viewer): Correct. The Viewer site role matches the Viewer license level perfectly.

Option D (Explorer): Incorrect. The Explorer license allows users to explore data and create content in the web interface, exceeding the Viewer license’s capabilities.