I85PREP
⌘ K
Okta Certified Administrator study materials
Okta Certified Administrator study resources

Okta Certified Administrator practice questions

One question at a time. Build your Okta Certified Administrator understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1User and Group Management

An administrator wants every new hire in the Sales department to receive the same baseline applications automatically on day one. Which Okta mechanism should the administrator use?

  1. Create a sign-on policy per application
  2. Enable self-service registration for the department
  3. Assign users to a group and assign that group to the applications Correct answer.
  4. Assign each user individually to every application

Explanation

Okta applies application assignments through group membership, so assigning the group to an app grants access to all current and future members. This keeps onboarding consistent and avoids per-user maintenance. Individual assignments work but do not scale or stay consistent as the department grows.

Question 2User and Group Management

Which statement describes how Okta evaluates group membership for a user who belongs to multiple groups?

  1. Only the group marked as default applies
  2. The user inherits the union of assignments from all groups Correct answer.
  3. The user must pick one primary group at sign-in
  4. Only the group with the oldest creation date applies

Explanation

Okta evaluates every group a user belongs to and combines the resulting assignments, so access is additive across groups. There is no concept of a single winning group for assignment purposes. Administrators should therefore review overlapping group assignments when auditing access.

Question 3User and Group Management

A user's profile shows a department attribute of 'Finance'. The administrator needs all Finance users to be grouped automatically without manual steps. What should be configured?

  1. A group rule that assigns users based on the department attribute Correct answer.
  2. An application sign-on policy for Finance
  3. A network zone limited to Finance users
  4. A password policy scoped to Finance

Explanation

Group rules evaluate user profile attributes and automatically add matching users to a target group. This is the standard way to keep membership aligned with directory data. Policies and zones govern authentication behavior rather than membership.

Question 4User and Group Management

What is the effect of deactivating a user in Okta?

  1. The user keeps signing in but loses administrator rights only
  2. The user is permanently deleted along with all assignments
  3. The user is moved to the Everyone group only
  4. The user cannot sign in, and assignments are retained for later reactivation Correct answer.

Explanation

Deactivation blocks sign-in while preserving the user's profile and assignments so the account can be reactivated. Deletion is a separate, more destructive action. This distinction matters when handling temporary leave versus termination.

Question 5User and Group Management

An administrator needs to import users from an on-premises directory and keep their profiles synchronized on an ongoing basis. Which Okta feature is designed for this?

  1. An Active Directory or LDAP agent integration with provisioning Correct answer.
  2. SAML assertion attribute mapping
  3. Self-service registration links
  4. Manual CSV import performed weekly

Explanation

Directory integration agents import users and keep attributes synchronized automatically. Manual imports create one-time changes without ongoing sync. SAML mapping only passes attributes during authentication and does not maintain the Okta profile.

Question 6User and Group Management

Which Okta group is present in every org and contains all users by default?

  1. Okta Administrators
  2. Everyone Correct answer.
  3. Domain Users
  4. All Staff

Explanation

The Everyone group exists in every Okta org and includes all active users automatically. It is commonly used for broad, organization-wide assignments and policies. Custom groups and administrator groups must be created and populated explicitly.

Question 7User and Group Management

An administrator wants to prevent users from changing their own password while still allowing them to reset it. Which password policy setting accomplishes this?

  1. Enable the password history restriction
  2. Disable the self-service password change option while keeping reset enabled Correct answer.
  3. Require an additional factor for sign-in
  4. Set the minimum password length to a high value

Explanation

Okta password policies separate the ability to change a password from the ability to reset a forgotten one. Disabling change while leaving reset available matches the requirement. Length, history, and factor requirements affect strength and authentication, not which self-service actions are permitted.

Question 8User and Group Management

Which user status indicates that an account has been created but the user has not yet completed the activation process?

  1. Provisioned
  2. Staged Correct answer.
  3. Active
  4. Suspended

Explanation

A staged user has a profile but has not activated and cannot sign in yet. Activation moves the account to Active once the user sets credentials. Suspended and provisioned describe other lifecycle states with different behavior.

Question 9User and Group Management

An administrator creates a group rule that adds users with title 'Contractor' to a Contractors group. A user's title later changes to 'Employee'. What happens to that user's membership if the rule remains active?

  1. The user is moved to the Everyone group only
  2. The user is removed from the group on the next rule evaluation Correct answer.
  3. The user is deleted from Okta
  4. The user remains in the group permanently because rules only add

Explanation

Active group rules are evaluated continuously, so users who no longer match the criteria are removed from the rule-managed group. This keeps membership aligned with current profile data. Rules do not permanently pin users once they stop matching.

Question 10User and Group Management

A user belongs to a group that is assigned an application, and the administrator later removes the user from that group. What is the resulting access state?

  1. The user keeps access because assignments are copied to the user
  2. The user's Okta account is deactivated
  3. The user is moved to a different group automatically
  4. The user loses the application assignment inherited from that group Correct answer.

Explanation

Application access granted through a group is tied to membership, so leaving the group removes that inherited assignment. Any direct assignment to the user would remain. This is why group-based access simplifies offboarding.

Question 11User and Group Management

An administrator needs to delegate the ability to reset passwords and unlock accounts for the Help Desk team without granting full administrator rights. Which approach is appropriate?

  1. Assign a delegated admin role scoped to the relevant users or groups Correct answer.
  2. Assign the Help Desk team to every application
  3. Share the super administrator credentials with the team
  4. Add the Help Desk team to the super administrator role

Explanation

Okta supports delegated administration with granular roles and scoping so a team can perform specific tasks such as password resets. This follows least privilege. Super administrator access and shared credentials create excessive risk.

Question 12User and Group Management

A user reports that they cannot see an application tile even though their group is assigned to the app. Which factor should the administrator check first?

  1. Whether the org has more than one administrator
  2. Whether the application uses SAML or OIDC
  3. Whether the user has a valid email address format
  4. Whether the application is set to appear in the end-user dashboard for that assignment Correct answer.

Explanation

Okta lets administrators hide an application from the user dashboard even when the assignment exists. Checking the visibility setting for that app and assignment explains a missing tile. Protocol choice and admin count do not control tile visibility.

Question 13User and Group Management

Which action best supports a joiner-mover-leaver process for a user moving from one department to another when group rules are configured?

  1. Disable the user's account until the next quarter
  2. Delete and recreate the user account
  3. Manually assign the user to all new department apps and leave old ones
  4. Update the department attribute so rules recalculate group membership Correct answer.

Explanation

Group rules keyed to profile attributes automatically adjust membership when the department changes, removing old access and adding new access. This is the core of a mover workflow. Deleting and recreating accounts loses history and creates churn.

Question 14User and Group Management

An administrator wants to require a second factor only when users sign in from outside the corporate network. Which Okta construct combines the condition and the requirement?

  1. An application provisioning setting
  2. A password policy with a longer minimum length
  3. A sign-on policy rule with a network zone condition and an MFA requirement Correct answer.
  4. A group rule based on the city attribute

Explanation

Sign-on policy rules evaluate conditions such as network zone and can then require an additional factor. This targets step-up authentication to risky contexts. Password length and provisioning settings do not implement conditional MFA.

Question 15User and Group Management

An administrator wants to bulk update a custom attribute for many existing users using a file. Which Okta capability supports this?

  1. Creating a new group rule
  2. Importing a CSV with matching identifiers to update profiles Correct answer.
  3. Editing each user profile manually
  4. Rotating the org's API token

Explanation

Okta supports importing a CSV keyed on a unique identifier such as username or email to update existing profiles in bulk. This is efficient for large attribute changes. Manual edits and API token rotation do not perform bulk profile updates.

Question 16User and Group Management

A group rule is configured to assign users to a group, but the administrator also wants to ensure that users removed from the source condition do not linger. Which setting should be reviewed?

  1. Whether the org uses SAML for federation
  2. Whether the user has a mobile phone enrolled
  3. Whether the target group is assigned to an application
  4. Whether the rule is active and whether membership removal is enabled for the rule Correct answer.

Explanation

Group rules have settings controlling whether they are active and whether users are removed when they no longer match. Reviewing these ensures membership stays accurate. Application assignment and federation protocol do not govern rule removal behavior.

Question 17User and Group Management

Which statement correctly distinguishes a group from an organizational unit in Okta?

  1. Groups can only contain administrators
  2. Org units replace groups for application assignment
  3. Groups cannot be nested or combined with rules
  4. Groups drive assignment and policy targeting, while org units are not an Okta construct used for targeting Correct answer.

Explanation

In Okta, groups are the primary construct for targeting assignments and policies. Organizational units are a directory concept from other systems and are not used as Okta targeting objects. Groups can be populated manually or by rules.

Question 18User and Group Management

An administrator needs to ensure that when a user is deactivated in Okta, their account in a connected application is also disabled. Which configuration supports this?

  1. Create a sign-on policy rule
  2. Increase the password policy complexity
  3. Add the user to the Everyone group
  4. Enable deactivation provisioning for the application Correct answer.

Explanation

Outbound provisioning settings can push deactivation to a connected app so the downstream account is disabled. This keeps offboarding consistent across systems. Group membership and policy changes do not themselves disable downstream accounts.

Question 19User and Group Management

A user has two Okta accounts with different usernames that both match the same person. What is the recommended way to consolidate access?

  1. Delete both accounts and create a new one
  2. Disable one account and leave the other unmanaged
  3. Merge the accounts so the secondary username becomes an alias of the primary Correct answer.
  4. Assign both accounts to the same groups

Explanation

Okta supports merging accounts so the secondary username becomes an alias, preserving access and history under one identity. Deleting accounts loses data and assignments. Managing two accounts separately creates confusion and duplicate access.

Question 20User and Group Management

An administrator wants to limit which users can be targeted by a delegated help desk role. Which mechanism provides this scoping?

  1. Adding the help desk to the Everyone group
  2. Creating a new application integration
  3. Changing the org's default password policy
  4. Assigning the role with a scope limited to specific groups or users Correct answer.

Explanation

Delegated admin roles can be scoped so the administrator can act only on specified users or groups. This enforces least privilege. Application integrations and password policies do not scope administrative authority.

Question 21User and Group Management

An org uses group rules to populate a group, and an administrator also manually adds a user to that same group. What is the result when the user no longer matches the rule?

  1. The user is deleted from Okta
  2. The rule removes the user, and the manual membership may also be affected depending on the rule's removal behavior Correct answer.
  3. The manual membership always overrides the rule and keeps the user
  4. The group is automatically deleted

Explanation

Rule-managed membership is dynamic, and removal behavior depends on the rule's configuration. Administrators should avoid mixing manual and rule-based membership in the same group to prevent unexpected removals. Neither deletion of the user nor deletion of the group is a normal outcome.

Question 22User and Group Management

An administrator needs to prove that a terminated user's access to all applications was removed within minutes of deactivation. Which Okta capability best supports this audit?

  1. The application's SAML metadata file
  2. The password policy history report
  3. The System Log filtered by the user and provisioning events Correct answer.
  4. The org's branding customization page

Explanation

The System Log records user lifecycle and provisioning events with timestamps, which supports demonstrating timely access removal. Password policy and branding pages do not contain access removal evidence. SAML metadata describes configuration, not events.

Question 23User and Group Management

A group rule targets a group that is also used in a sign-on policy condition. A user is removed from the group by the rule. What is the immediate effect on the user's authentication?

  1. The user no longer satisfies the policy condition and is evaluated against the remaining policy rules Correct answer.
  2. The user is locked out of Okta permanently
  3. The user retains the policy condition until the next password change
  4. The user is moved to the Everyone group only

Explanation

Policy conditions are evaluated at sign-in against current group membership, so removal changes which rules apply. The user is then evaluated against other applicable rules rather than being permanently locked out. Password change timing is unrelated to policy evaluation.

Question 24User and Group Management

An administrator must ensure that a contractor's Okta account is disabled automatically on a specific end date without manual intervention. Which approach is most reliable?

  1. Rely on the contractor to request deactivation
  2. Use a scheduled deactivation workflow or lifecycle management rule tied to an end-date attribute Correct answer.
  3. Set a shorter password lifetime for the contractor
  4. Assign the contractor to fewer applications

Explanation

Automating deactivation through a scheduled workflow or lifecycle rule tied to an end-date attribute removes reliance on manual action. This produces consistent, auditable offboarding. Shorter password lifetimes and fewer app assignments do not disable the account.

Question 25User and Group Management

An administrator is troubleshooting why a user received an application through a group even though no direct assignment exists. Which investigation path is most efficient?

  1. Review the org's email domain settings
  2. Review the user's group memberships and the assignments of each group to that application Correct answer.
  3. Check the user's password history
  4. Inspect the application's SAML certificate expiration

Explanation

Access can be inherited through any group membership, so enumerating the user's groups and their app assignments identifies the source. Password history, email domains, and certificate expiry do not explain inherited assignment. This approach narrows the cause quickly.

Question 26User and Group Management

In Okta, which group type is created automatically and used to assign applications and policies to users based on rules rather than manual membership?

  1. An Active Directory security group
  2. An app-specific group imported from a connected directory
  3. An Okta group Correct answer.
  4. An organizational unit

Explanation

Okta groups are native to the org and are the standard mechanism for assigning applications and policy conditions, and they can be populated by group rules. Directory groups imported from Active Directory are separate objects that must be linked or pushed. Organizational units structure directory objects but are not the Okta assignment construct.

Question 27User and Group Management

An administrator wants users to be able to sign in with their email address but also wants each user to have a distinct login that is not an email. Which Okta user profile field serves as the unique sign-in identifier?

  1. The email attribute
  2. The displayName attribute
  3. The login attribute Correct answer.
  4. The secondEmail attribute

Explanation

The login attribute holds the unique identifier a user types at sign-in, and it must be unique within the org. The email attribute stores the address used for notifications and can differ from the login. secondEmail is a recovery address, and displayName is only a presentation field.

Question 28User and Group Management

A new hire's Okta account shows the status STAGED after creation through the API. What does this status mean for the user?

  1. The user has been suspended for policy violations
  2. The user has been deactivated by an administrator
  3. The user has been created but has not yet activated the account Correct answer.
  4. The user has activated and can sign in immediately

Explanation

STAGED indicates the profile exists but the user has not completed activation, so no credentials are usable yet. ACTIVE means the user has activated and can authenticate. SUSPENDED and DEPROVISIONED represent different lifecycle states.

Question 29User and Group Management

An administrator needs to add many users to a single Okta group at once using a CSV file. Which Okta feature is designed for this bulk membership operation?

  1. Profile mastering
  2. Bulk group membership upload via CSV Correct answer.
  3. Group rules
  4. Import Users with a group column

Explanation

Okta supports uploading a CSV to add or remove members of an existing group in bulk. Group rules evaluate profile criteria continuously rather than consuming a file. Profile mastering controls which source owns attribute values and does not manage membership.

Question 30User and Group Management

Which Okta role can be assigned to a user so they can manage group membership and user profiles for a subset of groups without holding super administrator rights?

  1. API access management administrator
  2. Mobile administrator
  3. Report administrator
  4. Group administrator Correct answer.

Explanation

The group administrator role grants management of group membership and related user operations, and it can be scoped to specific groups. Report, API access management, and mobile administrator roles cover unrelated functions.

Question 31User and Group Management

An administrator wants to map an Okta user profile attribute to an attribute in a SAML application so the value is sent in the assertion. Where is this configured?

  1. In the user's individual profile page
  2. In the org's email domain settings
  3. In the application's Sign On tab under attribute statements Correct answer.
  4. In the group rule expression

Explanation

Attribute statements on the application's Sign On tab define which Okta profile values are included in the SAML assertion and under which names. Group rules only control membership, and per-user edits do not define app mappings. Email domain settings control sign-in domains, not assertion attributes.

Question 32User and Group Management

Which Okta group is automatically created in every org and is commonly used to assign applications to every user?

  1. Okta Administrators
  2. Domain Users
  3. All Staff
  4. Everyone Correct answer.

Explanation

The Everyone group exists by default and includes all users in the org, making it a convenient target for org-wide assignments. Okta Administrators is a separate built-in admin group, and All Staff and Domain Users are not default Okta groups.

Question 33User and Group Management

A user's Okta profile shows status ACTIVE, but the user reports they cannot sign in because their password is unknown. Which administrator action restores access without changing the user's status?

  1. Suspend the user and then unsuspend
  2. Reset the user's password and require a change at next sign-in Correct answer.
  3. Deactivate and reactivate the user
  4. Delete the user and recreate the account

Explanation

Resetting the password issues a temporary credential and can force a change at next sign-in while the account stays ACTIVE. Deactivate/reactivate and suspend/unsuspend cycles interrupt access and do not directly provide a new password. Deleting the account destroys the profile and its associations.

Question 34User and Group Management

An administrator configures a group rule with the expression `user.department == "Sales"` and assigns the rule to the Sales group. Which behavior should the administrator expect when a user's department changes to Marketing?

  1. The user is deactivated by the rule
  2. The user is removed from the Sales group automatically Correct answer.
  3. The rule fails and stops evaluating all users
  4. The user remains in the Sales group until manually removed

Explanation

Group rules continuously evaluate membership, so when a user no longer matches the expression they are removed from the rule-managed group. Rules do not deactivate users or halt evaluation due to a single user's attribute change. Manual removal is only needed for memberships that rules do not manage.

Question 35User and Group Management

An administrator needs to assign an application to a group but wants users to receive the app only after they accept an invitation, while others in the group should not be prompted. Which approach best fits?

  1. Assign the app to the group and enable self-service request
  2. Assign the app to a separate group populated by a rule that targets only eligible users Correct answer.
  3. Assign the app directly to each eligible user and remove the group assignment
  4. Assign the app to Everyone and rely on sign-on policy

Explanation

Narrowing the assignment to a rule-managed group that contains only eligible users ensures only those users receive the app. Assigning to Everyone or the broad group would grant access too widely. Direct per-user assignment defeats group-based management.

Question 36User and Group Management

A user is a member of a group that is assigned to an application, but the application tile does not appear. The group assignment shows as active. Which configuration should the administrator check first?

  1. The application's sign-on policy that may block the user Correct answer.
  2. The user's secondEmail value
  3. The user's email domain settings
  4. The org's branding customization

Explanation

A sign-on policy can block access even when the group assignment exists, which commonly explains a missing or unusable app. Branding, email domain, and secondEmail settings do not control app visibility for an assigned user.

Question 37User and Group Management

An administrator wants to prevent users in a specific group from using the self-service password reset flow while allowing all other users to use it. Which Okta configuration achieves this?

  1. Set a password policy for that group that disables self-service recovery Correct answer.
  2. Set the group's users to STAGED status
  3. Disable the Forgot Password link org-wide
  4. Remove the group from the Everyone group

Explanation

Password policies can be assigned to groups and can disable self-service recovery for members of that group while other groups keep it. The Everyone group cannot have members removed, and disabling recovery org-wide affects all users. STAGED status is a lifecycle state, not a recovery control.

Question 38User and Group Management

An administrator needs to ensure that when a user is removed from a group, the user's access to a connected application is revoked automatically. Which configuration is required?

  1. Assign the application to Everyone
  2. Enable deactivation or deprovisioning for the application Correct answer.
  3. Configure a sign-on policy for the application
  4. Enable self-service assignment

Explanation

Deprovisioning must be enabled for the app so that removal of the assignment triggers the corresponding action in the target system. Group assignment alone grants access but does not revoke downstream accounts unless deprovisioning is configured. Self-service and sign-on policies do not handle account revocation.

Question 39User and Group Management

A user has two Okta accounts with different logins that represent the same person. Which Okta feature is intended to link these profiles so administrators can manage the person centrally?

  1. Group rules
  2. Universal directory schema
  3. Linked objects Correct answer.
  4. Profile mastering

Explanation

Linked objects associate multiple Okta user profiles that represent the same individual, allowing centralized management. Profile mastering determines attribute source priority, group rules control membership, and the schema defines attribute definitions.

Question 40User and Group Management

An administrator wants to delegate the ability to reset passwords for only the users in a specific department. Which mechanism scopes the delegated role to those users?

  1. An application sign-on policy
  2. Resource sets that include only the target users Correct answer.
  3. A group rule that assigns the role
  4. The Everyone group

Explanation

Resource sets define the set of resources a delegated administrator can act on, so scoping the role to a resource set containing the target users limits their reach. Group rules assign membership, not admin scope. Everyone is too broad, and sign-on policies govern authentication.

Question 41User and Group Management

An administrator needs to add a custom attribute to the Okta user profile that is required for all users and must be unique. Where is this configured?

  1. In the application's provisioning settings
  2. In the Universal Directory profile editor for the Okta user profile Correct answer.
  3. In the org's sign-on policy
  4. In the group rule expression editor

Explanation

Custom attributes are added in the profile editor, where administrators can mark them required and enforce uniqueness. Provisioning settings map attributes to apps but do not define the Okta profile schema. Group rules and sign-on policies consume attributes but do not create them.

Question 42User and Group Management

An administrator sets up a group rule with the condition `user.title == "Manager"` and also manually adds a user without that title to the same group. What is the result for that manually added user?

  1. The user is deactivated by the rule
  2. The user remains because manual additions are not evaluated by the rule Correct answer.
  3. The rule is disabled until manual members are removed
  4. The user is removed because they do not match the rule

Explanation

Group rules manage only the memberships they add; users added manually are not removed by a rule that does not match them. Rules do not disable themselves due to manual members, and they never change account status.

Question 43User and Group Management

An administrator must ensure that a user's Okta account is deactivated automatically on a specific future date without manual intervention. Which approach is most appropriate?

  1. Remove the user from all groups on that date
  2. Set the user's status to SUSPENDED manually on that date
  3. Use a scheduled workflow or lifecycle automation that deactivates the user on the date Correct answer.
  4. Rely on the user's password expiring on that date

Explanation

Automated deactivation on a future date requires a scheduled workflow or lifecycle automation that triggers the deactivation. Manual suspension depends on someone acting, password expiry does not deactivate an account, and removing group membership does not change status.

Question 44User and Group Management

A group rule is configured to add users to a group, and the administrator later wants users who stop matching the rule to be removed automatically. Which setting must be enabled on the rule?

  1. Deactivate users when they no longer match the rule
  2. Remove users when they no longer match the rule Correct answer.
  3. Suspend users when they no longer match the rule
  4. Delete users when they no longer match the rule

Explanation

Group rules include an option to remove users who no longer match the criteria, which keeps membership aligned with the expression. Rules never deactivate, suspend, or delete users; those are separate lifecycle actions.

Question 45User and Group Management

An administrator wants to verify that a user's access to all applications was removed within minutes of deactivation. Which evidence best supports this?

  1. The System Log shows deactivation followed by deprovisioning events for each app Correct answer.
  2. The application's sign-on policy no longer lists the user
  3. The user's profile status shows DEPROVISIONED
  4. The user's group memberships are empty

Explanation

The System Log records the deactivation and the resulting app deprovisioning events with timestamps, providing auditable proof of timing. Status alone does not show downstream app actions, and sign-on policies are not per-user records.

Question 46User and Group Management

An administrator creates a group rule that targets a group used in a sign-on policy condition. A user is removed from the group by the rule. What is the immediate effect on the user's authentication?

  1. The user is removed from all applications
  2. The user's password is reset automatically
  3. The user is denied sign-in because the policy condition no longer matches Correct answer.
  4. The user is prompted for an additional factor

Explanation

Policy conditions evaluate group membership at sign-in, so removal from the group means the policy no longer applies to that user and they are denied if access depended on it. Removal from a group does not reset passwords or automatically remove app assignments unless those are also group-based.

Question 47User and Group Management

An administrator is troubleshooting why a user received an application through a group even though no direct assignment exists. Which sequence of checks best isolates the source of access?

  1. Check the user's secondEmail, then the displayName, then the login
  2. Check the user's password policy, then the sign-on policy, then the branding settings
  3. Check the user's email domain, then the org's provisioning settings, then the app's logo
  4. Check the user's group memberships, then each group's app assignments, then the app's assignment type Correct answer.

Explanation

Access through groups is traced by enumerating the user's memberships, then the assignments on those groups, then confirming whether the app uses group or individual assignment. The other sequences examine unrelated settings that do not grant app access.

Question 48User and Group Management

An administrator needs to ensure that a group rule does not add users who are already members of a second group used for exceptions. Which approach achieves this?

  1. Disable the Everyone group
  2. Assign the exception group to the application
  3. Delete the exception group
  4. Add a condition to the rule that excludes members of the exception group Correct answer.

Explanation

Group rule expressions can reference group membership, allowing the rule to exclude users who belong to an exception group. Deleting the exception group defeats its purpose, and assigning it to an app does not affect rule evaluation. The Everyone group cannot be disabled.

Question 49User and Group Management

A user's profile is mastered by an Active Directory source, and an administrator edits the user's department in Okta. What is the expected outcome after the next directory sync?

  1. The user is deactivated
  2. The Okta edit persists because Okta has priority
  3. The attribute becomes read-only permanently
  4. The directory value overwrites the Okta edit Correct answer.

Explanation

When a profile is mastered by a directory source, that source is authoritative, so the next sync overwrites local edits with the directory value. The account is not deactivated, and the attribute does not become permanently read-only.

Question 50User and Group Management

An administrator wants to bulk remove a set of users from a group without affecting their other group memberships or their account status. Which method is appropriate?

  1. Upload a CSV to remove those members from the target group Correct answer.
  2. Deactivate the users and reactivate them
  3. Change the users' status to SUSPENDED
  4. Delete the group and recreate it

Explanation

A CSV upload can remove specified members from a single group while leaving other memberships and statuses intact. Deactivation, deletion, and suspension affect the account or the group broadly and are not targeted membership removals.