I85PREP
⌘ K
Okta Certified Professional study materials
Okta Certified Professional study resources

Okta Certified Professional practice questions

One question at a time. Build your Okta Certified Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1User management

An Okta administrator wants to create users in bulk from a comma-separated file instead of adding them one at a time. Which Okta feature should the administrator use?

  1. The Import Users tool with a CSV file Correct answer.
  2. The Org Authorization Server settings page
  3. The Sign-On Policy rule builder
  4. The Universal Directory attribute editor

Explanation

Okta supports bulk user creation through the Import Users workflow, which accepts a CSV file and maps columns to Okta profile attributes. This is the standard method for onboarding many users at once rather than creating each profile manually.

Question 2User management

A new employee's Okta account has been created but the user has not yet activated it. What is the default status of that user profile?

  1. PROVISIONED
  2. SUSPENDED
  3. ACTIVE
  4. STAGED Correct answer.

Explanation

When an administrator creates a user without a password and without sending an activation email, Okta assigns the STAGED status. Staged users exist in the directory but cannot sign in until they are activated.

Question 3User management

Which Okta group type is populated automatically by a rule rather than by manual membership assignment?

  1. A static group
  2. A rule-based group Correct answer.
  3. An app group
  4. An Everyone group

Explanation

Rule-based groups evaluate a group rule expression and add or remove members automatically as user profiles change. Static groups require an administrator or delegated owner to add members individually.

Question 4User management

An administrator needs to add a custom attribute such as 'Cost Center' to every Okta user profile. Where is this configured?

  1. In the Password Policy settings
  2. In the Universal Directory profile editor Correct answer.
  3. In the Network Zone settings
  4. In the Sign-On Policy settings

Explanation

The Universal Directory profile editor lets administrators add custom attributes to the Okta user profile schema. Once added, the attribute can be mapped to apps and used in group rules.

Question 5User management

Which Okta object is used to assign a set of applications and policies to many users at once?

  1. A user profile
  2. An authorization server
  3. A group Correct answer.
  4. A network zone

Explanation

Groups are the primary mechanism for assigning applications and applying policies to multiple users simultaneously. Assigning to a group is more efficient than assigning each user individually.

Question 6User management

An administrator wants to temporarily block a user from signing in while preserving the user's profile and assignments. Which user status should be applied?

  1. SUSPENDED Correct answer.
  2. PASSWORD_EXPIRED
  3. DEPROVISIONED
  4. STAGED

Explanation

SUSPENDED blocks sign-in while retaining the profile and app assignments, so access can be restored later. DEPROVISIONED is a terminal state that removes app access and cannot be reversed.

Question 7User management

Which Okta feature allows end users to reset their own password without contacting the help desk?

  1. Network zones
  2. App provisioning
  3. Self-Service Recovery Correct answer.
  4. Org Authorization Server

Explanation

Self-Service Recovery lets users reset passwords and unlock accounts using configured authenticators such as email or security questions. It reduces help desk load and is configured in the user management settings.

Question 8User management

An administrator needs to assign an Okta application to all members of the Sales department automatically. Which approach best accomplishes this?

  1. Add the app to a network zone
  2. Create a group for Sales and assign the app to that group Correct answer.
  3. Assign the app to the Everyone group
  4. Assign the app to each user individually

Explanation

Assigning an application to a group is the standard way to grant access to a set of users and keeps access current as membership changes. Individual assignment does not scale and is error-prone.

Question 9User management

A user's Okta profile shows the status PASSWORD_EXPIRED. What is the most likely cause?

  1. The user's password has exceeded the maximum age set in the password policy Correct answer.
  2. The user has never activated the account
  3. The user's group membership was removed
  4. The user has been deprovisioned from all apps

Explanation

PASSWORD_EXPIRED indicates the user's password has passed the maximum age defined in the applicable password policy. The user must change the password before regaining access.

Question 10User management

An administrator wants users in the Engineering department to be added to an Engineering group automatically when their department attribute is set to Engineering. Which Okta feature should be used?

  1. A password policy
  2. A sign-on policy
  3. An app provisioning rule
  4. A group rule Correct answer.

Explanation

Group rules evaluate user profile attributes and automatically add or remove members based on the expression. Setting the expression to department equals Engineering achieves this outcome.

Question 11User management

Which Okta feature should an administrator use to map an Okta user attribute to an attribute in a downstream application such as Salesforce?

  1. Profile mapping Correct answer.
  2. Sign-On Policy
  3. Network zone configuration
  4. Org Authorization Server scope

Explanation

Profile mappings define how Okta profile attributes are sent to application attributes during provisioning. This ensures downstream apps receive the correct values.

Question 12User management

An organization requires that all new users receive an activation email when their account is created. Which setting controls this behavior?

  1. The activation email option when creating the user Correct answer.
  2. The sign-on policy session lifetime
  3. The password policy complexity rule
  4. The network zone allowlist

Explanation

When an administrator creates a user, Okta provides the option to send an activation email so the user can set a password and activate the account. Selecting this option places the user in PROVISIONED status pending activation.

Question 13User management

An administrator deactivates a user in Okta. What effect does deactivation have on the user's app assignments and profile?

  1. The user becomes STAGED and can reactivate
  2. Assignments are removed and the profile is permanently deleted
  3. Only the password is cleared and assignments remain
  4. Assignments are removed and the user is moved to DEPROVISIONED Correct answer.

Explanation

Deactivation removes app assignments, revokes sessions, and moves the user to the DEPROVISIONED status. Reactivation is possible for a limited period before the user is permanently deleted.

Question 14User management

An administrator wants to ensure users cannot reuse their last five passwords. Which Okta configuration enforces this?

  1. The group rule expression
  2. The sign-on policy MFA requirement
  3. The password policy history setting Correct answer.
  4. The app provisioning mapping

Explanation

The password policy includes a history setting that prevents users from reusing a specified number of prior passwords. Setting the history to five enforces the requirement.

Question 15User management

A user reports that they cannot see an application tile after signing in to Okta. What is the most likely cause?

  1. The network zone is misconfigured
  2. The authorization server is disabled
  3. The user is not assigned to the application Correct answer.
  4. The user's password policy is too strict

Explanation

Application tiles appear in the end-user dashboard only when the user is assigned to the app, either directly or through a group. Without an assignment, no tile is shown.

Question 16User management

An administrator needs to add a user to Okta and immediately assign an app, but the user should not receive an activation email. Which approach accomplishes this?

  1. Create the user with a password policy that disables email
  2. Create the user without sending an activation email and assign the app while the user is STAGED Correct answer.
  3. Create the user in the Everyone group only
  4. Create the user with an activation email and deactivate afterward

Explanation

Okta allows administrators to create a user without sending an activation email, leaving the user in STAGED status. App assignments can still be made while the user is staged.

Question 17User management

Which Okta capability allows an administrator to delegate user management tasks, such as password resets, to a subset of users?

  1. Network zones
  2. Authorization servers
  3. Administrator roles Correct answer.
  4. Sign-on policies

Explanation

Okta administrator roles grant specific permissions to users, allowing delegation of tasks like password resets or group management. Roles can be scoped to groups or apps for least privilege.

Question 18User management

An administrator wants to import users from an HR system on a recurring schedule rather than a one-time CSV upload. Which Okta capability supports this?

  1. A group rule
  2. Just-in-time provisioning from an identity provider Correct answer.
  3. Manual CSV import
  4. A password policy

Explanation

Inbound provisioning from an identity provider or HR source can create and update Okta users automatically on an ongoing basis. Manual CSV import is a one-time operation.

Question 19User management

An administrator needs to ensure that when a user is removed from a group, the user's access to an assigned application is also removed. Which Okta behavior supports this?

  1. Direct user assignment
  2. Profile mapping
  3. Network zone assignment
  4. App assignment through group membership Correct answer.

Explanation

When an app is assigned to a group, access follows membership; removing a user from the group removes the app assignment. Direct assignments do not follow group changes.

Question 20User management

An administrator wants to add a custom attribute to the Okta user profile and use it in a group rule expression. What must be done first?

  1. Create a sign-on policy referencing the attribute
  2. Add the attribute to a network zone
  3. Create an authorization server scope
  4. Add the attribute in the Universal Directory profile editor Correct answer.

Explanation

Custom attributes must be defined in the Universal Directory profile editor before they can be used in group rule expressions. Once defined, the attribute becomes available for rules and mappings.

Question 21User management

An administrator observes that a user in a rule-based group remains a member even after the user's department attribute changed. Which explanation is most likely?

  1. The user's password has expired
  2. The user is assigned to the app directly
  3. The group rule has not yet been evaluated or is inactive Correct answer.
  4. The network zone excludes the user

Explanation

Rule-based group membership updates when the group rule is evaluated, which occurs on a schedule or after relevant profile changes. If the rule is inactive or has not run, membership may lag behind the attribute change.

Question 22User management

A user who was deprovisioned more than 30 days ago needs to be restored with the same profile and app assignments. What is the most accurate statement?

  1. The user must be created again, and app assignments must be re-added
  2. The user can be reactivated and all assignments are restored
  3. The user can be reactivated only if the password policy allows it
  4. The user cannot be reactivated because the profile is permanently deleted Correct answer.

Explanation

After the deprovisioning retention window, Okta permanently deletes the user profile, so reactivation is not possible. The administrator must create a new user and reassign apps.

Question 23User management

An administrator wants to enforce that users in a high-security group must complete MFA, while other users are not prompted. Which Okta configuration accomplishes this?

  1. A password policy with a longer minimum length
  2. A group rule that removes users from the group
  3. A network zone that blocks all external IPs
  4. A sign-on policy rule with a group condition requiring MFA Correct answer.

Explanation

Sign-on policy rules can include group conditions and require an authentication factor such as MFA for those users only. Other users fall through to a less restrictive rule.

Question 24User management

An administrator is troubleshooting why a newly imported user cannot sign in. The profile shows status STAGED and no password. What is the most appropriate next step?

  1. Change the user's status to DEPROVISIONED
  2. Assign the user to the Everyone group
  3. Send an activation email or set a password to activate the user Correct answer.
  4. Add the user to a network zone

Explanation

A STAGED user without a password cannot sign in until activated. Sending an activation email or setting a password moves the user to ACTIVE and enables sign-in.

Question 25User management

An administrator needs to ensure that when a user's manager changes in the HR source, the Okta profile and downstream app reflect the new manager. Which Okta capability is most relevant?

  1. Network zone configuration
  2. Password policy history
  3. Profile mapping combined with inbound provisioning Correct answer.
  4. Sign-on policy session lifetime

Explanation

Inbound provisioning updates Okta profiles from the source system, and profile mappings push those attribute values to downstream apps. Together they keep the manager attribute synchronized.

Question 26User management

An Okta administrator needs to create many user accounts at once from a spreadsheet exported by an HR team. Which Okta capability is designed for this bulk creation task?

  1. Enabling self-service registration on the Okta sign-in page
  2. Configuring a SCIM provisioning connection in the application
  3. Creating a group rule that references an Okta expression
  4. Importing users from a CSV file in the Okta Admin Console Correct answer.

Explanation

Okta supports bulk user creation through CSV import, where an administrator uploads a file and maps columns to Okta profile attributes. SCIM, self-service registration, and group rules serve different purposes and do not perform an initial bulk account load from a spreadsheet.

Question 27User management

Which Okta user status indicates that an account exists and has a valid profile but has not yet completed activation and cannot sign in?

  1. ACTIVE
  2. STAGED Correct answer.
  3. DEPROVISIONED
  4. SUSPENDED

Explanation

STAGED means the user has been created or imported but has not yet activated, so no credentials are usable for sign-in. ACTIVE users can authenticate, SUSPENDED users are temporarily blocked, and DEPROVISIONED users have been removed from the org.

Question 28User management

An administrator is creating a new user and wants Okta to generate a temporary password that the user must change at first sign-in. Which option should the administrator select?

  1. Leave the password field blank so the user self-registers later
  2. Set the password directly and clear the change-on-first-login requirement
  3. Set the password directly and require a password change on first login Correct answer.
  4. Send an activation email with a link to set a password

Explanation

When creating a user, an administrator can set a password manually and enable the requirement to change it at first login, giving the user a known temporary credential. Sending an activation email uses a different flow, and leaving the password blank does not create usable credentials.

Question 29User management

Which Okta profile attribute is typically used as the unique identifier for a user and cannot be duplicated across two accounts?

  1. firstName
  2. login Correct answer.
  3. city
  4. department

Explanation

The login attribute is the unique identifier Okta uses for authentication and must be unique within the org. Profile attributes such as firstName, department, and city are descriptive and may repeat across many users.

Question 30User management

An administrator wants a user to be able to sign in to Okta but should not have access to any assigned applications yet. What is the minimum configuration needed?

  1. Set the user status to STAGED
  2. Activate the user without assigning any applications Correct answer.
  3. Place the user in a group with no rules
  4. Assign the user to at least one application group

Explanation

An activated user can authenticate to Okta even with zero application assignments; app tiles simply will not appear. Application access depends on assignments, not on the ability to sign in.

Question 31User management

Which Okta group type is populated automatically based on user profile attribute conditions rather than manual membership management?

  1. An Okta group created by an administrator
  2. A rule-based group Correct answer.
  3. An application-specific group
  4. A group imported from an Active Directory domain

Explanation

Rule-based groups evaluate a group rule expression against user profiles and add or remove members automatically. Manually created groups and directory-imported groups rely on other mechanisms for membership.

Question 32User management

An administrator wants to review the history of profile changes and status changes for a single Okta user. Which Admin Console feature provides this?

  1. The org's password policy settings
  2. The user's group membership list
  3. The System Log filtered to the user Correct answer.
  4. The application's provisioning settings

Explanation

The System Log records events such as user updates, activations, and sign-ins, and can be filtered to a specific user to review their history. Provisioning settings, group lists, and password policies do not record event history.

Question 33User management

An administrator needs to add a user to Okta and assign an application, but the user should be able to sign in only after completing a self-service activation step. Which approach fits this requirement?

  1. Import the user without setting a password and leave them STAGED
  2. Create the user with status SUSPENDED and assign the app
  3. Create the user with status ACTIVE and a permanent password
  4. Create the user and send an activation email Correct answer.

Explanation

Sending an activation email lets the user complete activation themselves, after which the account becomes ACTIVE and the assigned app is accessible. Creating the user as ACTIVE with a permanent password bypasses the self-service step.

Question 34User management

An administrator wants to ensure that a user's Okta profile attribute is populated from the HR source system and kept current. Which configuration supports this?

  1. A profile mapping from the HR source to the Okta user profile Correct answer.
  2. A password policy applied to the HR group
  3. A group rule that references the attribute
  4. An application sign-on policy

Explanation

Profile mappings define how attributes from a source system are written into the Okta user profile, and they are reapplied during imports to keep values current. Password policies, group rules, and sign-on policies do not populate profile attributes from an external source.

Question 35User management

A user's Okta account was suspended and now the administrator has unsuspended it. What is the resulting user status?

  1. STAGED
  2. ACTIVE Correct answer.
  3. RECOVERY
  4. PROVISIONED

Explanation

Unsuspending a user returns the account to ACTIVE so the user can sign in again with existing credentials. STAGED and PROVISIONED indicate pre-activation states, and RECOVERY is a temporary state during credential recovery.

Question 36User management

An administrator wants to require users to provide a second factor when they access a sensitive application, while other applications remain accessible with password only. Which Okta configuration achieves this?

  1. An application sign-on policy with an MFA requirement Correct answer.
  2. A group rule that adds users to the sensitive app group
  3. A password policy with a minimum length increase
  4. A global session policy applied to all users

Explanation

Application sign-on policies evaluate access per application and can require an additional factor for that app. Global session policies govern the Okta session broadly, and password or group settings do not impose per-application MFA.

Question 37User management

An administrator needs to remove a user's access to Okta applications immediately while keeping the account available for future reinstatement. Which action should the administrator take?

  1. Reset the user's password
  2. Suspend the user Correct answer.
  3. Deactivate the user
  4. Delete the user

Explanation

Suspending a user immediately blocks sign-in and app access while preserving the profile and assignments for later reactivation. Deactivation and deletion are more permanent and change what can be restored.

Question 38User management

Which Okta feature lets an administrator define password complexity, lockout, and history requirements for a set of users?

  1. An application sign-on policy
  2. A profile mapping
  3. A password policy Correct answer.
  4. A group rule

Explanation

Password policies define credential requirements such as length, complexity, history, and lockout, and are assigned to groups. Sign-on policies address authentication context, group rules address membership, and profile mappings address attribute flow.

Question 39User management

A new user imported from a directory has no password set and the account is in PROVISIONED status. What does this status indicate?

  1. The user has been permanently removed from Okta
  2. The user has been blocked by an administrator
  3. The user has been created by an app but has not yet been activated in Okta Correct answer.
  4. The user has an expired password and must reset it

Explanation

PROVISIONED indicates an account that an application created in Okta but that has not yet been activated, so no credentials are usable. Removed users are DEPROVISIONED, expired passwords show PASSWORD_EXPIRED, and blocked users are SUSPENDED.

Question 40User management

An administrator wants to assign an application to users based on their job title without manually maintaining membership. Which Okta construct should be used?

  1. An application sign-on policy
  2. A manually created group with app assignment
  3. A profile mapping from the app to Okta
  4. A group rule that matches job title and assigns the app to the resulting group Correct answer.

Explanation

A group rule can match on profile attributes such as job title and place users into a group, and the app assignment on that group then grants access automatically. Manual groups, sign-on policies, and profile mappings do not perform attribute-based assignment.

Question 41User management

An administrator wants to give a help desk team the ability to reset passwords for users in one department only. Which Okta capability supports this?

  1. Sharing the org's API token with the help desk team
  2. Creating a custom administrator role scoped to the department group Correct answer.
  3. Assigning the help desk team the super administrator role
  4. Adding the help desk team to the department group

Explanation

Okta supports delegated administration through custom roles scoped to specific groups, allowing limited tasks such as password resets for a defined population. The super administrator role grants broad access, and sharing API tokens or group membership does not delegate admin rights.

Question 42User management

An administrator wants to prevent users from reusing any of their previous passwords. Which password policy setting enforces this?

  1. Session lifetime
  2. Lockout threshold
  3. Minimum length
  4. Password history Correct answer.

Explanation

The password history setting defines how many prior passwords Okta remembers and rejects on change. Minimum length and lockout govern complexity and failed attempts, while session lifetime controls session duration.

Question 43User management

An administrator needs to import users from an HR system on a recurring schedule and keep profiles synchronized. Which Okta feature is appropriate?

  1. An inbound provisioning integration with scheduled imports Correct answer.
  2. A one-time CSV import
  3. A group rule that references HR attributes
  4. An application sign-on policy

Explanation

Inbound provisioning integrations import users from a source system on a schedule and apply profile mappings to keep attributes current. A one-time CSV import does not recur, and group rules and sign-on policies do not import users.

Question 44User management

A user's Okta profile shows status LOCKED_OUT. What does this status indicate?

  1. The user's password has expired
  2. The user has not yet activated the account
  3. The user was deactivated by an administrator
  4. The user exceeded the allowed failed sign-in attempts Correct answer.

Explanation

LOCKED_OUT occurs when a user exceeds the failed sign-in threshold defined by the password policy. It is distinct from deactivation, password expiration, and the pre-activation states.

Question 45User management

An administrator wants a user to receive an Okta notification when their profile is updated by an import. Which configuration enables this?

  1. A group rule that triggers on profile change
  2. An application sign-on policy
  3. The user notification settings for profile updates Correct answer.
  4. A password policy history setting

Explanation

Okta provides notification settings that can send email to users when profile attributes change, including changes made by imports. Group rules, sign-on policies, and password history do not generate profile-update notifications.

Question 46User management

An administrator observes that a user's profile attribute updated in Okta is not reflected in a downstream application that uses provisioning. Which configuration should be checked first?

  1. The user's password policy
  2. The user's group rule expression
  3. The org's global session policy
  4. The application's profile mapping and provisioning settings Correct answer.

Explanation

Outbound provisioning relies on profile mappings and provisioning settings to push attribute changes to the app. If an attribute is not mapped or provisioning is disabled for that attribute, the update will not reach the app.

Question 47User management

An administrator needs to restore a user who was deprovisioned more than 30 days ago with the same profile and app assignments. What is the correct assessment?

  1. The user can be reactivated with all assignments intact
  2. The user can be unsuspended to recover the account
  3. The user cannot be restored and must be recreated Correct answer.
  4. The user can be restored only if the org has a backup

Explanation

After the deprovisioning retention window elapses, Okta permanently removes the user and the account cannot be reactivated. The administrator must create a new user and reassign applications.

Question 48User management

An administrator wants a group rule to reference a custom profile attribute. What must be done before the rule can evaluate that attribute?

  1. Map the attribute to a group name
  2. Add the attribute to a password policy
  3. Assign the attribute to an application sign-on policy
  4. Add the attribute to the Okta user profile and ensure it is populated Correct answer.

Explanation

Group rule expressions can only reference attributes defined in the Okta user profile, and the rule evaluates against their populated values. The attribute must exist in the profile schema and contain data for matching to work.

Question 49User management

An administrator notices that a user remains in a rule-based group after the matching attribute changed. Which explanation is most likely?

  1. The user's password policy changed
  2. The user was manually added and manual membership overrides rules
  3. The group rule is inactive or the profile change has not been evaluated Correct answer.
  4. The application assignment was removed

Explanation

Rule-based membership updates only when the rule is active and evaluation runs against the current profile. An inactive rule or a pending evaluation leaves stale membership until the next evaluation.

Question 50User management

An administrator wants to ensure that when a user is removed from a group, the user's access to an assigned application is revoked automatically. Which Okta behavior supports this?

  1. Application assignment inherited through group membership Correct answer.
  2. A profile mapping from the group to the app
  3. A sign-on policy scoped to the application
  4. A password policy applied to the group

Explanation

When an application is assigned to a group, access is derived from membership, so removing the user from the group removes the assignment. Password policies, sign-on policies, and profile mappings do not revoke app access based on membership.