Okta Certified Administrator - Identity Access Management SSO MFA Lifecycle Directory

By Drew Nguyen · Updated Jul 10, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged2,143
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.4 (15)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A user's Okta account has been compromised. The security team needs to immediately revoke all active sessions and access tokens for this user without permanently deactivating the account. What action should the Okta administrator take?

Answer choices

  • A. Change the user's password — this automatically invalidates all sessions

  • B. Suspend the user's account — this blocks all logins without deactivating the account

  • C. Revoke all sessions in the user's profile under Admin Console > Directory > People > [User] > "Clear All Sessions" AND revoke all OAuth 2.0 tokens

  • D. Delete and recreate the user account

Question 2

An Okta administrator is reviewing the Okta System Log and finds unusual login activity. They see multiple failed login attempts followed by a successful login from an IP address in an unexpected country, all for the same user account within a 5-minute window. Which Okta security feature would have detected and potentially blocked this behavior automatically?

Answer choices

  • A. IP Blocklist with the unexpected country's IP ranges

  • B. Okta ThreatInsight — an adaptive threat detection engine that analyzes login behavior and can automatically block or require step-up authentication based on risk signals

  • C. Password complexity requirements preventing brute force

  • D. The Okta global session policy's maximum session lifetime settings

Question 3

An Okta administrator is configuring Single Sign-On (SSO) for a SaaS application that supports SAML 2.0. The application requires the NameID format to be "EmailAddress" and needs the user's department included as an attribute. What Okta configuration achieves this?

Answer choices

  • A. Configure the application as an OpenID Connect (OIDC) app since SAML cannot include custom attributes

  • B. In the Okta SAML application setup, configure the SAML Settings: set NameID format to "EmailAddress" using the user's email attribute, and add an Attribute Statement mapping "department" to `${user.department}` from Okta's Universal Directory

  • C. Create a custom claim in Okta's API and link it to the SAML application

  • D. Configure a SAML assertion transformation in the application's Identity Provider metadata

Question 4

A large organization is deploying Okta across multiple subsidiaries, each requiring complete isolation of users, applications, and policies while sharing a single Okta subscription. Which Okta architecture feature should the administrator evaluate?

Answer choices

  • A. Multiple Okta organizations (orgs) — one per subsidiary (requires separate subscriptions)

  • B. Okta's Multi-Tenant Org (Okta Multitenant Architecture) or use separate Production and Preview orgs

  • C. Okta Identity Governance with delegated administration to subsidiary administrators

  • D. Okta's UD Groups to logically separate subsidiaries within a single org

Question 5

An Okta administrator is troubleshooting why a user cannot access a SAML application. The user reports receiving a "403 Forbidden" error after attempting to log in. Where should the administrator investigate?

Answer choices

  • A. Check the application's SAML certificate expiration date

  • B. Check Okta System Log for the SAML authentication event to identify the specific error; verify the user is assigned to the application in Okta; verify the SAML assertion's NameID matches a valid user in the application

  • C. Restart the Okta service to clear session cache

  • D. Check the user's password expiration date