ACA Security & Governance 2 — Questions and Answers
Question 1: In Appian, which environment tier is intended exclusively for final user acceptance testing before production release?
- UAT Environment (Correct answer)
- Development Environment
- Sandbox Environment
- Load Test Environment
Correct answer: UAT Environment
The UAT environment is used for stakeholder validation and acceptance testing prior to promoting changes to production.
Question 2: What does the principle of least privilege mean in an Appian application context?
- Users should only be granted the minimum access needed to perform their tasks (Correct answer)
- Admins should have all permissions by default
- All users share a single permission group
- Permissions are assigned automatically based on usage patterns
Correct answer: Users should only be granted the minimum access needed to perform their tasks
The principle of least privilege reduces security risk by ensuring users can only access what is strictly necessary for their role.
Question 3: Which Appian feature allows an application to enforce different UI views for different user roles?
- User Filters on Interfaces (Correct answer)
- Process Reporting
- Smart Services
- Record Sync
Correct answer: User Filters on Interfaces
User filters and conditional display expressions on interfaces allow different UI content to be shown based on user group membership.
Question 4: What is the purpose of Appian's Connected System object in relation to security?
- Centralizes and secures external system credentials used by integrations (Correct answer)
- Manages internal user authentication tokens
- Encrypts process variables at rest
- Handles SSL certificate renewal
Correct answer: Centralizes and secures external system credentials used by integrations
Connected Systems store external API credentials and authentication configurations securely, preventing credential sprawl.
Question 5: How does Appian handle SAML-based Single Sign-On (SSO) authentication?
- Appian acts as the Service Provider, delegating authentication to the Identity Provider (Correct answer)
- Appian acts as the Identity Provider for all SSO connections
- SAML is not supported in Appian
- Appian generates its own SAML tokens independently
Correct answer: Appian acts as the Service Provider, delegating authentication to the Identity Provider
In SAML SSO, Appian is the Service Provider and delegates user authentication to the organization's Identity Provider (e.g., Okta, Azure AD).
Question 6: Which Appian configuration controls whether users can export record data to CSV or Excel?
- Record Type export settings (Correct answer)
- Process Report permissions
- System Admin Console export flags
- Interface component visibility rules
Correct answer: Record Type export settings
The Record Type configuration includes settings to enable or disable data export capabilities for end users.
ACA Security & Governance 2
In Appian, which environment tier is intended exclusively for final user acceptance testing before production release?