CPSA CPSA Security and Access Control 2 — Questions and Answers
Question 1: In Pega, which authentication mechanism allows users to log in using credentials from an external identity provider without re-entering passwords?
- OAuth 2.0 / SAML-based SSO (Correct answer)
- Basic Auth
- Kerberos Ticket Relay
- LDAP Bind
Correct answer: OAuth 2.0 / SAML-based SSO
Pega supports SAML and OAuth 2.0 for Single Sign-On, allowing users to authenticate via an external identity provider.
Question 2: What is the function of the 'Privilege' rule in Pega's security model?
- It defines a specific allowed action that can be granted or denied to a role (Correct answer)
- It encrypts case data at rest
- It logs operator activity for compliance
- It controls session timeout duration
Correct answer: It defines a specific allowed action that can be granted or denied to a role
Privileges are named permissions (e.g., 'CanApprove', 'CanDelete') that are granted or denied within access roles to control what actions a user may perform.
Question 3: Which Pega feature should be used to automatically lock an operator account after a configurable number of failed login attempts?
- Security Policy rule (Correct answer)
- Operator Access Group
- Authentication Profile
- Declarative rule
Correct answer: Security Policy rule
The Security Policy rule in Pega defines lockout thresholds, password complexity requirements, and session timeout settings for operators.
Question 4: In Pega, 'personas' defined during the application design phase map to which runtime security construct?
- Access Groups (Correct answer)
- Data Pages
- Rulesets
- SLA Rules
Correct answer: Access Groups
Personas identified in the App Studio design phase are implemented as Access Groups, defining what each type of user can access and do.
Question 5: What is the purpose of the 'Restrict screen to' feature available on Pega sections and forms?
- To limit which screen resolution can render the form
- To display the section only to operators with a specified privilege or access group (Correct answer)
- To restrict the number of fields displayed on mobile
- To lock the section during SLA escalation
Correct answer: To display the section only to operators with a specified privilege or access group
The 'Restrict screen to' setting on a Pega section or harness hides the entire UI component from operators who do not have the specified privilege.
Question 6: When configuring a Pega application for multi-tenancy, which approach isolates one tenant's data from another?
- Separate operator IDs
- Organizational hierarchy with Node-level isolation
- Access Control Policies scoped to organization/division/unit (Correct answer)
- Separate Pega installations per tenant
Correct answer: Access Control Policies scoped to organization/division/unit
Pega's Org/Div/Unit hierarchy combined with Access Control Policies allows data to be segmented so each tenant only sees their own records.
CPSA CPSA Security and Access Control 2
In Pega, which authentication mechanism allows users to log in using credentials from an external identity provider without re-entering passwords?