OKTA OKTA Reporting, Troubleshooting and Administration 2 — Questions and Answers
Question 1: A user reports they cannot access an app via SSO. After verifying the user is assigned to the app, what should the admin check next?
- Whether the app's SSL certificate is expired
- Whether the Sign-On Policy allows the user's authentication context (Correct answer)
- Whether the RADIUS server is reachable
- Whether the Universal Directory is synchronized with Active Directory
Correct answer: Whether the Sign-On Policy allows the user's authentication context
After confirming app assignment, the admin should review the app's Sign-On Policy to ensure the user's authentication context (e.g., MFA level, network zone) satisfies the policy rules.
Question 2: What does the 'User not assigned' error typically indicate when a user tries to access an Okta-integrated application?
- The user's password has expired in Okta
- The user or a group containing the user has not been assigned to the application in Okta (Correct answer)
- The application's SAML certificate has expired
- The user's MFA device is not enrolled
Correct answer: The user or a group containing the user has not been assigned to the application in Okta
'User not assigned' means the user does not have a direct assignment or group-based assignment to the application in Okta.
Question 3: Which Okta Admin Console section allows administrators to view and manage all active user sessions across the tenant?
- Directory > People > Active Sessions
- Reports > User Sessions
- Security > Active Sessions
- There is no built-in active session viewer; use the System Log (Correct answer)
Correct answer: There is no built-in active session viewer; use the System Log
Okta does not provide a real-time global active sessions dashboard; administrators must query the System Log for authentication events or use the API to inspect individual user sessions.
Question 4: An admin needs to force all users to re-authenticate immediately due to a suspected breach. What is the fastest way to accomplish this?
- Reset all user passwords from the Admin Console
- Revoke all active sessions globally via the API or per-user 'Clear Sessions' action (Correct answer)
- Disable and re-enable each application
- Change the Okta org URL to invalidate cookies
Correct answer: Revoke all active sessions globally via the API or per-user 'Clear Sessions' action
Using the Okta API's session revocation endpoint (or the per-user 'Clear Sessions' action) immediately invalidates all active sessions, forcing users to re-authenticate.
Question 5: When troubleshooting a SAML SSO failure, which Okta tool can help decode and inspect the SAML assertion being sent to the service provider?
- Okta System Log SAML assertion viewer
- Browser developer tools with a SAML tracer extension (Correct answer)
- Okta Identity Engine debugger
- Okta Verify diagnostic mode
Correct answer: Browser developer tools with a SAML tracer extension
A browser-based SAML tracer extension (e.g., SAML-tracer for Firefox/Chrome) captures and decodes SAML requests and responses, making it the standard tool for diagnosing SSO failures.
Question 6: What is the purpose of the 'Health Insight' feature in the Okta Admin Console?
- To monitor Okta's infrastructure uptime and SLA metrics
- To provide proactive recommendations for improving security posture and configuration best practices (Correct answer)
- To display real-time CPU and memory usage of the Okta tenant
- To alert on upcoming SSL certificate expirations for integrated apps
Correct answer: To provide proactive recommendations for improving security posture and configuration best practices
Health Insight analyzes the Okta tenant's configuration and provides actionable recommendations to address security gaps and align with best practices.
OKTA OKTA Reporting, Troubleshooting and Administration 2
A user reports they cannot access an app via SSO.
After verifying the user is assigned to the app, what should the admin check next?