OKTA OKTA Reporting, Troubleshooting and Administration 1 — Questions and Answers
Question 1: Where in the Okta Admin Console can administrators find a searchable log of all events that occur in the Okta tenant?
- Dashboard > Overview
- Reports > System Log (Correct answer)
- Security > Identity Engine
- Applications > Audit Trail
Correct answer: Reports > System Log
The System Log under Reports records every event in the Okta tenant — authentications, policy changes, provisioning events — and is searchable by event type, actor, and time.
Question 2: What query language does Okta's System Log support for advanced filtering?
- SQL
- SCIM filter syntax
- SCQL
- Okta Expression Language (OEL) filters (Correct answer)
Correct answer: Okta Expression Language (OEL) filters
Okta's System Log supports Okta Expression Language (OEL)-based filter expressions in the search bar, allowing complex queries by event type, actor, target, and more.
Question 3: An Okta admin needs to receive an email alert when a specific event type (e.g., admin privilege granted) occurs. Which feature should they configure?
- Okta ThreatInsight
- Event Hooks (Correct answer)
- Inline Hooks
- System Log Export
Correct answer: Event Hooks
Event Hooks allow Okta to send real-time HTTP POST notifications to an external endpoint when specified event types occur, enabling alerting integrations.
Question 4: What is the default retention period for events in the Okta System Log?
- 7 days
- 30 days
- 90 days (Correct answer)
- 1 year
Correct answer: 90 days
Okta retains System Log events for 90 days by default; organizations needing longer retention should export logs to a SIEM or log management system.
Question 5: Which Okta feature helps detect and respond to suspicious user sign-in behavior based on contextual signals like IP reputation and device?
- Okta ThreatInsight (Correct answer)
- Okta FastPass
- Okta Verify Push
- Okta Workflows
Correct answer: Okta ThreatInsight
Okta ThreatInsight analyzes sign-in context (IP, device, behavior) to identify and block threats such as credential stuffing and brute-force attacks.
Question 6: An administrator wants to export Okta System Log data to a third-party SIEM. What is the recommended approach?
- Manually download CSV exports from the Admin Console daily
- Use Okta's Log Streaming feature (e.g., AWS EventBridge or Splunk Cloud) (Correct answer)
- Enable SCIM export on each application integration
- Configure a RADIUS agent to forward authentication events
Correct answer: Use Okta's Log Streaming feature (e.g., AWS EventBridge or Splunk Cloud)
Okta Log Streaming pushes System Log events in near-real-time to supported SIEM integrations like AWS EventBridge or Splunk Cloud, eliminating manual exports.
OKTA OKTA Reporting, Troubleshooting and Administration 1
Where in the Okta Admin Console can administrators find a searchable log of all events that occur in the Okta tenant?