OKTA Industry Best Practices 5

Question 1

What is the best practice for where identity system logs should be sent for long-term monitoring and correlation?

Accepted Answer

Streamed to a SIEM for centralized analysis and alerting

Answer

Forwarding logs to a SIEM enables correlation with other sources, retention, and automated alerting.

Question 2

Which adaptive access signal is commonly used to step up authentication requirements?

Accepted Answer

A login from a new device or unusual location

Answer

Risk-based policies evaluate context such as new device, geolocation, or IP reputation to require stronger verification.

Question 3

Which statement best describes the role of device trust in access policies?

Accepted Answer

Only managed or compliant devices may access sensitive applications

Answer

Device trust adds a device-posture check so sensitive apps are reached only from managed, compliant endpoints.

Question 4

What is the recommended way to store API tokens used for integrations with an identity platform?

Accepted Answer

In a secrets manager with restricted access and periodic rotation

Answer

Secrets managers protect tokens with access controls, auditing, and rotation, avoiding exposure in code repositories.

Question 5

When designing self-service password reset, which practice is most secure?

Accepted Answer

Require a strong verified factor such as an authenticator app before reset

Answer

Requiring a strong factor prevents attackers from abusing recovery as a weaker path into the account.

OKTA - OKTA Certified Professional Practice Test