Analytics-Admn-201 Salesforce Certified Tableau Server Administrator Question and Answers

Tableau Server’s performance and stability depend on dedicated resources and proper configuration. Running additional software on the same server is the most likely to cause problems because:

Resource contention: Tableau Server requires significant CPU, RAM, and disk I/O. Other software (e.g., databases, web servers) can compete for these resources, leading to slowdowns, crashes, or failed tasks.

Port conflicts: Tableau uses specific ports (e.g., 80, 443, 8850), and other applications might interfere.

Security risks: Additional software increases the attack surface, potentially compromising Tableau Server.

Tableau recommends running the server on dedicated hardware without unrelated applications.

Option A (Running additional software on the server): Correct. This is a common cause of performance issues and is explicitly discouraged in Tableau’s best practices.

Option B (Separating the Backgrounder and VizQL processes to different machines): Incorrect. This is a supported multi-node configuration that can improve performance, not cause problems, if properly set up via TSM.

Option C (Configuring the server to use a static IP address): Incorrect. A static IP is recommended for Tableau Server to ensure consistent network access, so it’s unlikely to cause issues.

Option D (Using a non-default installation path): Incorrect. While not default, a custom path is supported (via TSM or installer options) and unlikely to cause problems if permissions and disk space are adequate.

In Tableau Server, schedules manage tasks like extract refreshes and subscriptions. Each task within a schedule has a priority value (ranging from 1 to 100, where 1 is the highest priority and 100 is the lowest). Tasks with higher priority (lower numbers) are executed before tasks with lower priority (higher numbers) when queued by the Backgrounder process. If the Backgrounder is overloaded or delayed, lower-priority tasks may not complete on time, leading to inconsistent refreshes.

In this scenario:

The 7:00 AM Extract Refresh task is critical for the CEO’s workbook, but the data is only refreshed 70% of the time by 9:00 AM.

The server has a single node, meaning a single Backgrounder process handles all tasks. With five schedules (some overlapping in the early morning), contention or delays could prevent the 7:00 AM task from completing reliably before 9:00 AM.

Option C (Set the priority of this task to 1): Correct. Setting the task priority to 1 ensures it has the highest priority among all queued tasks. This increases the likelihood that the Backgrounder executes it promptly at 7:00 AM, completing the refresh before the CEO accesses the workbook at 9:00 AM. You can adjust task priority in the Tableau Server web interface under Schedules > Tasks > Edit Priority.

Option A (Set the default priority of this schedule to 50): Incorrect. The default priority for schedules is already 50, and this option refers to the schedule’s default, not the specific task. It wouldn’t address the contention issue.

Option B (Set the priority for all other tasks to 50): Incorrect. This keeps all tasks at the default priority (50), leaving the 7:00 AM task without a relative advantage. It doesn’t prioritize the CEO’s task.

Option D (Set the priority of this task to 100): Incorrect. Priority 100 is the lowest, which would deprioritize the task, making the refresh even less reliable.

Tableau Services Manager (TSM) is the administrative tool for managing Tableau Server’s configuration, processes, and topology. To log in to TSM (via the web UI at https:// :8850 or CLI), you need:

TSM administrator credentials: These are distinct from site roles and are set during installation or reset via tsm reset.

Local administrative rights: On Windows, the account used to access TSM must be in the local Administrators group on the initial node, as TSM interacts with system-level services.

In a test cluster, the engineer’s inability to log in suggests they lack either the correct TSM credentials or sufficient OS-level permissions. Since the question focuses on a Windows environment and “initial node,” the most immediate requirement is local administrative rights to run TSM commands or access the UI.

Option C (An account with administrative rights to the computer): Correct. The engineer must use an account in the local Administrators group on the initial node to authenticate to TSM. After that, they’ll need the TSM admin username/password set during installation.

Option A (An account with a Creator site role): Incorrect. Site roles (e.g., Creator) apply to content access within Tableau Server, not TSM administration.

Option B (An account with a Site Administrator role): Incorrect. Site Administrators manage site content, not server-level TSM functions.

Option D (An account for the Tableau Server administrator): Partially correct but incomplete. This likely refers to the TSM admin account, but without local admin rights on the machine, login will fail. Option C is more precise.

Tableau Server’s user-based licensing (Creator, Explorer, Viewer) ties licenses to individual users—let’s determine compatible authentication methods:

User-Based Licensing:

Licenses are assigned per user, tracked by username.

Authentication determines how users log in—must integrate with licensing.

Option A (Local authentication): Correct.

Details: Users are managed in Tableau Server’s internal database—username/password set manually or via import.

Why: Directly ties to user accounts, fully compatible with licensing.

Option C (Trusted authentication): Correct.

Details: Allows external apps to authenticate users via tickets (e.g., /trusted/).

Why: Maps to Tableau usernames, integrating with licensing—common for embedded analytics.

Config: Trusted IPs or credentials set in TSM.

Option D (Active Directory): Correct.

Details: Uses AD for authentication (LDAP or Kerberos)—users sync to Tableau Server.

Why: AD usernames align with licensing—supports SSO and user management.

Config: Enable via tsm authentication active-directory configure.

Option B (Reliance authentication): Incorrect.

Why: Not a recognized Tableau authentication method—likely a typo (e.g., for "Resilience" or misheard term). No such feature exists.

Why This Matters: Authentication flexibility ensures user-based licensing fits diverse IT environments—critical for adoption.

Tableau Server supports multi-tenancy via sites, each with customizable settings managed by server or site administrators. Let’s analyze what’s configurable per site:

Site Settings: Found in the web UI under Site > Settings > General. Server admins can override site admin settings.

Option B (Limitation on storage space): Correct.

Details: Server admins can set a storage quota per site (e.g., 100 GB) to cap disk usage for extracts and workbooks.

How: In TSM or site settings (if enabled)—e.g., tsm configuration set -k site.storage.quota -v 100000.

Impact: Prevents one site from monopolizing resources in multi-site deployments.

Option D (Language and locale): Correct.

Details: Each site can set its language (e.g., English, French) and locale (e.g., date/number formats).

How: Site settings UI—e.g., "Language: French, Locale: France."

Impact: Tailors the user experience per site’s audience.

Option A (Ability to embed credentials): Incorrect.

Details: Embedding credentials (e.g., in data sources) is a server-wide setting (tsm data-access), not per-site. Site admins can’t override it.

Option C (Limitation on number of users): Incorrect.

Details: User limits are tied to licenses (server-wide), not configurable per site. Site admins manage user assignments, not quotas.

Why This Matters: Site-specific settings enable tailored governance and resource allocation in multi-tenant environments.

Subscriptions in Tableau Server deliver workbook views to users via email on a schedule. Group subscriptions apply to all group members—let’s unpack this:

Group Subscription Mechanics:

Created via Workbooks > Actions > Subscribe > Select Group.

Delivers content to all users in the group at the time the subscription runs (e.g., daily PDF).

Dynamic: Membership updates (additions/removals) are reflected automatically on the next run.

Option C (The subscription updates automatically to include the new user): Correct.

Details: When you add a user to the group (e.g., via Users > Groups > Add Users), Tableau Server’s subscription process queries the group’s current membership at runtime. The new user receives the subscription on the next scheduled delivery—no manual action needed.

Example: Group "Sales" has a 9 AM subscription. Add a user at 8 AM—they get the email tomorrow at 9 AM.

Option A (Admin receives notice to approve/deny): Incorrect.

Why: No approval workflow exists for group membership changes in subscriptions—it’s automatic.

Option B (Creator must manually edit): Incorrect.

Why: Subscriptions are tied to the group, not a static user list—manual edits aren’t required for membership changes.

Option D (Only members at creation time): Incorrect.

Why: This would be true for individual subscriptions (static list), but group subscriptions are dynamic.

Why This Matters: Dynamic group subscriptions streamline content delivery as teams evolve, reducing admin overhead.

Tableau Server supports multiple authentication methods, including Local Authentication, Active Directory, Kerberos, SAML, and OpenID Connect. OpenID Connect (OIDC) is an identity layer built on OAuth 2.0, commonly used for single sign-on (SSO). In Tableau Server, OIDC is implemented as a variant of SAML (Security Assertion Markup Language) authentication because both are SSO protocols managed through the same configuration workflow.

To use OpenID Connect:

Configure Tableau Server for SAML/SSO.

Provide an OIDC-compatible identity provider (IdP) configuration (e.g., Google, Okta).

Set up the IdP metadata and certificates in TSM.

Option D (SAML): Correct. Tableau Server treats OIDC as a subset of its SAML authentication framework, so you configure it under the SAML settings in TSM.

Option A (Local Authentication): Incorrect. Local Authentication uses Tableau’s internal user database, not an external SSO protocol like OIDC.

Option B (Kerberos): Incorrect. Kerberos is a network authentication protocol for Windows environments, unrelated to OIDC.

Option C (Active Directory): Incorrect. AD uses LDAP or Kerberos, not OIDC, for authentication.

TSM commands manage Tableau Server maintenance—let’s validate their syntax:

Command Requirements:

Some need arguments (e.g., file paths); others are standalone.

Valid and Complete: Must work as-is without errors.

Option C (tsm maintenance cleanup): Correct.

Details: Removes temporary files and old logs—no arguments required (optional flags like -l exist).

Use: tsm maintenance cleanup—runs fully.

Option D (tsm maintenance ziplogs): Correct.

Details: Creates a zip of logs (e.g., tsm-logs.zip)—no arguments needed (optional -d for date range).

Use: tsm maintenance ziplogs—complete and valid.

Option A (tsm maintenance backup): Incorrect.

Why: Requires -f .tsbak (e.g., tsm maintenance backup -f backup.tsbak)—incomplete without it.

Option B (tsm maintenance restore): Incorrect.

Why: Needs -f .tsbak (e.g., tsm maintenance restore -f backup.tsbak)—not standalone.

Why This Matters: Correct syntax ensures maintenance tasks execute without errors—critical for server health.

The Backgrounder process in Tableau Server handles tasks like extract refreshes and subscriptions—let’s explore its concurrency:

Backgrounder Behavior:

Each instance is single-threaded for task execution—one task at a time per Backgrounder.

Multiple Backgrounders (e.g., in multi-node setups) increase parallelism, but a single Backgrounder is limited to 1 concurrent task.

Queue: Additional tasks wait in the queue, prioritized by their priority (1–100).

Option A (One): Correct.

Details: A single Backgrounder executes one task (e.g., an extract refresh) until completion before starting the next.

Config: Add more Backgrounders via TSM (tsm topology set-process -n node1 -pr backgrounder -c 2) for more concurrency.

Option B (Two): Incorrect.

Why: Not natively supported—a single Backgrounder doesn’t multi-thread tasks.

Option C (Three): Incorrect.

Why: Exceeds the single-threaded design.

Option D (Unlimited): Incorrect.

Why: Concurrency is fixed at 1 per instance—resources affect queue processing speed, not simultaneous tasks.

Why This Matters: Understanding Backgrounder limits guides scaling—more instances mean more parallel tasks, critical for heavy workloads.

Tableau Server is designed for production environments and is supported only on server-class operating systems, not desktop operating systems. As of the latest documentation (aligned with knowledge up to March 21, 2025), the supported operating systems for Tableau Server on Windows are:

Windows Server 2016

Windows Server 2019

Windows Server 2022 (added in later versions, but relevant as of 2025).

Desktop operating systems like Windows 7 or Windows 10 are not supported for production installations due to stability, security, and performance requirements.

Option A (Windows 7): Incorrect. Windows 7 is a desktop OS and is not supported for Tableau Server. It’s also end-of-life as of January 2020.

Option B (Windows 10): Incorrect. Windows 10 is a desktop OS and not supported for production Tableau Server deployments, though it may be used for testing in non-production scenarios.

Option C (Windows Server 2019): Correct. This is a supported server OS for Tableau Server.

Option D (Windows Server 2016): Correct. This is also a supported server OS for Tableau Server.

Tableau Server relies on several processes to function, each with a specific role. The Repository process (powered by PostgreSQL) serves as the database for metadata, storing critical information such as:

User and group details.

Permissions and site configurations.

Workbook and data source metadata (e.g., schedules, subscriptions).

Option B (Repository): Correct. The Repository is the centralized database that holds all metadata, making it the backbone of Tableau Server’s content management. There are typically two instances in an HA setup (one active, one passive), monitored by the Cluster Controller.

Option A (Data Engine): Incorrect. The Data Engine manages in-memory data processing and extract storage (e.g., .hyper files), not metadata. It’s separate from the Repository.

Option C (Backgrounder): Incorrect. The Backgrounder handles background tasks like extract refreshes and subscriptions, but it doesn’t store metadata—it interacts with the Repository to retrieve task details.

Option D (File Store): Incorrect. The File Store manages physical extract files and workbook assets, not metadata, which is stored in the Repository.

When Tableau Server uses Active Directory (AD) for authentication, group synchronization imports AD groups and assigns a minimum site role (e.g., Viewer, Explorer) to users in that group. This ensures users meet a baseline access level. The behavior for existing users during sync is:

If the user’s current site role provides more access than the minimum (e.g., Explorer vs. Viewer), their role remains unchanged.

If the user’s current role provides less access than the minimum (e.g., Unlicensed vs. Viewer), their role is upgraded to the minimum.

This preserves higher privileges while enforcing a floor. “Reduces access” means the minimum role is lower than the current role (e.g., Viewer vs. Explorer), in which case the existing role stays.

Option A (It will change to the minimum site role only if the minimum site role reduces access): Correct. The user’s role changes only if the minimum increases access (e.g., Unlicensed to Viewer); otherwise, it stays higher.

Option B (It will change only if the minimum provides more access): Incorrect wording. This is the inverse of the actual behavior—change occurs when needed to meet the minimum, not to exceed it.

Option C (It will always change): Incorrect. Existing higher roles are preserved.

Option D (It will never change): Incorrect. It changes if the current role is below the minimum.

Single Sign-On (SSO) allows users to authenticate once (e.g., via a corporate identity provider) and access Tableau Server without re-entering credentials. Tableau Server supports several SSO methods:

OpenID Connect (OIDC): An OAuth 2.0-based protocol for SSO, configured via Tableau’s SAML settings with an OIDC-compatible IdP (e.g., Google, Okta).

Kerberos with Active Directory: A ticket-based SSO protocol, widely used in Windows environments with AD integration.

SAML: A flexible SSO standard using XML assertions, supporting various IdPs (e.g., ADFS, PingFederate).

Let’s evaluate:

Option A (OpenID Connect): Correct. OIDC is an SSO method, implemented as a SAML variant in Tableau Server, enabling seamless login.

Option C (Kerberos with Active Directory): Correct. Kerberos provides SSO in AD environments, delegating authentication to the domain controller.

Option D (Security Assertion Markup Language - SAML): Correct. SAML is a core SSO method in Tableau, widely adopted for enterprise integrations.

Option B (Local Authentication): Incorrect. Local Authentication uses Tableau’s internal user database, requiring manual credential entry—no SSO support.

Why This Matters: SSO enhances user experience and security by leveraging existing identity systems, reducing password fatigue.