Analytics-Admn-201 Salesforce Certified Tableau Server Administrator Question and Answers

Installing Tableau Server on Windows requires an account with sufficient privileges to configure services, write to the file system, and manage registry settings. Let’s analyze this in depth:

Installation Requirements:

The installer creates services (e.g., Tableau Server Gateway), writes to Program Files and ProgramData, and configures TSM.

It needs local administrative privileges on the machine to perform these tasks.

Post-install, a "Run As" account can be set for services (e.g., NT AUTHORITY\NetworkService), but this is separate from the install account.

Option C (An account in the local administrator group): Correct.

Why: The account must be in the local Administrators group to:

Install software (UAC elevation).

Configure services and ports.

Write to protected directories (e.g., C:\Program Files\Tableau).

Examples: A local admin (e.g., Administrator) or a domain user added to the Administrators group (e.g., DOMAIN\AdminUser).

Process: Log in as this account, run the installer, and provide TSM admin credentials during setup.

Option A (A local user account): Incorrect.

A standard local user (not in Administrators) lacks permissions—installation would fail with "Access Denied" errors.

Option B (A domain user account): Incorrect unless clarified.

A domain user without local admin rights can’t install. If it’s in the Administrators group, it qualifies, but C is more specific.

Option D (NT AUTHORITY\NetworkService): Incorrect.

This is a built-in service account for running services (default "Run As" post-install), not for executing the installer—an interactive user account is required.

Why This Matters: Using the right account prevents install failures and ensures secure configuration—critical for production setups.

Kerberos delegation allows Tableau Server to pass a user’s Kerberos credentials to a data source for seamless authentication (SSO)—let’s explore which sources support it:

Kerberos Overview:

Used with Active Directory (AD) for SSO in Windows environments.

Tableau Server delegates the user’s ticket to the data source, avoiding embedded credentials.

Requires:

Data source support for Kerberos.

Proper configuration (e.g., SPN, constrained delegation).

Supported Data Sources: Per Tableau’s documentation:

Option A (Teradata): Correct.

Details: Supports Kerberos delegation—common in enterprise data warehouses.

Config: Enable in TSM (tsm authentication kerberos configure) and set SPN for Teradata.

Option C (SQL Server): Correct.

Details: Fully supports Kerberos—widely used with AD-integrated SQL Server instances.

Config: Requires AD setup and "Trustworthy" delegation in SQL Server.

Option D (SAP HANA): Correct.

Details: Supports Kerberos SSO via delegation—popular in SAP ecosystems.

Config: Needs HANA Kerberos setup (e.g., keytab) and Tableau Server integration.

Option B (PostgreSQL): Incorrect.

Why: Supports Kerberos authentication natively, but Tableau Server doesn’t enable delegation to PostgreSQL—users must embed credentials or use other methods (e.g., OAuth).

Why This Matters: Kerberos delegation enhances security by avoiding stored passwords—knowing supported sources ensures SSO feasibility.

The VizQL Server process in Tableau Server handles rendering visualizations and processing queries for users viewing dashboards or workbooks. During installation, Tableau Server automatically configures the number of VizQL instances based on the number of processor cores on the machine, following this rule:

Default VizQL instances = 2 per node, unless manually adjusted post-installation.

In multi-node setups, additional instances may be added based on core count, but the question specifies a single server with 16 cores.

The installer does not scale VizQL instances linearly with core count by default (e.g., it doesn’t set 1 instance per 4 cores). Instead:

For a single-node installation, the default is 2 VizQL instances, regardless of core count (assuming the minimum hardware requirements are met: 8 cores, 32 GB RAM).

Administrators can later adjust this using TSM (e.g., tsm topology set-process) based on performance needs, but the question asks for the default configured by the installer.

Option A (4): Incorrect. Four instances might be configured manually for a 16-core server, but it’s not the default.

Option B (6): Incorrect. Six instances exceed the default for a single node.

Option C (10): Incorrect. Ten instances are far beyond the default and would require manual configuration.

Option D (2): Correct. The installer sets 2 VizQL instances by default on a single-node installation.

Tableau Server consists of multiple processes managed by TSM. When you stop Tableau Server (e.g., via tsm stop), most application processes halt, but some TSM-specific processes remain active to manage the server’s infrastructure. Let’s examine each:

TSM Processes: These include the Administration Controller, Administration Agent, and License Manager, which handle configuration, monitoring, and licensing.

Application Processes: These include VizQL Server, Backgrounder, Data Server, etc., which deliver Tableau’s core functionality and stop when the server is stopped.

When tsm stop is executed:

The Administration Controller (port 8850) continues running to manage TSM operations (e.g., restarts, status checks).

The License Manager remains active to validate licenses and ensure compliance, even when the server is offline.

Application processes like VizQL Server and Backgrounder shut down, as they’re tied to user-facing services.

Option B (License Manager): Correct. It persists to handle licensing tasks, ensuring the server can restart without license issues.

Option D (Administration Controller): Correct. It’s the core TSM process, always running to accept commands and manage the server state.

Option A (VizQL Server): Incorrect. VizQL stops, as it renders visualizations for users—an application process tied to active server operation.

Option C (Backgrounder): Incorrect. Backgrounder stops, as it processes background tasks (e.g., extract refreshes), which halt when the server is down.

Why This Matters: Understanding which processes persist helps administrators troubleshoot and manage server lifecycle events effectively.

Tableau Server’s installer configures process instances based on hardware and deployment type (single-node vs. multi-node). For a single-node installation with 4 cores, we need to consider the default process topology. Let’s break this down exhaustively:

Key Processes:

Gateway: Handles incoming requests (1 instance).

Application Server (VizPortal): Manages UI and sessions (1 instance).

VizQL Server: Renders visualizations (2 instances).

Backgrounder: Runs extract refreshes, subscriptions (1 instance).

Data Server: Manages data connections (1 instance).

File Store: Stores extracts (1 instance).

Repository: Metadata database (1 instance, active).

Cluster Controller, Cache Server, etc.: Supporting processes (typically 1 each).

Default Configuration:

On a single-node install, Tableau sets 1 instance per process unless specified otherwise, except for VizQL, which defaults to 2.

The installer doesn’t scale instances linearly with cores (e.g., 4 cores ≠ 4 instances). Post-install, TSM can adjust this (e.g., tsm topology set-process), but the question asks for the installed default.

Minimum hardware (8 cores, 32 GB RAM) suggests higher defaults, but 4 cores still triggers a minimal setup.

Option B (1): Correct with Caveat.

Most processes (e.g., Backgrounder, Gateway, Data Server) default to 1 instance on install, regardless of 4 cores.

VizQL defaults to 2, but the question’s phrasing ("each process") implies a general rule. Historically (and per docs), 1 is the baseline for most, with VizQL as the exception.

Interpretation: Assuming "each" means the typical case, 1 fits most processes on a 4-core single-node setup.

Option A (2): Incorrect. Only VizQL defaults to 2; others don’t.

Option C (8): Incorrect. Far exceeds defaults—8 cores might justify more, but not 4.

Option D (4): Incorrect. Not tied to core count by default; manual config would be needed.

Why This Matters: Understanding defaults aids capacity planning—4 cores is below production minimum (8), so performance tuning may be needed post-install.

Registering Tableau Server from the command line involves providing configuration details (e.g., identity store, license) via the tsm register command. Let’s explore this fully:

Registration Process:

Run during initial setup or to update settings (e.g., after changing AD/LDAP config).

Uses a configuration file to pass parameters to TSM.

Command: tsm register --file .

File Format:

Tableau Server uses JSON for configuration files in TSM commands like tsm register.

Example:

json

CollapseWrapCopy

{

"identityStore": {

"type": "local",

"domain": "example.com"

}

}

JSON is structured, machine-readable, and aligns with Tableau’s modern CLI design.

Option C (JSON): Correct.

Official format for tsm register, per documentation and practical use.

Option A (YML): Incorrect.

While tabsvc.yml exists internally, it’s not for registration—tsm register uses JSON.

Option B (XML): Incorrect.

Older Tableau configs used XML (e.g., workgroup.yml pre-TSM), but TSM standardized on JSON.

Option D (HTTP): Incorrect.

HTTP is a protocol, not a file format—irrelevant here.

Why This Matters: Correct file format ensures seamless registration, avoiding CLI errors in setup or migrations.

Tableau Server uses a role-based licensing model with three primary license levels: Creator, Explorer, and Viewer. Each license level corresponds to specific site roles that define what users can do on the server.

Viewer License: This is the most restrictive license, allowing users to view and interact with published content (e.g., dashboards and visualizations) but not to create or publish new content.

Site Role: The Viewer license can only be associated with the Viewer site role. This role restricts users to viewing capabilities, aligning with the license’s purpose.

Option A (Creator): Incorrect. The Creator license is for users who can create, edit, and publish content using Tableau Desktop and the web interface. It corresponds to the Creator site role, not Viewer.

Option B (Explorer (can publish)): Incorrect. This is a variation of the Explorer license, which allows users to edit and publish content within limits. It’s more permissive than Viewer.

Option C (Viewer): Correct. The Viewer site role matches the Viewer license level perfectly.

Option D (Explorer): Incorrect. The Explorer license allows users to explore data and create content in the web interface, exceeding the Viewer license’s capabilities.

When Tableau Server uses Active Directory (AD) for authentication, group synchronization imports AD groups and assigns a minimum site role (e.g., Viewer, Explorer) to users in that group. This ensures users meet a baseline access level. The behavior for existing users during sync is:

If the user’s current site role provides more access than the minimum (e.g., Explorer vs. Viewer), their role remains unchanged.

If the user’s current role provides less access than the minimum (e.g., Unlicensed vs. Viewer), their role is upgraded to the minimum.

This preserves higher privileges while enforcing a floor. “Reduces access” means the minimum role is lower than the current role (e.g., Viewer vs. Explorer), in which case the existing role stays.

Option A (It will change to the minimum site role only if the minimum site role reduces access): Correct. The user’s role changes only if the minimum increases access (e.g., Unlicensed to Viewer); otherwise, it stays higher.

Option B (It will change only if the minimum provides more access): Incorrect wording. This is the inverse of the actual behavior—change occurs when needed to meet the minimum, not to exceed it.

Option C (It will always change): Incorrect. Existing higher roles are preserved.

Option D (It will never change): Incorrect. It changes if the current role is below the minimum.

In a high-availability (HA) Tableau Server setup, the Repository (PostgreSQL) has an active and passive instance. Failover occurs if the active Repository fails. Let’s dive into the process:

HA Setup:

Two Repository instances across nodes (active/passive).

Failover switches to the passive instance if the active one becomes unavailable (e.g., crash, network issue).

Cluster Controller:

Role: Monitors all processes (e.g., Repository, File Store) across nodes, detecting failures via heartbeats and status checks.

Failover Decision: If the active Repository stops responding, Cluster Controller initiates failover, promoting the passive instance to active.

Coordination: Works with Coordination Service (ZooKeeper) to update topology but makes the initial detection call.

Option A (Cluster Controller): Correct.

Why: It’s the watchdog process, constantly monitoring Repository health and triggering failover when needed.

Option B (Coordination Service): Incorrect.

Role: ZooKeeper maintains cluster state and coordinates topology updates post-failover, but doesn’t detect the failure—Cluster Controller does.

Option C (Gateway): Incorrect.

Role: Routes client requests—unrelated to internal process monitoring or failover.

Option D (Backgrounder): Incorrect.

Role: Executes background tasks—no involvement in Repository failover decisions.

Why This Matters: Understanding failover ensures HA reliability—Cluster Controller is the linchpin for resilience.

Tableau Desktop and Tableau Server have versioning considerations when publishing content, particularly regarding compatibility between older Desktop versions (e.g., 10.5) and newer Server versions (e.g., 2020.1). Let’s break this down step-by-step:

Version Context: Tableau Desktop 10.5 was released in 2017 and used the .tde (Tableau Data Extract) format for extracts. Tableau Server 2020.1, released in 2020, introduced the .hyper extract format (starting with version 10.5, but fully standardized later). When publishing from an older Desktop version to a newer Server version, Tableau ensures backward compatibility but may upgrade certain components.

Publishing Process: With a Creator site role and Publisher permissions, you have the rights to publish workbooks to the specified project. Tableau Server accepts workbooks from older Desktop versions (e.g., 10.5) and upgrades them to the current Server version (2020.1) during publishing. This process is seamless for the workbook itself, but extracts require special handling.

Extract Handling: If the workbook contains embedded .tde extracts (stored within the .twb or .twbx file), Tableau Server 2020.1 converts these to .hyper format upon publishing. This conversion is necessary because .hyper replaced .tde as the default extract engine starting in Tableau 10.5 and beyond, offering better performance and scalability. During this process, Tableau Desktop or Server displays a warning to inform the user of the upgrade, as it’s a one-way conversion (you can’t revert to .tde on the Server).

Now, let’s evaluate the options:

Option A (You will successfully publish without any errors or warnings): Incorrect. While the publishing succeeds, a warning about the .tde to .hyper conversion appears if the workbook contains embedded extracts. Without extracts, no warning occurs, but the question’s context implies extracts are likely involved (common in visualizations).

Option B (Error message: unable to publish to a newer version): Incorrect. Tableau supports publishing from older Desktop versions to newer Server versions. There’s no outright error blocking this; compatibility is maintained.

Option C (Warning: embedded .tde extracts will be upgraded to .hyper): Correct. This is the precise warning displayed when a workbook with .tde extracts is published to a Server version that uses .hyper. It ensures the user is aware of the format change, which might affect extract refresh schedules or performance expectations.

Option D (Warning: workbook will be upgraded to a new version): Partially correct but less specific. The workbook is upgraded to 2020.1 compatibility, but the warning focuses on the extract format change (.tde to .hyper), not the workbook version generically. Option C is more accurate.

Why This Matters: The .tde to .hyper shift improves query performance and supports larger datasets, but users need to know about it for planning (e.g., extract refresh schedules might need adjustment). The warning ensures transparency.

The Backgrounder process in Tableau Server handles tasks like extract refreshes and subscriptions—let’s explore its concurrency:

Backgrounder Behavior:

Each instance is single-threaded for task execution—one task at a time per Backgrounder.

Multiple Backgrounders (e.g., in multi-node setups) increase parallelism, but a single Backgrounder is limited to 1 concurrent task.

Queue: Additional tasks wait in the queue, prioritized by their priority (1–100).

Option A (One): Correct.

Details: A single Backgrounder executes one task (e.g., an extract refresh) until completion before starting the next.

Config: Add more Backgrounders via TSM (tsm topology set-process -n node1 -pr backgrounder -c 2) for more concurrency.

Option B (Two): Incorrect.

Why: Not natively supported—a single Backgrounder doesn’t multi-thread tasks.

Option C (Three): Incorrect.

Why: Exceeds the single-threaded design.

Option D (Unlimited): Incorrect.

Why: Concurrency is fixed at 1 per instance—resources affect queue processing speed, not simultaneous tasks.

Why This Matters: Understanding Backgrounder limits guides scaling—more instances mean more parallel tasks, critical for heavy workloads.

In an HA Tableau Server cluster, the Coordination Service (ZooKeeper ensemble) maintains cluster state—let’s find the best way to check it:

Coordination Service:

Runs on multiple nodes (3 or 5 in HA) to ensure quorum and failover.

Status indicates if it’s running and synced—critical for cluster health.

Option C (Run tsm status -v): Correct.

Details: tsm status --verbose lists all processes across nodes, including Coordination Service (e.g., "Coordination Service: RUNNING").

Why Best: Provides detailed, node-specific status in the CLI—e.g., "Node 1: RUNNING, Node 2: RUNNING."

Use: Run on the initial node; -v ensures full output.

Option A (TSM web client Status page): Incorrect.

Why: The TSM UI (Server > Status) shows process counts (e.g., "Coordination Service: 3 instances"), but not detailed per-node status—less granular than CLI.

Option B (tsm maintenance ziplogs): Incorrect.

Why: Generates log archives for troubleshooting, not a real-time status check.

Option D (Tableau Server Status page): Incorrect.

Why: The Server Status page (Server > Status in the web UI) monitors application processes (e.g., VizQL), not TSM’s Coordination Service.

Why This Matters: Coordination Service health ensures HA stability—tsm status -v is the admin’s go-to for precision.

In Tableau Server, projects organize content (workbooks, data sources) and use permissions to control access. "Locking permissions" restricts how permissions are managed within a project—let’s explore this exhaustively:

Permission Management Modes:

Managed by Owner: Default mode. Content owners (e.g., workbook publishers) can set permissions on their items, inheriting project defaults as a starting point.

Locked to the Project: Project-level permissions are enforced, and content owners cannot modify them. This ensures consistency across all items in the project.

How to Lock:

In the Tableau Server web UI:

Go to Content > Projects.

Select a project, click Actions > Permissions.

In the Permissions dialog, change Permissions Management from "Customizable" (Managed by Owner) to "Locked."

Set the desired permissions (e.g., Viewer, Editor) for users/groups, which then apply uniformly to all content.

Via REST API: Use the updateProject endpoint with "permissionsLocked": true.

Option B (You can lock permissions to a project by changing Customizable to Locked): Correct.

Details: This is the precise action in the UI—switching from "Customizable" to "Locked" locks permissions at the project level.

Impact: Owners lose the ability to override permissions on individual workbooks/data sources, enforcing governance.

Example: Set "All Users" to Viewer (Locked)—all content in the project is view-only, regardless of owner intent.

Option A (Locking permissions must be enabled on the Server Settings page): Incorrect.

Why: Locking is a per-project setting, not a server-wide toggle. The Server Settings page (via TSM) controls global configs (e.g., authentication), not project permissions.

Option C (Content permissions are locked by default): Incorrect.

Default: New projects are "Managed by Owner" (Customizable), allowing flexibility unless explicitly locked by an admin.

Option D (By setting the appropriate Project permission role): Incorrect.

Confusion: "Project permission role" isn’t a term—permissions are set via rules (e.g., Viewer, Editor), but locking is a separate action (Customizable → Locked).

Why This Matters: Locking permissions ensures uniform access control, critical for regulated environments or large teams where consistency trumps flexibility.