Archer-Expert Archer Certified Administrator-Expert Question and Answers

The Archer Job Monitor is a dedicated administrative interface found within the "Administration" workspace. It is the primary dashboard for monitoring the health of the Archer Job Engine . According to the curriculum, the Job Monitor provides visibility into both scheduled and ad-hoc background tasks, including Data Feeds, Data Publication, Notifications, and Recalculations.

The report displays a chronological list of jobs, their current status (Queued, In Progress, Completed, or Failed), and their start/end times. This is the first place an administrator looks if a notification wasn't sent or a data feed didn't update. Unlike "User access logs" (which track logins) or "System performance metrics" (which are found in the ACP or IIS), the Job Monitor is focused strictly on the execution history of background system tasks, allowing administrators to identify bottlenecks or specific job failures without needing access to the server's event logs.

In the Archer architecture, search operations—particularly Global Search and Indexing —are handled by the Search service, which operates under the broader Job Framework . According to the Archer Installation and Troubleshooting guide, when a user executes a search that is technically "valid" (meaning the syntax is correct) but fails to return expected results or fails during execution, the details are captured in the Job Framework log files .

These logs provide insight into how the Search service is interacting with the Lucene indexes. If the index is corrupt or if the search query is timing out, the Job Framework logs (usually found in the \Logs directory on the Services server) will contain the specific stack traces or warnings. The Configuration Service (Option A) only logs system-level startup and ACP connectivity, and the Data Feed Service (Option D) is irrelevant to UI search queries. Reviewing the Job Framework logs is the standard first step for administrators when users report that "search isn't working" despite records clearly existing in the system.

Actions by E-mail (ABE) is a feature designed to allow executives and busy stakeholders to progress a workflow without logging into the Archer UI. According to the Advanced Workflow Beyond the Basics course, ABE notifications include specific "action buttons" (e.g., Approve, Reject, Needs More Info).

When a user clicks a button, a new email is generated with a unique encoded string. If the user types a message in that reply email, the Archer Mail Processing Service parses the response. It not only moves the record to the next node based on the button clicked but also captures any text the user typed and appends it to the Workflow Action History (or a designated "Comments") field. This ensures that the rationale for the decision is audited within the record. Option A is incomplete because it ignores the comment-capturing capability, and Option C is incorrect because ABE does not support complex UI elements like drop-down menus within the email client.

In Archer, the LDAP Synchronization process is a comprehensive identity management tool. According to the Archer Administration II curriculum, its primary purpose is to ensure that the Archer user database mirrors the corporate directory (Active Directory/LDAP). It is not limited to just creating accounts or linking groups; its most critical function is the automation of the user lifecycle .

When the sync runs, it checks for changes in the LDAP source. If a user’s department or email changes in Active Directory, Archer updates the user profile data accordingly. Most importantly for security, if a user is disabled or removed from the LDAP group/OU being synced, Archer can automatically deactivate the account (or move it to a "terminated" status) based on the "Missing Person" configuration in the LDAP setup. This prevents unauthorized access by former employees. Options C and D are "Only" statements that describe small portions of the tool's capability, whereas Option B captures the ongoing maintenance and security synchronization that is the hallmark of the Archer LDAP service.

The primary driver for Single Sign-On (SSO) in an Archer environment is user convenience and centralized identity management. As taught in Archer Administration II , the "goal" of SSO is to reduce the friction of accessing the platform. By allowing users to leverage their existing corporate credentials (via SAML, Windows Integrated, or LDAP), they can access Archer without needing to maintain a separate, "native" Archer password.

This strategy improves security by centralizing credential management in a single Identity Provider (IdP), where Multi-Factor Authentication (MFA) and account revocation policies can be strictly enforced. Option A is incorrect because SSO actually helps enforce enterprise security parameters rather than bypassing them. Option B is false because SSO is intended for all users, not just admins. Option C describes the opposite of SSO. Ultimately, the successful implementation of SSO ensures that users have a seamless transition into Archer while the organization maintains a high standard of access control.

In the Advanced Workflow Beyond the Basics curriculum, administrators are taught how to manage "faulted" or "stuck" workflow jobs using the Advanced Workflow Job Troubleshooting Tool . When a record hits a snag—for example, if a Notification Node fails because of a mail server timeout or a Evaluate Content Node fails due to a missing field value—the job may stop at that specific node.

The Reset option is the specific administrative action used to re-trigger a node. Selecting "Reset" clears the error state of the current node and attempts to execute it again. This is distinct from Restart (Option C), which would typically send the record back to the very beginning of the entire workflow process, potentially duplicating previous steps. Update Job (Option A) is generally used to apply workflow version changes to an active record, and Cancel (Option D) terminates the workflow entirely. For a pinpointed "retry" of a specific failure point, "Reset" is the verified functional command within the troubleshooting utility.

Here are the verified answers and detailed explanations for Questions 8 through 11, strictly aligned with the Archer Administration II and Advanced Workflow Beyond the Basics curriculum standards.

The Archer Packaging API is a component of the modern RESTful API suite. As organizations move toward DevOps and automated deployment models, the ability to programmatically create and export Archer packages (the containers used to move applications between Dev, Test, and Production) has become essential.

According to the Archer Administration II curriculum, the RESTful API provides endpoints specifically for the Packaging Service . This allows administrators to write scripts that automatically bundle application changes into a .zip package without manually navigating the "Packaging" menu in the Archer UI. The SOAP API (Option B) is primarily focused on record data and search services and does not have comprehensive packaging capabilities. The Content API (Option C) is strictly for record-level content (CRUD operations) and does not interact with the system's metadata packaging engine. Therefore, the RESTful API is the correct tool for automating the "Package Creation" workflow.

While you initiate a manual import from the Data Imports menu (Option C), the actual execution and processing details of that task are monitored through the Job Queue . According to the Archer Administration II curriculum, once a user clicks "Import," the task is handed off to the Job Engine.

To see if the import was successful, how many rows were processed, or if any errors occurred, the administrator must navigate to Integration > Review Job Queues . This interface provides the granular details of the "Job Status," including start/end times and the specific results of the processing. This is consistent with how Archer handles all background tasks (Feeds, Recalculations, etc.). The "Data Imports" screen itself primarily serves as the portal for uploading the file and mapping fields, whereas "Review Job Queues" is the operational dashboard for tracking the actual work performed by the Archer services.

In a standard corporate environment where users are already logged into a Windows Domain, Windows Integrated SSO (WIA) is considered the "easiest" and most seamless method. According to the Archer installation guides, WIA utilizes the NTLM or Kerberos protocols already built into the Windows OS and Internet Information Services (IIS).

Because the web server and the user's workstation share a common trust via Active Directory, the user is authenticated automatically without needing to provide credentials or interact with a third-party identity provider (IdP). While Federated SSO (Option C), like SAML, is more robust for cloud or multi-platform environments, it requires significantly more configuration, including certificate exchanges and metadata mapping. Token Based SSO (Option B) often requires custom coding or specialized header injection. For a pure Windows-based internal environment, Windows Integrated SSO provides the most "out-of-the-box" experience for both the administrator and the end-user.

The Mail Merge functionality in Archer allows administrators to take record data and push it into a pre-formatted Word or PDF template. This is a common requirement for generating formal "Exception Letters" or "Audit Reports."

As taught in the Archer Administration II curriculum, when a user is viewing a record and wishes to generate one of these documents, they must click the Export button. Upon clicking Export, the user is presented with several options: standard exports (like CSV or Rich Text) and any Mail Merge Templates that have been associated with that specific application and made available to the user's role. Option B (Email) is used for sending on-demand notifications, not for generating formatted document templates based on Word/PDF layouts.

According to the Advanced Workflow Beyond the Basics curriculum, the safest administrative practice when modifying an active workflow is to briefly deactivate it. When you deactivate the workflow, you prevent new records from entering a potentially "in-flux" process while you are saving new versions.

Once the changes are finalized and the new version is saved, reactivating the workflow allows the system to initialize the new logic. It is important to note that reactivating the workflow does not automatically update existing records (as discussed in previous questions regarding Bulk Update Jobs), but it ensures that the transition between versions is "clean." Option D is often impossible in a production environment with thousands of active records. Option B is factually incorrect as records do not return to the Start node; they stay exactly where they were in their specific version. Deactivating ensures that the Advanced Workflow Service doesn't attempt to process a record against a design that is currently being overwritten or modified by the administrator.

While Archer has been aggressively moving toward the RESTful API (Option C) for modern integrations, the ability to execute an existing Archer Report and retrieve the results has historically been a core function of the SOAP API (Web Services). Specifically, the SearchSvc (Search Service) within the SOAP API includes the ExecuteSearch and SearchRecordsByReport methods.

According to the Archer Administration II technical integration documents, the RESTful API is primarily designed for CRUD operations (Create, Read, Update, Delete) on individual records and metadata. While newer versions of the REST API are expanding, the legacy SOAP Web Services remain the primary, verified method for triggering a pre-defined "Saved Report" via an external call. The Content API (Option D) is a subset of the RESTful API focused on record data but lacks the high-level report execution engine found in the SOAP services.

In the Archer security model, record-level access is determined by the complex intersection of Access Roles , Groups , and Record Permission Fields . According to the Archer Administration II curriculum, the Investigate Access tool is the primary diagnostic utility for troubleshooting "Why can't User X see Record Y?"

Unlike standard reports, Investigate Access allows an administrator to select a specific user and a specific record (or application) and run a simulation. The tool then provides a detailed breakdown of the "Final Access" (Read, Update, Delete) and, crucially, explains how that access was derived. It will highlight if the user is being granted access via a specific Group, if a Record Permission field is restricting them, or if their Access Role lacks the necessary rights. This is more efficient than the Access Control Reports (Option C), which provide a broad overview of permissions but do not provide the record-specific context that "Investigate Access" offers for pinpoint troubleshooting.

Archer's Advanced Search provides sophisticated control over how data is returned to the user. Within the search configuration tabs, there is a section dedicated to Result Limits . As detailed in the Archer Administration II search module, this feature is essential for optimizing performance and creating specific types of reports (like "Top 10" or "Bottom 5%").

The administrator has the flexibility to limit the results in two ways:

Fixed Number: For example, "Show only the first 50 records."

Percentage: For example, "Show only the top 10% of records."

This is often combined with sorting; if you sort by "Risk Score" descending and limit the results to the top 10 records, you have successfully created a "Top 10 Risks" report. These limits are applied after the filters have narrowed down the dataset but before the data is rendered in the UI or exported. This dual-capability ensures that administrators can build reports that meet precise business requirements, whether they are based on a specific count or a statistical distribution.

The Archer Web Services Transporter is used for "Archer-to-Archer" data feeds. For the "Load Fields" button to work, Archer must be able to successfully authenticate and connect to the source instance's API to retrieve the report metadata.

As detailed in the Archer Administration II Data Feed module, if no fields appear, it almost always indicates a communication failure between the Feed Manager and the Web Service. The Transport Configuration section (found on the Source Connection tab) contains the critical connection details: the Base URL, the Instance Name, and the User Credentials. If the credentials are incorrect, the URL is mistyped, or the "Session Token" cannot be generated, Archer cannot "see" the source report's structure, and thus the field list will remain empty. Checking the connection settings is the primary troubleshooting step before looking at filters or target mappings.

In the Advanced Workflow Beyond the Basics curriculum, the Wait for Content Update node is identified as the primary tool for time-based automation. While its name suggests it is waiting for a user to change a field, its secondary function is to act as a SLA (Service Level Agreement) timer .

Within the node configuration, an administrator can define an "Escalation" or "Timeout" path. You can set a specific duration (e.g., 5 days). If the expected content update does not occur within that timeframe, the node "times out" and automatically reroutes the record down a secondary transition path—typically to a manager's review or an automated notification. While a User Action node (Option B) can have a "due date," it does not automatically move the record to a different path solely based on time without the Wait for Content Update node logic. Update Content (Option D) and Send Notification (Option A) nodes are instantaneous actions and do not possess the ability to "pause" and monitor for duration.

This question reinforces a critical security concept in Archer Administration II . LDAP Synchronization is not just a "one-time" user creation tool; it is a lifecycle management service. While it does create accounts and associate groups, its most vital ongoing function is the synchronization of state .

If a user's title changes in Active Directory, the next LDAP sync will update that title in Archer, ensuring that reports and workflows based on user attributes remain accurate. Furthermore, if a user is removed from the corporate directory, the LDAP sync identifies them as a "Missing Person" based on the administrator's configuration and can automatically deactivate the Archer account. This automated deactivation is a core compliance requirement for most organizations to ensure that terminated employees lose access to sensitive GRC data immediately. Options A and C are incorrect because they use the word "Only," which ignores the broader, dynamic maintenance capabilities of the service.

Scheduled Report Distributions behave differently than standard "On-Demand" reports. According to the Archer Administration II curriculum, when a report is scheduled for distribution (e.g., emailed as a PDF or Excel file), the Archer platform must "impersonate" a user to run the query and generate the file.

The platform uses the security context of the user who configured the Scheduled Report Distribution (typically an administrator). This means that all recipients of the email will see the exact same data—the data that the administrator is authorized to see. This is a critical security consideration: if an administrator has "System Administrator" rights and schedules a report for a group of low-privilege users, those users may see sensitive data in the attachment that they would not be able to see if they logged into Archer directly. Option B is incorrect because the system does not run a separate query for every individual recipient's unique permissions at the time of the email burst.