Free Salesforce Tableau Architect practice questions

Question 1

Northern Trail Outfitters has a tested PowerShell validation script that must run before a CMT migration. An engineer pastes its PowerShell statements directly into the Custom script field, assuming that the field selects PowerShell automatically. Which configuration should the architect recommend?
A. Rename the migration plan to use a .ps1 extension because the plan filename selects the runtime for every custom script.
B. Use Executable with Parameters to invoke the intended PowerShell executable with the validation script arguments.
C. Retain the pasted statements because the Custom script field detects PowerShell syntax and changes its execution engine.
D. Move the PowerShell statements to the post-migration Custom script field because that field uses a different script engine.

Accepted Answer

Correct answer: B. Use Executable with Parameters to invoke the intended PowerShell executable with the validation script arguments.
CMT executes a Custom script as a .cmd file rather than automatically selecting PowerShell from its syntax. Its Executable with Parameters option lets the plan invoke the intended executable and pass the script arguments explicitly. Renaming the migration plan does not choose a different custom-script engine. Moving the same statements to the post-migration field changes timing, not the documented .cmd execution format.

Question 2

Cumulus Financial is configuring browser-based Tableau Server 2024.2 sessions. Policy permits at most eight hours from sign-in and at most 45 minutes without activity, even if the user keeps a view open. Connected-client refresh tokens are outside this change. After confirming long uploads fit the policy, which three settings should the architect apply before applying pending changes? Choose 3 answers.
A. Set wgserver.session.idle_limit to 45 to cap inactivity at 45 minutes.
B. Set wgserver.session.apply_lifetime_limit to true to enforce a session lifetime.
C. Set vizqlserver.querylimit to 28800 to enforce the absolute browser sign-in lifetime.
D. Set wgserver.session.lifetime_limit to 480 to cap the session at eight hours.
E. Set vizqlserver.session.expiry.timeout to 45 to enforce the web sign-in idle limit.

Accepted Answer

Correct answer: A. Set wgserver.session.idle_limit to 45 to cap inactivity at 45 minutes. | B. Set wgserver.session.apply_lifetime_limit to true to enforce a session lifetime. | D. Set wgserver.session.lifetime_limit to 480 to cap the session at eight hours.
The browser sign-in limits use the wgserver session settings, with lifetime and idle values expressed in minutes. Enabling apply_lifetime_limit makes the 480-minute absolute cap effective, while idle_limit supplies the separate 45-minute inactivity cap. VizQL session expiry discards an idle VizQL session rather than configuring the web sign-in limit. The VizQL query limit controls view-update time in seconds, not the absolute lifetime of a browser sign-in.

Question 3

Cloud Kicks has core-based Tableau Server licensing and several Server Administrators. It adds Creator licenses for analysts, but no administrator currently has a Creator role. Before promising that all newly purchased Creator capacity can go to analysts, what should the architect account for?
A. Each analyst must become a Server Administrator before the server can assign that analyst a Creator role.
B. Core-based licensing exempts Server Administrators from role-based licensing when Creator capacity is added.
C. The additional Creator licenses replace the core-based entitlement, so existing Explorer users must be relicensed.
D. Server Administrators consume Creator capacity before Creator roles can be assigned to nonadministrators.

Accepted Answer

Correct answer: D. Server Administrators consume Creator capacity before Creator roles can be assigned to nonadministrators.
When Creator licensing is added, Server Administrators must have Creator roles before Creator roles can be assigned to nonadministrators. Core licensing does not exempt those administrators from the highest available role type. Analysts do not need administrative privileges to receive Creator roles. Creator licenses can supplement core licensing; adding them does not require replacing the existing entitlement or relicensing every Explorer.

Question 4

Universal Containers has configured a SAML identity provider for employees on a Tableau Cloud site. Contractors must use TableauID credentials with MFA instead of that employee provider. How should the architect configure these two populations without creating another site solely for authentication?
A. Set each user to the appropriate authentication type: the configured SAML provider or Tableau with MFA.
B. Assign both authentication types simultaneously to every user so Cloud tries each provider during the same sign-in.
C. Replace contractor accounts with Viewer licenses, because a license role selects the authentication provider automatically.
D. Force the entire site to one provider, because Tableau credentials cannot coexist with configured SAML authentication.

Accepted Answer

Correct answer: A. Set each user to the appropriate authentication type: the configured SAML provider or Tableau with MFA.
A Cloud site can use configured external authentication alongside Tableau credentials, with each user assigned one authentication type. Employees can therefore use the existing SAML provider while contractors use Tableau with MFA. Each user is not configured to try both authentication types simultaneously, and the whole site need not be forced to one type. License roles govern access capabilities rather than automatically selecting an identity provider; this case does not require multiple SAML configurations.

Question 5

Bloomington Caregivers installed Tableau Server on Linux without proxy parameters and must now route its outbound internet traffic through a forward proxy. The server uses the default unprivileged user. Where should the architect place the proxy configuration?
A. In a .conf file under ~tableau/.config/systemd/tableau_server.conf.d, then restart TSM services.
B. In a sudoers file for the tableau user so the TSM services can read proxy variables when they restart.
C. In /etc/environment, edited as root and followed by a reboot so every Tableau process inherits it.
D. In TSM configuration keys set with tsm configuration set, followed by tsm pending-changes apply.

Accepted Answer

Correct answer: A. In a .conf file under ~tableau/.config/systemd/tableau_server.conf.d, then restart TSM services.
For an existing Linux installation, Tableau documents stopping the server, opening a session as the tableau user, creating a file such as 20-proxy.conf in ~tableau/.config/systemd/tableau_server.conf.d, restarting the administrative services with the provided scripts, and running tsm restart. The TSM services run as a systemd user service for the tableau user, so a system-wide /etc/environment change is not the documented mechanism. No TSM configuration key is documented for this Linux forward proxy setup. Tableau Server no longer uses a Tableau-specific sudoers file.

Question 6

Ursa Major Solar wants members of its existing Linux group tabops to administer TSM, and current tsmadmin members must keep access during the transition. What should the architect run?
A. tsm configuration set -k tsm.authorized.groups -v tsmadmin,tabops, then apply the pending changes.
B. initialize-tsm again with --tsm-authorized-group=tabops so that the new group is added to TSM.
C. tsm configuration set -k tsm.authorized.groups -v tabops, which adds tabops alongside tsmadmin.
D. A change in /etc/group that makes tabops a member of tsmadmin so its users inherit TSM authorization.

Accepted Answer

Correct answer: A. tsm configuration set -k tsm.authorized.groups -v tsmadmin,tabops, then apply the pending changes.
The authorized group list is stored in tsm.authorized.groups, which accepts a comma-separated list, and setting it overwrites the existing value; listing both groups keeps current tsmadmin members authorized while adding tabops. Setting only tabops is the trap, because existing tsmadmin users would lose TSM authorization. initialize-tsm runs only once, so its --tsm-authorized-group option applies only at installation. Linux /etc/group does not make one group a member of another.

Question 7

Northern Trail Outfitters engineers write the registration file and the LDAP identity-store JSON for a new Tableau Server on Linux in a Windows text editor and copy both files to the initial node. The JSON passes a syntax check on the engineers' laptops, but registration and the identity-store configuration on the Linux node fail with errors. What should the architect do?
A. Run the TSM commands with sudo, because the errors come from the ownership the copied files received on Linux.
B. Replace the JSON files with tsm configuration set keys, because TSM on Linux cannot import JSON configuration.
C. Re-create or convert the files on Linux so that each line ends with LF only, then rerun the configuration steps.
D. Save both files in UTF-16 encoding, so that Linux can read files that were authored on a Windows computer.

Accepted Answer

Correct answer: C. Re-create or convert the files on Linux so that each line ends with LF only, then rerun the configuration steps.
Tableau's Linux troubleshooting guide says to edit or create installation and configuration files on Linux, because files created on Windows end lines with CR LF instead of LF and can cause errors during registration or when configuring identity-store or gateway settings. A JSON syntax check does not detect line endings, which is why the files look valid on the laptops. Changing the encoding to UTF-16 does not remove the carriage returns and is not what Tableau expects. Running with sudo addresses permissions, not file content. TSM on Linux does import JSON configuration files, so abandoning them is unnecessary.

Question 8

Cumulus Financial runs Tableau Server on VMware in its own data center, licensed through Tableau Enterprise, which includes Advanced Management capabilities. Its security office wants the root key for encrypted extracts protected by the company's Azure Key Vault. What should the architect advise?
A. Run tsm security kms set-mode azure with the vault and key names, because the license is the only prerequisite.
B. Store the master extract keys in Azure Key Vault and keep the root master key in each node's Java keystore.
C. Azure Key Vault integration requires Tableau Server deployed in Azure; these on-premises nodes can use the local KMS.
D. Use AWS KMS instead, because it can be reached from any data center once IAM credentials are configured.

Accepted Answer

Correct answer: C. Azure Key Vault integration requires Tableau Server deployed in Azure; these on-premises nodes can use the local KMS.
Azure Key Vault is an Advanced Management KMS option, and its documented prerequisites include both the Advanced Management capability and Tableau Server deployed in Azure; an on-premises VMware deployment uses the local KMS, which is available with every installation. Treating the license as the only prerequisite is the trap here. AWS KMS has the parallel requirement that Tableau Server be deployed in AWS EC2 and authenticate through the instance's IAM role. The key hierarchy is also misdescribed: the external KMS encrypts the root master key, while the local keystore still stores secrets.

Question 9

Cumulus Financial reran upgrade-tsm.cmd after a failed Tableau Server upgrade on Windows, and it failed again at the same step. The command window shows only a generic message. Default directories are in use. Which two logs should the architect examine next? Choose 2 answers.
A. tabadmincontroller logs under the data directory's tabsvc\logs folder, which record problems in the jobs that the upgrade runs.
B. The workgroup.pg_dump file inside the most recent backup, which records the upgrade steps that failed.
C. The Setup log in the \Temp folder of the account that first installed the previous version of Tableau Server.
D. tsm.log in C:\Users\<user>\.tableau	sm, which records every job step that the upgrade script runs on all nodes.
E. app-upgrade.log in C:\ProgramData\Tableau\Tableau Server\logs, which repeats the command-line errors with more detail.

Accepted Answer

Correct answer: A. tabadmincontroller logs under the data directory's tabsvc\logs folder, which record problems in the jobs that the upgrade runs. | E. app-upgrade.log in C:\ProgramData\Tableau\Tableau Server\logs, which repeats the command-line errors with more detail.
Tableau's upgrade troubleshooting says to look in app-upgrade.log, which contains the errors shown at the command line, often with more detail, and then in tabadmincontroller.log, because harder upgrade problems usually come from a job. tsm.log is the TSM command-line client's log for one user and is not the documented source for upgrade job failures. The \Temp folder holds Setup logs for a new installation, and the logs from an earlier version's install say nothing about this upgrade. workgroup.pg_dump is the repository data inside a backup and is used to size the repository.

Question 10

Cumulus Financial is reviewing two Kerberos proposals for Tableau Server: a front-end service would use constrained delegation to sign users in to Tableau, and Tableau would use unconstrained delegation to reach databases. Which two corrections should the architect make? Choose 2 answers.
A. Grant the data-access account rights to the Tableau web endpoint's SPN instead of the database SPNs.
B. Use unconstrained delegation on the front-end service to make Tableau sign-in supported.
C. Use unconstrained delegation for data sources when the workbook uses viewer credentials.
D. Use constrained delegation, with rights to the target database SPNs, for supported data sources.
E. Do not use constrained delegation as the mechanism for single sign-on into Tableau Server.

Accepted Answer

Correct answer: D. Use constrained delegation, with rights to the target database SPNs, for supported data sources. | E. Do not use constrained delegation as the mechanism for single sign-on into Tableau Server.
Tableau Server does not support constrained delegation for single sign-on into Tableau itself. Its supported delegation use is constrained delegation to supported data sources, with the Tableau data-access account granted rights to the target database SPNs. Switching the front-end service to unconstrained delegation is not the documented remedy. Unconstrained delegation to data sources is explicitly unsupported, and rights to the Tableau web endpoint's SPN do not supply the required delegation rights to the target database SPNs.

Question 11

Cloud Kicks runs deploy-coordination-service for the intended node IDs with no other pending changes. The command completes successfully. Before restarting Server, an operator plans to activate the new ensemble by manually removing the old one. Which documented result should the architect explain?
A. The command only stages the ensemble; pending-changes apply is always required to make it production.
B. Successful deployment makes the new ensemble production and removes the old one; failed deployment has a separate cleanup step.
C. Both ensembles remain production, and Server selects a different ensemble independently for each request.
D. The old ensemble remains production until cleanup-coordination-service is run to activate the newly staged ensemble.

Accepted Answer

Correct answer: B. Successful deployment makes the new ensemble production and removes the old one; failed deployment has a separate cleanup step.
The deployment command makes the new ensemble the production ensemble and removes the old ensemble when it succeeds. The documented cleanup command addresses an unsuccessfully deployed ensemble after a failure. It is not an extra activation step after successful deployment. The procedure does not describe two simultaneous production ensembles or a mandatory pending-changes apply after this successful command.

Question 12

Universal Containers' security team wants a custom view on Tableau Server that shows, for each site-role change, which administrator made the change and which user was changed, using names as they were at the time even if either account has since been removed. Which two joins should the architect use? Choose 2 answers.
A. Join historical_events.hist_target_site_id to _users.site_id, because the target site identifies which user's role was changed.
B. Join historical_events.hist_actor_user_id to _users, because _users keeps a record for each removed user until its history expires.
C. Join historical_events.worker to _users.name, because worker records the account name of the user who initiated the event.
D. Join historical_events.hist_target_user_id to hist_users to identify the user who was the target of the event.
E. Join historical_events.hist_actor_user_id to hist_users to identify the administrator who initiated the event.

Accepted Answer

Correct answer: D. Join historical_events.hist_target_user_id to hist_users to identify the user who was the target of the event. | E. Join historical_events.hist_actor_user_id to hist_users to identify the administrator who initiated the event.
In the data dictionary, hist_actor_user_id references the hist_users record of the user who initiated the event and hist_target_user_id references the hist_users record of the user who was the target, and hist_users holds user details as they were at the time of the event. _users contains current user information, so removed accounts and earlier names are lost. The worker column holds the name or IP address of the worker where the event occurred, not a user name. A site ID identifies a site and cannot single out the user whose role changed.

Question 13

Cumulus Financial's Admin Insights dashboard on Tableau Cloud plots sign-ins by hour using Event Date (local) with the Timezone parameter set to New York. For events from before the most recent daylight-saving change, the peak appears one hour off. What should the architect do?
A. Change the parameter to UTC and back to New York, because the local field is cached until the parameter value changes.
B. Change the Admin Insights Update Frequency setting, because the local date is calculated only when the data source is updated.
C. Build the hourly view from Event Date, which is in UTC, and handle the daylight-saving conversion in its own calculation.
D. Switch the site's time zone in Settings, because Event Date (local) follows the site setting rather than the Timezone parameter.

Accepted Answer

Correct answer: C. Build the hourly view from Event Date, which is in UTC, and handle the daylight-saving conversion in its own calculation.
TS Events stores Event Date in UTC, and Event Date (local) is a simple adjustment by the Timezone parameter that Tableau says will not be accurate for older data if the time zone uses daylight saving time. Starting from the UTC field and converting with a daylight-saving-aware calculation removes the shift. Update frequency only controls how often the data is refreshed. The local field is driven by the workbook's Timezone parameter, and toggling that parameter does not change the fixed offset that causes the problem.

Question 14

Cloud Kicks' orchestration tool calls the Tableau REST API Run Extract Refresh Task method after its upstream ETL finishes. A downstream step must start only after the refreshed extract is available on Tableau Server 2024.2. How should the orchestrator determine that the refresh is complete?
A. Poll Get Extract Refresh Tasks and treat the task's disappearance from the returned list as proof the refresh completed.
B. Poll the Query Job method with the job ID returned by Run Extract Refresh Task until the job reports that it has completed.
C. Subscribe a webhook to DatasourceRefreshStarted and start the downstream step as soon as that webhook request arrives.
D. Treat the successful Run Extract Refresh Task response as confirmation that the extract has already finished refreshing.

Accepted Answer

Correct answer: B. Poll the Query Job method with the job ID returned by Run Extract Refresh Task until the job reports that it has completed.
Run Extract Refresh Task only adds the task to the backgrounder queue and returns information about the backgrounder job, including a job ID to use with Query Job to check the refresh status. A successful response therefore means the job was queued, not finished. Get Extract Refresh Tasks lists the scheduled tasks, which stay defined after a run, so polling them says nothing about one job. DatasourceRefreshStarted fires when the refresh begins, which is too early for the downstream step.

Question 15

Ursa Major Solar runs Tableau Server with Advanced Management, an Amazon RDS external repository and External File Store. The operations lead wants the Resource Monitoring Tool (RMT) to raise an incident if the repository process stops, and to chart extract file sizes over time. What should the architect tell the operations lead?
A. Raise the Environment Down severity for the repository, because that system incident fires whenever any one Tableau process stops.
B. RMT does not monitor external repository process status or external file store extract sizes, so those requirements need the platform's own monitoring.
C. Install an RMT Agent on the RDS instance and on the file store host, so their process status and file sizes appear in the RMT charts.
D. Enable the Hyper Spooling incident, because it reports extract storage growth on the external file store as well as memory spooling.

Accepted Answer

Correct answer: B. RMT does not monitor external repository process status or external file store extract sizes, so those requirements need the platform's own monitoring.
RMT documents that for an external repository and an external gateway the process status is not monitored, and for External File Store the extract file size is not tracked (extract failures and durations still are), so the gap must be covered by the database or storage platform's own monitoring. Agents are installed on Tableau Server nodes, not on a managed RDS database or storage host. Environment Down is a system-defined critical incident whose severity cannot be changed, and it fires when Tableau Server is offline or a process is down on all nodes. Hyper Spooling incidents report Data Engine queries spooling to disk under memory pressure, not file store growth.

Question 16

Between two TabJolt runs, Cumulus Financial's engineer raised the VizQL Server instances on each Tableau Server test node from the default to eight. The second run had slower response times than the first, and memory stayed close to the limit on every node throughout. What should the architect recommend before the next run?
A. Reduce the number of VizQL Server instances, because each one reserves memory and too many can slow the server.
B. Keep eight instances and extend each run to an hour, because longer runs let the memory use settle at a lower level.
C. Add still more VizQL Server instances, because the slowdown shows the server needs extra rendering capacity.
D. Increase the backgrounder instances, because the extra memory is being used by extract refreshes started by the test.

Accepted Answer

Correct answer: A. Reduce the number of VizQL Server instances, because each one reserves memory and too many can slow the server.
Tableau's Optimize for User Traffic guidance says to add one VizQL Server process at a time and measure, warns that too many can slow the server down because each consumes CPU and memory, and says to reduce the number of VizQL processes if memory usage is consistently high. Adding more instances repeats the change that made the second run worse. Nothing in the test attributes the memory to backgrounders, and the plan should stop other work on the server during tests. Longer runs do not release memory that the extra instances reserve.

Question 17

In the Performance of Views and Stats for Load Times administrative views, Cloud Kicks' architect finds that one Sales Pipeline workbook loads slowly at every hour of the day, even when very few sessions are active. Its dashboards show dozens of sheets, use many filter cards and connect live to a slow database. Which three actions should the architect recommend? Choose 3 answers.
A. Add VizQL Server processes, so each dashboard request has more rendering capacity on the server.
B. Reduce the number of filters on the dashboards.
C. Display less information in each view, or break the large dashboards up into several smaller views.
D. Increase the VizQL session timeout, so viewers keep their sessions open between visits to the workbook.
E. Use a data extract instead of the slow live connection where the data freshness needs allow it.

Accepted Answer

Correct answer: B. Reduce the number of filters on the dashboards. | C. Display less information in each view, or break the large dashboards up into several smaller views. | E. Use a data extract instead of the slow live connection where the data freshness needs allow it.
When a view is slow regardless of when it is viewed, Tableau says the workbook itself needs to be optimized, and lists displaying less information or breaking up views, reducing the number of filters and using data extracts as simple optimizations. Adding VizQL Server processes is the remedy when slowness tracks user traffic, which this workbook does not show. A longer session timeout keeps idle sessions consuming memory and CPU without making the workbook's queries or layout any lighter.

Question 18

Get Cloudy Consulting's four-node Tableau Server runs the Administration Controller on node 1. An engineer added a weekly tsm maintenance cleanup -l -q job to Windows Task Scheduler on node 3, the least busy node. What should the architect recommend for this job?
A. Move it to node 1, because on a distributed deployment cleanup runs on the node with the Administration Controller, with the server running.
B. Keep it on node 3, but stop Tableau Server first, because http_requests entries can be deleted only while the server is stopped.
C. Move it to the node that runs the repository, because cleanup with -q must run on the node hosting the http_requests table.
D. Schedule an identical cleanup job on every node, because each node's TSM agent cleans only the logs written on its own machine.

Accepted Answer

Correct answer: A. Move it to node 1, because on a distributed deployment cleanup runs on the node with the Administration Controller, with the server running.
Tableau states that on a distributed deployment tsm maintenance cleanup should be run on the node running the Administration Controller, usually the initial node. The -q option deletes old http_requests entries only while Tableau Server is running and is ignored when the server is stopped. Tableau documents running the command on the Administration Controller node, not duplicating it on every node or running it on the repository node.

Free Salesforce Tableau Architect
Practice Questions

What is the Tableau Architect exam like?

Questions by exam section

Design a Tableau Infrastructure

Question 1 · Medium

Question 2 · Harder · Choose 3

Question 3 · Medium

Question 4 · Easier

Deploy Tableau Server

Question 5 · Medium

Question 6 · Harder

Question 7 · Medium

Question 8 · Medium

Question 9 · Medium · Choose 2

Question 10 · Medium · Choose 2

Question 11 · Easier

Monitor and Maintain a Tableau Deployment

Question 12 · Medium · Choose 2

Question 13 · Harder

Question 14 · Easier

Question 15 · Medium

Question 16 · Harder

Question 17 · Medium · Choose 3

Question 18 · Medium

Where to go after these 18 questions

Get Tableau Architect exam updates by email

Ready for a full Tableau Architect practice exam?

Free Salesforce Tableau ArchitectPractice Questions