Okta Pro Practice Test

Okta Pro practice test: what's covered

• Okta Certified Professional
• IAM/IdP

Free Okta Pro sample questions

1. Your CISO asks where Okta stores the canonical user identity record that drives SSO, MFA, and provisioning across 120 SaaS apps. Which Okta component holds this canonical record?

   • A. The Okta Org's SAML metadata file
   • B. Universal Directory (UD), the unified profile store inside the Org
   • C. The Active Directory (AD) agent's local cache
   • D. Each downstream SaaS app, synced back to Okta nightly
   Show answer

   Correct: B. Universal Directory is the canonical identity store inside every Okta Org. AD/LDAP/HRIS feed INTO UD via profile mastering; downstream SaaS apps receive from UD via SCIM/SAML JIT. SAML metadata is just trust config, not an identity store. AD agent cache is a transient sync buffer, not the source of truth in Okta.

2. You are explaining the Okta Identity Cloud building blocks to your architecture team. Which THREE of the following are first-class capabilities of the Okta Workforce Identity platform? (Choose 3)

   • A. Universal Directory
   • B. Adaptive MFA
   • C. API Access Management (Custom Authorization Servers)
   • D. A built-in SIEM with 90-day log retention
   • E. On-prem SQL replication of the Okta user store
   Show answer

   Correct: A and B and C. UD, Adaptive MFA, Lifecycle Management, SSO, and API Access Management are the documented pillars of Okta Workforce Identity. Okta is NOT a SIEM — System Log retention is 90 days but it is a log surface, not a SIEM. Okta also does not replicate its user store to an on-prem SQL server; downstream copies happen via SCIM/AD agent, not raw DB replication.

3. An Okta Org has tenant ID acme.okta.com. You deploy an AD agent on a domain-joined Windows server. Which direction does the AD agent open a connection?

   • A. Okta cloud initiates an inbound TCP/443 connection to the AD agent
   • B. The AD agent makes an OUTBOUND TLS connection to acme.okta.com and long-polls for work
   • C. Okta uses LDAPS over the internet to read AD directly, no agent needed
   • D. The agent only opens a connection during scheduled imports
   Show answer

   Correct: B. All Okta agents (AD, LDAP, IWA, RADIUS) use OUTBOUND HTTPS 443 to the Okta cloud and long-poll for instructions — no inbound firewall rules required. The trap "Okta initiates inbound" is a classic networking misconception. Okta does not connect directly to AD over public LDAPS for the standard agent model.

4. You need to expose an internal API to mobile and SPA clients with Okta as the authorization server, issuing access tokens with custom scopes and claims. Which Okta capability is purpose-built for this?

   • A. Okta Org Authorization Server (default)
   • B. Okta API Access Management — Custom Authorization Server
   • C. Okta Workflows
   • D. Okta Lifecycle Management
   Show answer

   Correct: B. Custom Authorization Servers (part of API Access Management, a paid add-on) let you define custom scopes, claims, audiences, access policies, and token lifetimes per API. The default "Org" authorization server only issues tokens for the Okta API itself and cannot host third-party API resource servers. Workflows is for no-code automation; Lifecycle Management is for joiner/mover/leaver provisioning.

5. An app team asks "can we deploy Okta on our own VMs in our DC for sovereignty?". What is the correct answer for Okta Workforce Identity Cloud?

   • A. Yes, Okta ships a self-hosted appliance ISO
   • B. No — Okta Workforce Identity Cloud is multi-tenant SaaS only; only agents (AD, LDAP, RADIUS) run on-prem
   • C. Yes, but only on AWS Outposts
   • D. Yes, via Okta Private Cloud, a paid Kubernetes distribution
   Show answer

   Correct: B. Okta Workforce Identity is delivered exclusively as SaaS. Sovereignty/residency is addressed via regional cells (US/EU/PREVIEW), not via self-hosting. The only on-prem footprint is lightweight agents (AD, LDAP, IWA, RADIUS, Provisioning) that long-poll outbound to the cloud.

Last updated: 2026-10-19

Okta Pro practice test FAQ