Salesforce Certified Tableau Server Administrator Questions and Answers
A user named John publishes a workbook named Sales Quota to a project named Sales. The All Users group has the View and Download Workbook/Save As capabilities only to the Sales project. A user named Sandy has the Explorer (can publish) site role, on the Sales Quota workbook. No other users or groups have permissions to the Sales project. The Sales project is set to Managed by the owner. What are the effective rights for Sandy?
Options:
All of the capabilities associated with the Editor rule
View and Download Workbook/Save As
The same rights as John
No access
Answer:
BYou activate the same Tableau Server product key on three installations for Dev, Test, and Production. You plan to move the Test environment to new hardware. What is the recommended workflow for managing the product key?
Options:
Install and activate Tableau Server on the new hardware, and then deactivate it on the old hardware
Deactivate the product key on the existing Test environment, and then install and activate Tableau Server on the new hardware
Install and activate Tableau Server on the new hardware and keep the existing Test environment as a backup
Install and activate Tableau Server on the new hardware, and then run the following script in the old environment: tableau-server-obliterate.cmd -y -y -y
Answer:
BExplanation:
Tableau Server’s licensing ties product keys to specific machines. Moving an environment requires managing activations to stay compliant. Let’s break this down:
Licensing Rules:
A product key can be activated on multiple machines (e.g., Dev, Test, Prod), but only up to the licensed limit (typically 3 for such setups).
Deactivation frees the key for reuse elsewhere.
Recommended Workflow:
Deactivate first: Use tsm licenses deactivate on the old Test machine to release the key.
Then activate: Install on the new hardware and activate with tsm licenses activate -k
Why: Ensures compliance and avoids activation conflicts (e.g., exceeding the key’s limit).
Option B (Deactivate on Test, then install/activate on new hardware): Correct.
Steps:
On old Test: tsm licenses deactivate.
Install Tableau Server on new hardware.
On new Test: tsm licenses activate -k
Benefit: Clean, compliant transfer—preserves license integrity.
Option A (Activate new, then deactivate old): Incorrect.
Risk: If the key’s limit is reached (e.g., 3 activations), the new activation fails until deactivation occurs. Order matters.
Option C (Activate new, keep old as backup): Incorrect.
Issue: Exceeds license limit (4 activations) and risks non-compliance. Backup requires deactivation or a separate key.
Option D (Activate new, obliterate old): Incorrect.
Details: tableau-server-obliterate.cmd wipes the entire install (data, config)—overkill and doesn’t formally deactivate the key via TSM, potentially leaving licensing inconsistent.
Why This Matters: Proper license management prevents activation errors and ensures legal use across environments.
Several Tableau Server users published workbooks that have large extracts. After several weeks of use, the users abandoned the workbooks. What should you do to identify the abandoned workbooks?
Options:
Use the Stale Content administrative view
Examine the extract files in ProgramData/Tableau/Tableau Server/data/tabsvc/dataengine/extract
Delete all extracts and allow them to be re-generated automatically if they are still in use
View all workbooks, and sort by the Modified date
Answer:
AExplanation:
Abandoned workbooks—those no longer actively used—can clutter Tableau Server and consume resources (e.g., disk space for extracts). Identifying them efficiently requires leveraging built-in administrative tools rather than manual or destructive methods. Let’s explore this in depth:
Tableau Server Admin Views: Tableau provides pre-built administrative views to monitor server health, usage, and content. The Stale Content view, accessible under Server > Status > Administrative Views, is specifically designed to identify content (workbooks, data sources) that hasn’t been viewed or modified recently. It shows:
Content name, owner, and project.
Last viewed date and last modified date.
View count over a period.This view uses Repository data to track usage metrics, making it ideal for spotting abandoned workbooks.
Option A (Use the Stale Content administrative view): Correct. This is the most efficient and non-invasive method. You can filter by last viewed date (e.g., >30 days ago) to identify workbooks with large extracts that users have stopped accessing. From there, you can contact owners or delete the content if policy allows. It’s a server administrator’s go-to tool for content management.
Option B (Examine extract files in ProgramData/.../extract): Incorrect and impractical. The ProgramData/Tableau/Tableau Server/data/tabsvc/dataengine/extract directory stores .hyper extract files, but:
File names are cryptic (e.g., GUIDs), not tied directly to workbook names.
It doesn’t indicate usage or abandonment—only file presence and size.
Manual inspection is time-consuming and error-prone compared to the Stale Content view.
Option C (Delete all extracts and allow them to be re-generated): Incorrect and risky. Deleting extracts (e.g., via tsm maintenance cleanup) removes them without identifying usage. Regeneration only occurs if a schedule or user triggers it, potentially disrupting active users and losing historical data unnecessarily.
Option D (View all workbooks, and sort by the Modified date): Partially effective but inefficient. In the Tableau Server UI (e.g., under Content > Workbooks), you can sort by "Last Modified," but:
It doesn’t show viewership (a workbook might be modified recently but unused).
It’s manual and doesn’t scale for large deployments compared to the Stale Content view.
Why This Matters: The Stale Content view leverages Tableau’s metadata to provide actionable insights, saving time and reducing risk compared to manual or destructive alternatives. It’s part of Tableau’s governance toolkit.
Which three data sources support Kerberos delegation with Tableau Server? (Choose three.)
Options:
Teradata
PostgreSQL
SQL Server
SAP HANA
Answer:
A, C, DExplanation:
Kerberos delegation allows Tableau Server to pass a user’s Kerberos credentials to a data source for seamless authentication (SSO)—let’s explore which sources support it:
Kerberos Overview:
Used with Active Directory (AD) for SSO in Windows environments.
Tableau Server delegates the user’s ticket to the data source, avoiding embedded credentials.
Requires:
Data source support for Kerberos.
Proper configuration (e.g., SPN, constrained delegation).
Supported Data Sources: Per Tableau’s documentation:
Option A (Teradata): Correct.
Details: Supports Kerberos delegation—common in enterprise data warehouses.
Config: Enable in TSM (tsm authentication kerberos configure) and set SPN for Teradata.
Option C (SQL Server): Correct.
Details: Fully supports Kerberos—widely used with AD-integrated SQL Server instances.
Config: Requires AD setup and "Trustworthy" delegation in SQL Server.
Option D (SAP HANA): Correct.
Details: Supports Kerberos SSO via delegation—popular in SAP ecosystems.
Config: Needs HANA Kerberos setup (e.g., keytab) and Tableau Server integration.
Option B (PostgreSQL): Incorrect.
Why: Supports Kerberos authentication natively, but Tableau Server doesn’t enable delegation to PostgreSQL—users must embed credentials or use other methods (e.g., OAuth).
Why This Matters: Kerberos delegation enhances security by avoiding stored passwords—knowing supported sources ensures SSO feasibility.
You have an installation of Tableau Server and a site that are configured to use default settings. What should you do to ensure that the users on the site can set up data-driven alerts?
Options:
Enable data-driven alerts on the Tableau Services Manager Configuration page
Run the tsm configuration set -k dataAlerts.checkIntervalInMinutes -v 60 command
Change the data-driven alerts setting on the new site's Settings page
No action is necessary: the default settings enable data-driven alerts for the site
Answer:
CExplanation:
Data-driven alerts in Tableau Server allow users to receive notifications when data in a view meets certain conditions (e.g., a sales metric exceeds a threshold). By default, this feature is disabled for a site unless explicitly enabled by an administrator.
Option C (Change the data-driven alerts setting on the new site's Settings page): This is the correct answer. In the Tableau Server web interface, a site administrator can navigate to the site’s Settings > General page and enable the option "Let users create data-driven alerts." This must be done manually because the default setting for a new site is disabled. Once enabled, users with appropriate permissions (e.g., Viewer, Explorer, or Creator roles) can create alerts on views they have access to.
Option A (Enable data-driven alerts on the TSM Configuration page): This is incorrect because the TSM Configuration page (accessed via the TSM web UI or CLI) manages server-wide settings like ports, authentication, and processes, not site-specific features like data-driven alerts.
Option B (Run the tsm configuration set -k dataAlerts.checkIntervalInMinutes -v 60 command): This is incorrect. The dataAlerts.checkIntervalInMinutes key controls how frequently Tableau Server checks alert conditions (default is 60 minutes), but it does not enable the feature itself. The feature must first be turned on at the site level.
Option D (No action is necessary): This is incorrect because the default setting for data-driven alerts is off for new sites, requiring explicit action to enable it.
When you use trusted tickets in Tableau Server, users can:
Options:
Access embedded views without being prompted for credentials
Encrypt database connections
Save and edit workbooks
Embed database credentials
Answer:
AExplanation:
Trusted Tickets is an authentication method in Tableau Server for embedding views in external applications (e.g., portals) without requiring users to log in manually. Here’s how it works:
A trusted application (e.g., a web server) authenticates with Tableau Server using a trusted IP or username/password.
Tableau Server issues a temporary ticket (a unique string).
The ticket is embedded in a view URL (e.g., /trusted/
Option A (Access embedded views without being prompted for credentials): Correct. Trusted tickets enable SSO-like behavior for embedded content, bypassing the login prompt if the ticket is valid. This is ideal for seamless integration into external systems.
Option B (Encrypt database connections): Incorrect. Encryption is handled by data source configurations (e.g., SSL), not trusted tickets, which focus on user authentication.
Option C (Save and edit workbooks): Incorrect. Trusted tickets grant view access, not edit permissions—those depend on the user’s site role and permissions.
Option D (Embed database credentials): Incorrect. Trusted tickets authenticate users to Tableau Server, not databases—database credentials are managed separately in the data source.
Why This Matters: Trusted tickets simplify embedding Tableau content securely in custom applications, enhancing user experience.
What file format should you use to register Tableau Server from the command line?
Options:
YML
XML
JSON
HTTP
Answer:
CExplanation:
Registering Tableau Server from the command line involves providing configuration details (e.g., identity store, license) via the tsm register command. Let’s explore this fully:
Registration Process:
Run during initial setup or to update settings (e.g., after changing AD/LDAP config).
Uses a configuration file to pass parameters to TSM.
Command: tsm register --file
File Format:
Tableau Server uses JSON for configuration files in TSM commands like tsm register.
Example:
json
CollapseWrapCopy
{
"identityStore": {
"type": "local",
"domain": "example.com"
}
}
JSON is structured, machine-readable, and aligns with Tableau’s modern CLI design.
Option C (JSON): Correct.
Official format for tsm register, per documentation and practical use.
Option A (YML): Incorrect.
While tabsvc.yml exists internally, it’s not for registration—tsm register uses JSON.
Option B (XML): Incorrect.
Older Tableau configs used XML (e.g., workgroup.yml pre-TSM), but TSM standardized on JSON.
Option D (HTTP): Incorrect.
HTTP is a protocol, not a file format—irrelevant here.
Why This Matters: Correct file format ensures seamless registration, avoiding CLI errors in setup or migrations.
What should you use to set a preferred active repository?
Options:
A tsm configuration set command
A tabcmd set command
The TSM browser client's Maintenance page
The TSM browser client's Configuration Topology page
Answer:
AExplanation:
Tableau Server uses a PostgreSQL database as its repository to store metadata, user information, and permissions. In a high-availability (HA) setup with multiple nodes, there are typically two repository instances: one active and one passive. The "preferred active repository" refers to designating which repository instance should take priority as the active one. This is managed through Tableau Services Manager (TSM).
The correct method to set the preferred active repository is by using the tsm configuration set command. Specifically, you would use a command like:
tsm configuration set -k pgsql.preferred_host -v
This command allows an administrator to specify the preferred host for the active repository, ensuring control over which node takes precedence in an HA environment.
Option B (tabcmd set command) is incorrect because tabcmd is a command-line utility primarily used for administrative tasks like managing users, groups, and content (e.g., publishing workbooks), not for configuring server topology or repository settings.
Option C (TSM browser client's Maintenance page) is incorrect because the Maintenance page in the TSM web interface is used for tasks like backups, restores, and cleanup, but it does not provide an option to set the preferred active repository.
Option D (TSM browser client's Configuration Topology page) is partially relevant since the Topology page displays the current configuration of services across nodes, including the repository. However, it does not allow direct modification of the preferred active repository; this must be done via the tsm command line.
What two Tableau Services Manager (TSM) processes continue to run when Tableau Server is stopped? (Choose two.)
Options:
VizQL Server
License Manager
Backgrounder
Administration Controller
Answer:
B, DExplanation:
Tableau Server consists of multiple processes managed by TSM. When you stop Tableau Server (e.g., via tsm stop), most application processes halt, but some TSM-specific processes remain active to manage the server’s infrastructure. Let’s examine each:
TSM Processes: These include the Administration Controller, Administration Agent, and License Manager, which handle configuration, monitoring, and licensing.
Application Processes: These include VizQL Server, Backgrounder, Data Server, etc., which deliver Tableau’s core functionality and stop when the server is stopped.
When tsm stop is executed:
The Administration Controller (port 8850) continues running to manage TSM operations (e.g., restarts, status checks).
The License Manager remains active to validate licenses and ensure compliance, even when the server is offline.
Application processes like VizQL Server and Backgrounder shut down, as they’re tied to user-facing services.
Option B (License Manager): Correct. It persists to handle licensing tasks, ensuring the server can restart without license issues.
Option D (Administration Controller): Correct. It’s the core TSM process, always running to accept commands and manage the server state.
Option A (VizQL Server): Incorrect. VizQL stops, as it renders visualizations for users—an application process tied to active server operation.
Option C (Backgrounder): Incorrect. Backgrounder stops, as it processes background tasks (e.g., extract refreshes), which halt when the server is down.
Why This Matters: Understanding which processes persist helps administrators troubleshoot and manage server lifecycle events effectively.
What should you do to ensure that server tasks associated with a particular schedule run one-at-a-time?
Options:
Set Execution to Serial
Set Default priority to 0
Set Frequency to Hourly
Set Execution to Parallel
Answer:
AExplanation:
In Tableau Server, schedules manage tasks such as extract refreshes and subscriptions. The execution mode of a schedule determines how tasks within that schedule are processed by the Backgrounder process:
Parallel: Tasks run simultaneously (up to the Backgrounder’s capacity), which is the default setting.
Serial: Tasks run one-at-a-time in sequence, ensuring that one task completes before the next begins.
To ensure tasks associated with a particular schedule run one-at-a-time, you must configure the schedule’s execution mode to Serial. This is done in the Tableau Server web interface:
Go to Schedules.
Select the schedule, click Actions > Edit Schedule.
Under Execution, choose Serial instead of Parallel.
Option A (Set Execution to Serial): Correct. This directly addresses the requirement by forcing tasks to execute sequentially.
Option B (Set Default priority to 0): Incorrect. Priority (1–100) determines the order of task execution across all schedules, not whether tasks run one-at-a-time within a single schedule. Also, 0 is not a valid priority value (minimum is 1).
Option C (Set Frequency to Hourly): Incorrect. Frequency (e.g., hourly, daily) controls when the schedule runs, not how tasks within it are executed.
Option D (Set Execution to Parallel): Incorrect. Parallel execution allows tasks to run simultaneously, which contradicts the requirement.
You have an existing group subscription. You add a user to the group. What statement correctly describes the result?
Options:
The administrator receives a notice to approve or deny adding the user to the subscription
The creator of the subscription receives notice of the change and must manually edit the subscription to reflect the new group membership
The subscription updates automatically to include the new user
The subscription will continue to include only the members of the group at the time the subscription was made
Answer:
CExplanation:
Subscriptions in Tableau Server deliver workbook views to users via email on a schedule. Group subscriptions apply to all group members—let’s unpack this:
Group Subscription Mechanics:
Created via Workbooks > Actions > Subscribe > Select Group.
Delivers content to all users in the group at the time the subscription runs (e.g., daily PDF).
Dynamic: Membership updates (additions/removals) are reflected automatically on the next run.
Option C (The subscription updates automatically to include the new user): Correct.
Details: When you add a user to the group (e.g., via Users > Groups > Add Users), Tableau Server’s subscription process queries the group’s current membership at runtime. The new user receives the subscription on the next scheduled delivery—no manual action needed.
Example: Group "Sales" has a 9 AM subscription. Add a user at 8 AM—they get the email tomorrow at 9 AM.
Option A (Admin receives notice to approve/deny): Incorrect.
Why: No approval workflow exists for group membership changes in subscriptions—it’s automatic.
Option B (Creator must manually edit): Incorrect.
Why: Subscriptions are tied to the group, not a static user list—manual edits aren’t required for membership changes.
Option D (Only members at creation time): Incorrect.
Why: This would be true for individual subscriptions (static list), but group subscriptions are dynamic.
Why This Matters: Dynamic group subscriptions streamline content delivery as teams evolve, reducing admin overhead.
Your deployment of Tableau Server uses Active Directory authentication. What statement correctly describes the process of importing a group from Active Directory?
Options:
If an imported group contains any users that have Tableau Server accounts, their site role will be changed to match the site role specified during the import
Importing a group from Active Directory requires a .csv file that lists user IDs
You can change the name of a group during import, although this will not change the group’s name in Active Directory
New users created as a result of importing a group are assigned the site role specified during the import
Answer:
DExplanation:
Importing an AD group into Tableau Server syncs user management—let’s analyze the process and options:
AD Group Import Process:
How: In the UI (Users > Groups > Add Group > Active Directory), enter the AD group name, set a site role, and sync.
Behavior:
Existing Users: If a user is already in Tableau Server, their site role remains unchanged unless manually adjusted—sync applies the minimum role only if it upgrades access.
New Users: Added to Tableau with the site role specified during import.
Config: Requires AD authentication enabled in TSM.
Option D (New users created are assigned the site role specified during import): Correct.
Details: When importing (e.g., "SalesTeam" group, site role: Explorer):
New users get Explorer.
Existing users keep their role unless it’s below Explorer (e.g., Unlicensed → Explorer).
Why: Ensures consistent onboarding—new users align with the group’s intended access.
Option A (Existing users’ roles change to match import): Incorrect.
Why: Existing roles persist unless lower than the minimum—e.g., Viewer stays Viewer if import sets Explorer, but Unlicensed upgrades. Not a full overwrite.
Option B (Requires a .csv file): Incorrect.
Why: AD import uses live sync via LDAP—no .csv needed (that’s for local auth imports).
Option C (Change group name during import): Incorrect.
Why: The AD group name is fixed—you can’t rename it in Tableau during sync (it mirrors AD). Post-import renaming is possible but not part of the process.
Why This Matters: Accurate AD sync ensures seamless user management—missteps can disrupt access or licensing.
What command should you run to update the automatically-generated secrets that are created during a Tableau Server installation?
Options:
tsm data-access caching set -r 1
tsm licenses refresh
tsm security regenerate-internal-tokens
tsm security validate-asset-keys
Answer:
CExplanation:
Tableau Server uses internal secrets (tokens) for secure communication between its processes (e.g., Repository, File Store). These are automatically generated during installation and can be regenerated if compromised or for security maintenance. The command to update these is:
tsm security regenerate-internal-tokens: This regenerates the internal security tokens, ensuring all processes use the new tokens after a restart.
Option C (tsm security regenerate-internal-tokens): Correct. This is the documented command for updating internal secrets.
Option A (tsm data-access caching set -r 1): Incorrect. This command configures caching behavior, not security tokens.
Option B (tsm licenses refresh): Incorrect. This refreshes license data, unrelated to internal secrets.
Option D (tsm security validate-asset-keys): Incorrect. This validates encryption keys for assets, not internal tokens.
Which two settings should you configure to allow users to post comments on a visualization? (Choose two.)
Options:
The relevant users must have a minimum site role of Explorer (can publish)
Add Comments must be allowed in permissions for the relevant users
Comments must be enabled on the server Settings page
Comments must be enabled on the site Settings page
Answer:
B, DExplanation:
Comments on visualizations foster collaboration in Tableau Server—let’s break down the requirements:
Commenting Prerequisites:
Site-Level Enablement: Comments must be activated for the site.
Permission: Users need the "Add Comment" capability on the content.
Site Role: Minimum role of Viewer allows commenting if permissions are set.
Option B (Add Comments must be allowed in permissions): Correct.
Details: In the Permissions dialog (e.g., for a workbook), set "Add Comment" to "Allowed" for users/groups. Default is "Denied" unless explicitly enabled.
How: Content > Workbooks > Actions > Permissions > Edit Rule.
Why: Permissions are granular—site enablement alone isn’t enough.
Option D (Comments must be enabled on the site Settings page): Correct.
Details: Go to Site > Settings > General > Allow Comments—check the box.
Why: This is a site-wide toggle (default: off). Without it, no one can comment, regardless of permissions.
Option A (Minimum site role of Explorer - can publish): Incorrect.
Why: Viewer role suffices if permissions allow—Explorer (can publish) isn’t required (it adds publishing, not commenting).
Option C (Server Settings page): Incorrect.
Why: Comments are a site-level feature, not server-wide—no such toggle exists in TSM’s Server Settings.
Why This Matters: Enabling comments at both site and content levels ensures controlled collaboration—key for team insights.
Which Tableau Server process performs the role of a database for metadata?
Options:
Data Engine
Repository
Backgrounder
File Store
Answer:
BExplanation:
Tableau Server relies on several processes to function, each with a specific role. The Repository process (powered by PostgreSQL) serves as the database for metadata, storing critical information such as:
User and group details.
Permissions and site configurations.
Workbook and data source metadata (e.g., schedules, subscriptions).
Option B (Repository): Correct. The Repository is the centralized database that holds all metadata, making it the backbone of Tableau Server’s content management. There are typically two instances in an HA setup (one active, one passive), monitored by the Cluster Controller.
Option A (Data Engine): Incorrect. The Data Engine manages in-memory data processing and extract storage (e.g., .hyper files), not metadata. It’s separate from the Repository.
Option C (Backgrounder): Incorrect. The Backgrounder handles background tasks like extract refreshes and subscriptions, but it doesn’t store metadata—it interacts with the Repository to retrieve task details.
Option D (File Store): Incorrect. The File Store manages physical extract files and workbook assets, not metadata, which is stored in the Repository.
Which two operating systems are supported for a Tableau Server installation? (Choose two.)
Options:
Windows 7
Windows 10
Windows Server 2019
Windows Server 2016
Answer:
C, DExplanation:
Tableau Server is designed for production environments and is supported only on server-class operating systems, not desktop operating systems. As of the latest documentation (aligned with knowledge up to March 21, 2025), the supported operating systems for Tableau Server on Windows are:
Windows Server 2016
Windows Server 2019
Windows Server 2022 (added in later versions, but relevant as of 2025).
Desktop operating systems like Windows 7 or Windows 10 are not supported for production installations due to stability, security, and performance requirements.
Option A (Windows 7): Incorrect. Windows 7 is a desktop OS and is not supported for Tableau Server. It’s also end-of-life as of January 2020.
Option B (Windows 10): Incorrect. Windows 10 is a desktop OS and not supported for production Tableau Server deployments, though it may be used for testing in non-production scenarios.
Option C (Windows Server 2019): Correct. This is a supported server OS for Tableau Server.
Option D (Windows Server 2016): Correct. This is also a supported server OS for Tableau Server.
