Archer-Expert Archer Certified Administrator-Expert Questions and Answers

In a Single-Server Installation (typically used for Sandbox, Development, or small-scale environments), the goal is to consolidate the entire Archer architecture onto one machine. According to the Archer Administration II setup guides, this means the Web Server (IIS), the Archer Services (Job Engine, Indexing), the Advanced Workflow (AWF) service, and the SQL Server Instance Database must all reside on that single host.

While production environments favor a distributed model (Option B) for performance and redundancy, a single-server setup requires that all roles are configured to point to "localhost" or the local server's IP. The administrator must ensure the server has sufficient CPU and RAM to handle the overlapping resource demands of the SQL database engine and the Archer web services simultaneously. Options C and D describe "Distributed" or "Hybrid" models, which contradict the definition of a single-server installation.

In the Archer security model, record-level access is determined by the complex intersection of Access Roles , Groups , and Record Permission Fields . According to the Archer Administration II curriculum, the Investigate Access tool is the primary diagnostic utility for troubleshooting "Why can't User X see Record Y?"

Unlike standard reports, Investigate Access allows an administrator to select a specific user and a specific record (or application) and run a simulation. The tool then provides a detailed breakdown of the "Final Access" (Read, Update, Delete) and, crucially, explains how that access was derived. It will highlight if the user is being granted access via a specific Group, if a Record Permission field is restricting them, or if their Access Role lacks the necessary rights. This is more efficient than the Access Control Reports (Option C), which provide a broad overview of permissions but do not provide the record-specific context that "Investigate Access" offers for pinpoint troubleshooting.

The Archer Web Services Transporter is used for "Archer-to-Archer" data feeds. For the "Load Fields" button to work, Archer must be able to successfully authenticate and connect to the source instance's API to retrieve the report metadata.

As detailed in the Archer Administration II Data Feed module, if no fields appear, it almost always indicates a communication failure between the Feed Manager and the Web Service. The Transport Configuration section (found on the Source Connection tab) contains the critical connection details: the Base URL, the Instance Name, and the User Credentials. If the credentials are incorrect, the URL is mistyped, or the "Session Token" cannot be generated, Archer cannot "see" the source report's structure, and thus the field list will remain empty. Checking the connection settings is the primary troubleshooting step before looking at filters or target mappings.

This statement is FALSE . The default authentication mechanism for a fresh installation of Archer is Archer Native Authentication . As detailed in the Archer Installation and Troubleshooting guide, when an instance is first created, it relies on the internal Archer database to store usernames and encrypted passwords.

Single Sign-On (SSO), whether it be Windows Integrated, SAML, or LDAP-based, is an opt-in configuration that must be manually enabled and configured by a System Administrator within the Archer Control Panel (ACP) . Native authentication remains the fallback method and is used for the initial "System Administrator" account setup. While most enterprise organizations quickly transition to SSO for security and convenience, the platform itself defaults to its own internal authentication engine to ensure the system is accessible immediately after installation without requiring a pre-existing connection to an Identity Provider (IdP).

In the Archer Security Parameters configuration (found in the Archer Control Panel or the Administration workspace), administrators define the "Maximum login attempts." According to the Archer Administration II curriculum, when a user exceeds this threshold (e.g., five failed attempts), the system automatically updates their account status to Locked .

It is important to distinguish "Locked" from "Inactive" or "Disabled." An Inactive or Disabled account usually implies an administrative action or a termination of the user's employment. A Locked status is a temporary security measure triggered by the system to prevent "brute force" attacks. Depending on the Security Parameter settings, a locked account may automatically unlock after a specified duration (e.g., 30 minutes), or it may require an administrator to manually click the "Unlock" button within the user's profile. This distinction allows administrators to run reports specifically on "Locked" users to identify potential security threats or users who simply need assistance with their credentials.

The Instance Report is a comprehensive diagnostic document that provides a "snapshot" of an entire Archer instance. According to the Archer Administration II curriculum, this report is found within the Archer Control Panel (ACP) or can be generated from the Administration workspace.

It is specifically designed to aid in troubleshooting and system auditing. It contains metadata about the installation history , a list of all applications and solutions , and the status of background jobs . Most importantly, it includes performance-related data such as the Top 10 field histories (identifying which fields are growing the fastest in the database) and record counts. This report is often requested by Archer Support when investigating system-wide performance issues, as it aggregates critical architectural data into a single, readable view that is more holistic than an Access Control or Application Builder report.

The scenario described is a classic implementation of Windows Integrated Authentication (WIA) , a form of Single Sign-On (SSO). As detailed in the Archer Installation and Troubleshooting guides, when Archer is configured for Windows Integrated SSO, it leverages the Kerberos or NTLM protocol. Since Sarah has already authenticated to the Windows Domain at the start of her shift, her browser passes her "security token" directly to the Archer web server (IIS).

The Archer Control Panel (ACP) must be configured to recognize the domain, and the user's Archer account must have their Windows account name (e.g., DOMAIN\Username) populated in the "Domain Account" field. This creates a seamless "handshake" that bypasses the Archer login screen entirely. Unlike a password manager (Option C), which still technically "types" the details, or biometrics (Option B), which requires a new physical scan, Windows Integrated SSO provides a passive experience where the existing OS-level authentication is trusted by the application, drastically improving user workflow and productivity.

This is a core concept of the Archer Data Gateway (ADG) feature. While traditional Data Feeds (Option A) and Data Imports (Option C) work by pulling a copy of external data and saving it into the Archer SQL database, Data Gateway functions differently. It provides a "window" into an external data source.

As taught in the Archer Administration II integration module, ADG allows users to view and interact with data stored in external SQL databases or other systems as if the data were inside Archer, but the information remains in the source system. This is crucial for high-volume data or sensitive information where "duplication" is prohibited by policy or storage constraints. APIs (Option D) are used to programmatically move data but still generally involve moving a copy of that data. Data Gateway is the only listed feature specifically designed for "non-duplicating" interaction.

This question reinforces a critical security concept in Archer Administration II . LDAP Synchronization is not just a "one-time" user creation tool; it is a lifecycle management service. While it does create accounts and associate groups, its most vital ongoing function is the synchronization of state .

If a user's title changes in Active Directory, the next LDAP sync will update that title in Archer, ensuring that reports and workflows based on user attributes remain accurate. Furthermore, if a user is removed from the corporate directory, the LDAP sync identifies them as a "Missing Person" based on the administrator's configuration and can automatically deactivate the Archer account. This automated deactivation is a core compliance requirement for most organizations to ensure that terminated employees lose access to sensitive GRC data immediately. Options A and C are incorrect because they use the word "Only," which ignores the broader, dynamic maintenance capabilities of the service.

This statement is TRUE and represents the standard architecture for Federated Single Sign-On. In the context of SAML (Security Assertion Markup Language), Archer acts as the Service Provider (SP) , which is the application the user wants to access. The Identity Provider (IdP) , such as Okta, PingFederate, or Azure AD, is the system that holds the user's credentials and performs the actual authentication.

As detailed in the Archer installation and security guides, when a user attempts to log into Archer via SAML, Archer sends an authentication request to the IdP. The IdP authenticates the user and sends a "SAML Assertion" (a signed digital token) back to Archer. Archer then validates this token and allows the user access without them ever having to type their password directly into the Archer interface. This workflow is a cornerstone of modern enterprise security, allowing for centralized identity management and the enforcement of Multi-Factor Authentication (MFA) at the IdP level.

In the Questionnaires and Assessment Maintenance curriculum, the Question Library acts as a "blueprint" for the final assessment. When you add a record to the Library, you aren't just adding text; you are defining the metadata for a future field.

The Question Type (e.g., Numeric, Values List, Text) and Display Format (e.g., Radio Buttons vs. Dropdown) are mandatory because they tell the Archer platform how to dynamically generate the user interface when a Questionnaire is launched. When a target record is created from a template, Archer looks at these library fields to determine which database column types to use and how the web browser should render the interaction. Without this information, the system would not know whether to provide a text box for a comment or a list of "Yes/No" options for the respondent.

In Advanced Workflow (AWF) , logic-based branching is handled by the Evaluate Content node. As taught in the Advanced Workflow Beyond the Basics course, this node acts as a "decision engine" within the workflow. An administrator configures one or more rules within the node that evaluate the fields of the record currently in the workflow.

Based on whether these rules evaluate to true or false, the record is routed down different paths (outbound transitions). For example, an Evaluate Content node might check the "Risk Rating" of a record; if the rating is "High," it transitions to an Executive Approval node; if it is "Low," it transitions directly to the Archive node. This is distinct from a User Action node (Option D), where the path is chosen manually by a person, or an Update Content node (Option B), which simply changes a field value without necessarily redirecting the workflow path.

In Archer, the LDAP Synchronization process is a comprehensive identity management tool. According to the Archer Administration II curriculum, its primary purpose is to ensure that the Archer user database mirrors the corporate directory (Active Directory/LDAP). It is not limited to just creating accounts or linking groups; its most critical function is the automation of the user lifecycle .

When the sync runs, it checks for changes in the LDAP source. If a user’s department or email changes in Active Directory, Archer updates the user profile data accordingly. Most importantly for security, if a user is disabled or removed from the LDAP group/OU being synced, Archer can automatically deactivate the account (or move it to a "terminated" status) based on the "Missing Person" configuration in the LDAP setup. This prevents unauthorized access by former employees. Options C and D are "Only" statements that describe small portions of the tool's capability, whereas Option B captures the ongoing maintenance and security synchronization that is the hallmark of the Archer LDAP service.

While Archer has been aggressively moving toward the RESTful API (Option C) for modern integrations, the ability to execute an existing Archer Report and retrieve the results has historically been a core function of the SOAP API (Web Services). Specifically, the SearchSvc (Search Service) within the SOAP API includes the ExecuteSearch and SearchRecordsByReport methods.

According to the Archer Administration II technical integration documents, the RESTful API is primarily designed for CRUD operations (Create, Read, Update, Delete) on individual records and metadata. While newer versions of the REST API are expanding, the legacy SOAP Web Services remain the primary, verified method for triggering a pre-defined "Saved Report" via an external call. The Content API (Option D) is a subset of the RESTful API focused on record data but lacks the high-level report execution engine found in the SOAP services.

To build a hierarchical view within a single application (like a "Manager" field in the Contacts application that points back to another record in the Contacts application), Archer utilizes Internal References . As taught in the Archer Administration II Advanced Search module, when an application references itself, you can use Directional Search logic to traverse the hierarchy.

By configuring the search to look "Upstream" or "Downstream" through the internal reference, Archer can recursively find all subordinates under a manager or all managers above an employee. This allows the system to flatten a complex organizational tree into a readable report. External References (Option B) are used between different applications, and Statistical Search (Option D) is used for mathematical aggregations (Sum, Count, Average). Only the combination of Internal References and Directional Search provides the specialized recursive logic required to map out a multi-level organizational hierarchy.

According to the Archer Administration and Security documentation, Single Sign-On (SSO) integration provides a multi-faceted advantage for both the end-user and the system administrator. Reduced Password Fatigue occurs because users no longer need to remember unique credentials for Archer, which directly leads to a decrease in Help Desk Costs associated with password reset requests. Increased Productivity is achieved through seamless access; users can move from their workstation or corporate portal directly into Archer without the interruption of a manual login prompt.

+1

Furthermore, Improved Security is a primary driver for SSO. By leveraging centralized authentication providers (like Active Directory via SAML 2.0 or Windows Integrated Authentication), Archer administrators ensure that corporate password policies (complexity, rotation, and MFA) are strictly enforced. When an employee leaves the organization and their account is disabled in the central directory, their access to Archer is revoked instantaneously. This eliminates the risk of "orphan accounts" existing within the Archer user database. Therefore, because SSO addresses administrative overhead, user experience, and enterprise-grade security protocols simultaneously, "All these answers are correct" is the verified professional standard.

In the Archer Questionnaire module, Display Rules function similarly to Conditional Layouts in standard applications, but they operate within the specific context of the Assessment/Questionnaire record. These rules are "active" logic. According to the Questionnaires and Assessment Maintenance curriculum, these rules are evaluated every time the questionnaire record is updated .

This means as a user is actively answering questions, the system evaluates the responses in real-time. If a user selects "Yes" to a specific question, the display rule immediately triggers to show the follow-up questions. If they change it to "No," the follow-up questions are hidden. This real-time evaluation ensures a streamlined user experience, preventing the user from seeing irrelevant questions. This is distinct from a "Save" event (Option D); if the rules only evaluated on save, the user would have to constantly save the record to see the next set of questions, which would be highly inefficient.

When moving data between two applications within the same Archer environment (often called an "Archer-to-Archer" feed), the Archer Web Services Transporter is the standard and recommended method. As detailed in the Archer Administration II Data Feed module, this transporter uses Archer’s own API (Web Services) to authenticate and "read" a report from the source application.

The transporter then passes that data to the Target section of the feed for mapping. Using a Database Query Transporter (Option C) directly against the Archer back-end SQL tables is strongly discouraged and often unsupported because it bypasses the application logic and security layers. The File Transporter (Option B) would require an intermediate step of exporting data to a CSV first. The Web Services Transporter allows for a direct, secure, and API-compliant way to keep data synchronized between inter nal applications, such as feeding "Findings" from various modules into a centralized "Master Findings" application.