Okta Certified Consultant Hands-on Configuration Exam

Introduction

Congratulations on beginning the process to prepare for your Okta Consultant certification.

This exam study guide is designed to help you prepare for the Okta Certified Consultant Hands-On Configuration Exam. It contains a detailed list of the topics covered on this exam, as well as a list of preparation resources. 

Passing this exam or the Okta Certified Consultant exam is a requirement for becoming an Okta Certified Consultant. It is also a prerequisite for anyone seeking to become an Okta Certified Technical Architect. The Okta Consultant Hands-On Configuration exam is based on the Okta Identity Engine and includes both Discrete Option Multiple Choice (DOMC) questions and hands-on configuration tasks. The Okta Certified Consultant exam is based on the Okta Classic Engine and is comprised entirely of DOMC questions. 

How to use this study guide

At minimum, we highly recommend that you thoroughly review each topic listed in the Consultant Exam subject areas section of this study guide. Make sure you understand each topic. If you are not familiar with a topic, research it by either using one of the corresponding preparation resources or searching the Okta Help Center or Okta Product Documentation Library. Some topics are best learned through hands-on experience with the Okta service.

What does it mean to be an Okta Certified Consultant?

Okta Certified Consultants are technically proficient at implementing the Okta service in a variety of configurations. Consultants have experience integrating common applications such as Microsoft Office 365, Google Workspace, Box, and Salesforce with Okta. They also have extensive knowledge and experience scoping and implementing complex Okta integrations involving multi-forest and multi-domain environments, advanced single sign-on (SSO), and inbound federation with Okta. Consultants have working knowledge of Okta APIs and custom configuration options.

Who should take the Okta Certified Consultant Hands-On Configuration Exam?

The primary candidates for the Okta Certified Consultant certification are individuals who hold the Okta Certified Administrator certification and are involved with implementing Okta. Okta recommends that candidates for the Okta Certified Consultant certification meet the following requirements at minimum:

• More than five years of experience in security administration for Identity and Access Management
• One year of hands-on experience implementing Okta
• Successful completion of Advanced Profile Sourcing Techniques and Inbound Federation: Using Okta as a Service Provider courses or equivalent training
• Hands-on experience implementing attribute-level sourcing across directory services and human resource systems as a source of truth for users, as well as experience migrating user data and passwords from an existing source of truth into Okta
• Experience using various Okta tools (Examples: SAML Wizard, Okta RADIUS Agent, OIDC flows) on advanced SSO integrations
• Experience with Advanced Server Access management and OAuth 2.0 roles
• Understanding of Okta Access Gateway use cases and benefits
• Experience implementing custom configurations with Okta using various tools (Examples: Okta on-premises provisioning (OPP), custom email domain, sign-in screen, sign-in widget, custom vanity login UI, custom URL, MFA as a Service, on-premises MFA, SCIM App Wizard)
• Experience with advanced configurations of directory agents (Active Directory and LDAP), Desktop SSO, verbose logging, and proxy settings
• Experience implementing inbound federation with Okta
• Ability to configure adaptive MFA, behavioral detection, pre-authentication sign-on, and ThreatInsights 
• Understanding of  device trust
• Understanding of how Okta APIs, API Access Management, scopes, and claims can be used to implement custom solutions
• Experience using Okta APIs in a non-production lab environment, and familiarity with API collections

About the Okta Certified Consultant Hands-On Configuration Exam

Exam Scheduling

Okta certification exams are administered and proctored by Examity®, a secure online proctoring service. Okta has partnered with Examity to protect the integrity of our certification exams. Online proctoring means that you can take Okta exams from almost any location at a time that is convenient for you, without requiring that you travel to a test center. Your Okta certification exam must be scheduled at least 24 hours in advance of the time you plan to sit for the test in order to avoid the additional fee associated with on-demand testing. You can schedule your exam through the Okta Certification Credential Manager.

Understanding the types of items included on this exam

Part I of this exam includes Discrete Option Multiple-Choice (DOMC) items. Part II contains performance-based, hands-on use cases.

Understanding the DOMC item type

Part I of this exam consists of 43 DOMC items. DOMC is a powerful measurement tool that produces reliable test scores. It does so by removing several “contaminants” that affect test outcomes but are unrelated to the knowledge and skills being tested. The DOMC item type levels the playing field, and more fairly measures your skills by improving:

• Readability. Because you are required to read less text, the exam tends to take less time and places fewer demands on the slower reader or the non-native English speaker.
• Fairness. When savvy test takers are unsure of an answer, they look for clues by comparing options or gleaning information from other items on an exam. DOMC removes this test-taking advantage and serves as a powerful method to assess your actual knowledge.
• Security. Instead of displaying all options at the same time, options are randomly presented one at a time. For each option presented, you must make a YES or NO decision to indicate whether you think the option is correct. Answer options are presented in random order, and in most instances, you are NOT presented with all the available options associated with a DOMC item. Item exposure is limited by presenting only a subset of the available options to you. Limiting item exposure helps ensure the integrity of the exam.

Scoring

You can be assured that the DOMC item type is scored fairly and with precision.

• If you are presented with a correct option and respond YES, then that response is scored as “correct". A DOMC item can be programmed to require one or more correct responses in order to be complete and to be considered answered correctly. Typically, however, only one correct response is required.
• If you are presented with a correct option and respond NO, then that item is scored as “incorrect”.
• If you are presented with an incorrect option and respond YES, then that item is scored as “incorrect”.
• If you are presented with an incorrect option, and respond NO (technically, a correct response), the item is not scored until additional options are presented and responded to.

Note: Even after you respond correctly or incorrectly to an item, additional correct or incorrect options might be presented but your responses to those options will not be scored at all. This is done to prevent you from guessing the correctness or incorrectness of a response.

The DOMC item format might require that you make some adjustments to your usual test-taking approaches. The reward of such effort is confidence that those test takers who become certified are truly competent in the areas tested on the exam and will represent excellence in the field.

To learn more about DOMC items, visit https://domc.caveon.com/home. In addition, the Okta Consultant Practice and Premier Practice Exams will help you become accustomed to the new test format. We highly recommend that you become familiar with the format of this item type before taking any Okta certification exams.

Understanding the performance-based use cases on this exam

Part II of the exam contains instructions for Part II, the credentials needed to access the Okta orgs that are assigned at the beginning of the exam, high level background information, and four use cases. The information, org credentials, and four use cases are accessible through tabs on the exam screen. Each use case consists of configuration tasks that test takers are asked to complete in their assigned Okta Identity Engine Preview Orgs. This exam allows test takers to demonstrate their skill with the Okta service in a natural way that mimics how administrators use Okta on the job. 

We recommend that test takers complete the use cases and tasks in order because completing some tasks depend on the successful completion of previous tasks. 

Scoring of Performance-Based Use Cases

Uses cases are graded upon the submission of the exam or immediately at the end of the 120-minute time clock allotted for this part of the exam. A scoring rubric is used to grade this exam. The grading process is automated using scripts to query the logs of the Okta tenants, as well as APIs to validate specific configurations. As it is a program policy, we provide a final Pass or Fail decision only. We do not provide grades, nor do we make public the minimum amount of points an exam taker needs to pass our exams.

Submitting the Exam

At the bottom of the page is a blue button labeled "Save & Submit Exam". After you have completed all of the use cases and you are ready to submit your exam, click the SAVE & SUBMIT EXAM BUTTON. When you do, you will be presented with a confirmation popup. Clicking the YES, SUBMIT NOW button will end your exam and submit it for grading.

Preparing for the Okta Consultant Hands-On Configuration Exam

A combination of instructor-led training courses, self-paced learning, self-study, and on-the-job experience will prepare you to take this exam.

Okta resources

• The Okta Help Center contains a knowledge library of articles and videos, some of which are pertinent to topics covered on this exam.
• The Okta Content Library offers searchable white papers with a rich body of information to explore before your exam.
• Join the Okta Community to review questions, discussions, ideas, and blogs for additional exam preparation.

Certified Consultant Hands-On Configuration Exam subject areas

Part I subject areas

The following table lists the topics that are covered in Part I of the exam. These topics are grouped into topic areas, and topic areas roll up into domains/exam sections. Use this list as an outline to guide your study and validate your readiness for Part I of this exam. 

• About profile sources
• Prioritize profile sources
• Define the attribute profile source

• Prioritize profile sources

• About profile sources
• About attribute-level sourcing
• Workday Real Time Sync
• Import users from an app
• Match imported user attributes

• Okta User Migration Guide

• Workday
• Grant Provisioning Group Admin privileges to a Workday Administrator
• Considerations

• Map custom attributes
• Configure the CSV directory integration profile attributes

• Create SAML app integrations using AIW

• Advanced Server Access
• Get started with Advanced Server Access
• Audit events

• About Access Gateway
• Configure your Okta tenant as an Identity Provider
• About Access Gateway security best practices
• Configure Admin /etc/hosts entry
• Generic applications

• Implement authorization by grant type

• OpenID Connect
• A Beginner's Guide to JWT

• Okta RADIUS Integrations

• About the Okta RADIUS server agent
• RADIUS common issues and concerns
• Install and configure the RADIUS agent in AWS
• RADIUS deployment architectures
• Using NTRadPing to Test Okta Radius Functionality

• Troubleshoot provisioning

• Provision on-premises applications
• Enable the Transport Layer Security 1.2 protocol
• Install the Okta Provisioning Agent
• Connect to a SCIM connector
• Configure the API call timeout period

• Configure a custom email domain

• Redirect unauthenticated users to a custom login page

• Redirect vs. embedded
• Okta deployment models - redirect vs. embedded

• Customize the Okta URL and email notification domains

• Provide your own certificate authority for managed devices
• Certificate management tasks

• Troubleshooting MFA integrations
• MFA for Active Directory Federation Services (ADFS)

• Inline hook timeout behavior
• Commands
• Telephony inline hook reference
• Supported commands
• Registration inline hook reference
• Token inline hook reference

• About on-premises provisioning
• Create SAML app integrations using AIW
• Add SCIM provisioning to app integrations

• Register multiple domains to an Okta Active Directory agent

• Integration with existing Active Directory forests and domains
• Prepare Active Directory for the integration
• Active Directory integration known issues
• Configure Active Directory import and account settings
• Define the attribute profile source

• About Active Directory Desktop Single Sign-on and Just-in-Time provisioning
• Configure agentless Desktop Single Sign-on
• Active Directory Desktop Single Sign-on
• About the agentless Desktop Single Sign-on workflow
• Desktop Single Sign-on troubleshooting
• Configure browsers for agentless Desktop Single Sign-on on Windows

• Install the Okta LDAP Agent

• LDAP integration features
• AD LDS LDAP integration reference
• Configure Active Directory import and account settings
• Active Directory integration prerequisites

• LDAP interface known issues
• LDAP interface connection settings
• Set up and manage the LDAP interface
• Expose app groups in the LDAP interface directory information tree
• Does DUO Security work as an MFA factor for LDAP interface?

• Configure Identity Provider routing rules

• Make Azure Active Directory an identity provider
• Create an app at the Identity Provider
  
• Create an Identity Provider in Okta

• Planning for SAML
• How to configure SAML 2.0 for Okta Org2Org Application

• Social IdP settings
• Add an external identity provider

• Configure Identity Provider routing rules
• Add a SAML Identity Provider
• Custom IdP authenticator
• Configure Identity Provider routing rules

• Add a SAML Identity Provider
• Create an Identity Provider in Okta

• The big picture

• Integrate Okta Org2Org with Okta

• Okta FastPass
• Okta FastPass FAQ
• Configure Okta FastPass

• Behavior detection and evaluation

• Global Session Policy
• Global Session Policy evaluation
• Add a global session policy rule
• Edit a global session policy

• Add an authentication policy rule
• Default policies
• Add an authentication policy rule
• Authentication policies

• Sign-on policies

• Configure Identity Provider routing rules
• Identity Provider routing rules

• Okta ThreatInsight
• Okta ThreatInsight Whitepaper

• About Okta ThreatInsight

• Core Okta API

• Users API

• Which authorization server should you use
• Implement authorization by grant type
• Create scopes

• API Access Management
• Simple use cases
• Which authorization server should you use
• Access token
• Endpoints

• Request a token that contains the custom claim
• Reserved scopes and claims
• Scope values
• Scopes

• Authorization server
• Securing applications

• What kind of client are you building?
• OAuth 2.0 and OpenID Connect Overview
• OAuth 2.0
• Recommended flow by application type
• Implicit flow

• MyAccount API
• SDK and tools
• Reset password