Archer-Expert Sample Questions Answers

The Archer LDAP Synchronization service is a "one-way" synchronization tool from the Directory Server (e.g., Active Directory) to Archer.

A and D are correct: The service allows for the synchronization of users and groups (D), ensuring that any updates—such as name changes, department updates, or account deactivations (A)—made in the directory server are mirrored in Archer.

B is incorrect: LDAP Synchronization does not facilitate "automatic" login (SSO). While LDAP Authentication can be used to verify a password, the seamless "no username/password" experience is provided by Windows Integrated SSO or SAML , which are distinct from the synchronization service.

C is incorrect: Archer cannot write back to the organization's directory server. It is a consumer of LDAP data, not a manager of it. Changes made in Archer (like updating a phone number in the User Profile) will not be pushed back to Active Directory; in fact, they will likely be overwritten by the next LDAP sync.

In the Data Feed Manager , the "Target Record Processing" setting on the Run Configuration tab determines how Archer handles records that are not present in the current source file. As taught in Archer Administration II , selecting the Delete radio button (often referred to as a "destructive feed" or "mirroring") instructs Archer to compare the source file to the target application.

If the feed finds records in the target application that do not match the keys provided in the source file, it will delete them. In this scenario, since there are only 20 entries in the source file, Archer will keep (or create) those 20 records and delete the remaining 80 records that were already in the system but were missing from the source. Consequently, the final count in the target application will be 20. This setting is typically used for synchronization tasks where Archer must exactly match an external "system of record." Administrators are cautioned when using this setting, as it can lead to massive data loss if the source file is accidentally truncated or filtered incorrectly.

Archer is a Windows-based enterprise application that relies on the Microsoft technology stack. As detailed in the Archer Installation and Troubleshooting guide, there are three primary prerequisites for a successful deployment:

IIS (Internet Information Services): This is the web server that hosts the Archer web interface and APIs.

SQL Server: Archer requires a Microsoft SQL Server database to store all application data, metadata, and the instance configurations.

Microsoft .NET Framework: Archer is built on .NET; specific versions (such as 4.7.2 or higher, depending on the Archer version) must be installed for the web and service components to function.

Apache (Option A) is an alternative web server used primarily for Linux-based environments and is not a prerequisite or a supported web server for the Archer platform.

Actions by E-mail (ABE) is a feature designed to allow executives and busy stakeholders to progress a workflow without logging into the Archer UI. According to the Advanced Workflow Beyond the Basics course, ABE notifications include specific "action buttons" (e.g., Approve, Reject, Needs More Info).

When a user clicks a button, a new email is generated with a unique encoded string. If the user types a message in that reply email, the Archer Mail Processing Service parses the response. It not only moves the record to the next node based on the button clicked but also captures any text the user typed and appends it to the Workflow Action History (or a designated "Comments") field. This ensures that the rationale for the decision is audited within the record. Option A is incomplete because it ignores the comment-capturing capability, and Option C is incorrect because ABE does not support complex UI elements like drop-down menus within the email client.

In the Archer platform, the Recalculation Schedule (found within the application's General Tab) is a powerful tool, but it can become a performance bottleneck if not configured efficiently. When a recalculation job is triggered, the Archer services must evaluate every record in the application to determine if calculations need to be updated. According to the Archer Administration II curriculum, the most effective way to optimize this process is by using Calculation Filters .

By selecting option A, you are instructing the system to ignore records that are irrelevant to the specific business logic (e.g., records that are already "Expired," "Rejected," or "Draft"). By filtering the schedule to run only for "Approved" requests, the job engine processes a significantly smaller subset of data, which reduces the load on the Async Service and speeds up the completion time. Option B would likely slow the system down further by adding logical complexity to the calculation itself. Option C (Data-Driven Events) is not suitable for date-based triggers because DDEs only fire upon a record "Save" event; they cannot proactively "watch" a date to trigger a change without user intervention or a scheduled recalculation.

In Archer, the LDAP Synchronization process is a comprehensive identity management tool. According to the Archer Administration II curriculum, its primary purpose is to ensure that the Archer user database mirrors the corporate directory (Active Directory/LDAP). It is not limited to just creating accounts or linking groups; its most critical function is the automation of the user lifecycle .

When the sync runs, it checks for changes in the LDAP source. If a user’s department or email changes in Active Directory, Archer updates the user profile data accordingly. Most importantly for security, if a user is disabled or removed from the LDAP group/OU being synced, Archer can automatically deactivate the account (or move it to a "terminated" status) based on the "Missing Person" configuration in the LDAP setup. This prevents unauthorized access by former employees. Options C and D are "Only" statements that describe small portions of the tool's capability, whereas Option B captures the ongoing maintenance and security synchronization that is the hallmark of the Archer LDAP service.

In Archer, Private Fields are a high-security feature where access is restricted to specific Users or Groups, regardless of their Access Role permissions. When an administrator manages these permissions, the concept of Cascading is vital for hierarchy management.

As taught in Archer Administration II , if you grant a parent group access to a private field and select the "Cascade" option, Archer automatically extends those permissions to every child group within that hierarchy. This follows the standard inheritance model used throughout the platform's security architecture. Without cascading (Option C), only the direct members of the parent group would see the field data, and administrators would have to manually add every subgroup individually. Selecting cascade ensures that as the organization grows and new subgroups are added under the parent, those new members will automatically inherit the necessary access to view or edit the protected field.

The Archer Question Library is a centralized repository of questions used to build questionnaires. According to the Questionnaires and Assessment Maintenance curriculum, the "Out of the Box" (OOTB) content provided by Archer is modular. When an organization licenses a specific Use Case (e.g., IT Security Risk Management, Third Party Governance, or Business Continuity), the relevant question sets for those domains are imported into the library.

For example, an organization that only licenses Third Party Governance will have a Question Library populated with vendor-related assessments (like SIG or ISO-based questions), but they will not see Business Continuity-specific questions unless that use case is also licensed. This ensures that the platform remains uncluttered and relevant to the specific business needs of the organization. The deployment option (On-Premise vs. SaaS) and the support model have no impact on the actual metadata content of the library; it is strictly driven by the licensed functional modules.

This statement is TRUE and represents the standard architecture for Federated Single Sign-On. In the context of SAML (Security Assertion Markup Language), Archer acts as the Service Provider (SP) , which is the application the user wants to access. The Identity Provider (IdP) , such as Okta, PingFederate, or Azure AD, is the system that holds the user's credentials and performs the actual authentication.

As detailed in the Archer installation and security guides, when a user attempts to log into Archer via SAML, Archer sends an authentication request to the IdP. The IdP authenticates the user and sends a "SAML Assertion" (a signed digital token) back to Archer. Archer then validates this token and allows the user access without them ever having to type their password directly into the Archer interface. This workflow is a cornerstone of modern enterprise security, allowing for centralized identity management and the enforcement of Multi-Factor Authentication (MFA) at the IdP level.

In a Single-Server Installation (typically used for Sandbox, Development, or small-scale environments), the goal is to consolidate the entire Archer architecture onto one machine. According to the Archer Administration II setup guides, this means the Web Server (IIS), the Archer Services (Job Engine, Indexing), the Advanced Workflow (AWF) service, and the SQL Server Instance Database must all reside on that single host.

While production environments favor a distributed model (Option B) for performance and redundancy, a single-server setup requires that all roles are configured to point to "localhost" or the local server's IP. The administrator must ensure the server has sufficient CPU and RAM to handle the overlapping resource demands of the SQL database engine and the Archer web services simultaneously. Options C and D describe "Distributed" or "Hybrid" models, which contradict the definition of a single-server installation.

In the Archer Questionnaire module, Display Rules function similarly to Conditional Layouts in standard applications, but they operate within the specific context of the Assessment/Questionnaire record. These rules are "active" logic. According to the Questionnaires and Assessment Maintenance curriculum, these rules are evaluated every time the questionnaire record is updated .

This means as a user is actively answering questions, the system evaluates the responses in real-time. If a user selects "Yes" to a specific question, the display rule immediately triggers to show the follow-up questions. If they change it to "No," the follow-up questions are hidden. This real-time evaluation ensures a streamlined user experience, preventing the user from seeing irrelevant questions. This is distinct from a "Save" event (Option D); if the rules only evaluated on save, the user would have to constantly save the record to see the next set of questions, which would be highly inefficient.

This question reinforces a critical security concept in Archer Administration II . LDAP Synchronization is not just a "one-time" user creation tool; it is a lifecycle management service. While it does create accounts and associate groups, its most vital ongoing function is the synchronization of state .

If a user's title changes in Active Directory, the next LDAP sync will update that title in Archer, ensuring that reports and workflows based on user attributes remain accurate. Furthermore, if a user is removed from the corporate directory, the LDAP sync identifies them as a "Missing Person" based on the administrator's configuration and can automatically deactivate the Archer account. This automated deactivation is a core compliance requirement for most organizations to ensure that terminated employees lose access to sensitive GRC data immediately. Options A and C are incorrect because they use the word "Only," which ignores the broader, dynamic maintenance capabilities of the service.

Archer's functionality is governed by a License Key . As taught in Archer Administration II , all the code for all use cases usually exists within the installer, but they are "locked" based on your organization's specific entitlements.

When a new use case is purchased, Archer provides a new alphanumeric license key. The System Administrator must log into the Archer Control Panel (ACP) , navigate to the "Instance" settings, and update the license key field. Once saved, the new use case—including its applications, workflows, and reports—becomes available for installation or activation. You do not need to perform a full system upgrade (Option C) or wait for a "push" from Archer (Option B). While you may need to download the specific Package File (.zip) for the use case from the Archer Community, the "step to gain access" and unlock the rights within your specific instance is the application of the license key in the ACP.

The Data-Driven Event (DDE) Analyzer is a diagnostic tool used to see why certain UI changes (like hiding a field or making it required) occurred. As taught in the Archer Administration II troubleshooting module, the Analyzer provides a high-level summary of the DDE execution path. It will show the name of the rule (Option A), the fields involved (Option B), and the actions triggered (Option C).

However, it does not provide a granular, "Boolean-level" breakdown of every individual filter condition within a complex rule. If a rule has five different conditions joined by AND/OR logic, the Analyzer will tell you if the entire rule evaluated to True or False, but it will not specify the result of each individual condition (Option D). To see that level of detail, administrators often have to simplify the rule or use "Dummy Fields" for testing. Understanding this limitation is key to effectively using the Analyzer for debugging complex conditional layouts.

The Data Import Wizard offers three distinct processing modes: "Add New Records," "Update Existing Records," and "Add New and Update Existing Records." According to the Archer Administration II curriculum, the "Update Existing Records" mode is highly restrictive. It is used when an administrator only wants to modify records that already reside in the system.

During the import, Archer uses the specified Key Field(s) to find matches between the source file and the target application. If a match is found, the existing record is updated with the new data from the source file. However, if a row in the source file does not have a corresponding match in Archer, that row is simply ignored and discarded . No new records are created. This is a safety measure to prevent the accidental creation of "orphan" or duplicate data when the intent is strictly maintenance of existing content. If an administrator wishes to both update matches and create new records for non-matches, they must specifically choose the "Add New and Update Existing Records" (Upsert) option.

According to the Archer API Guide and Administration II materials, the Archer APIs have specific formatting requirements based on their architecture. The SOAP API (Simple Object Access Protocol) is strictly bound to the XML-based SOAP protocol. It uses a Web Services Description Language (WSDL) to define the structure of its messages, and these messages must be formatted as XML . It cannot process or return JSON payloads.

In contrast, the RESTful API is more flexible; while it defaults to JSON for modern integrations, it is capable of supporting both XML and JSON depending on the "Content-Type" and "Accept" headers provided in the request. The Content API , which is a specific subset of the Archer RESTful infrastructure, also follows these multi-format capabilities. Therefore, the statement that the SOAP API can use JSON is the incorrect one. For administrators building integrations, understanding this distinction is vital, as modern web applications typically prefer JSON, but legacy Archer SOAP services will reject any request that is not valid XML.

In a distributed (multi-host) Archer environment, the Archer Configuration Service is the most critical underlying component that must exist on every server in the web and services tiers. As taught in Archer Administration II , this service is responsible for "registering" the server with the Archer Control Panel (ACP) .

The Configuration Service allows the central ACP to communicate with each node in the cluster to manage settings, update the nlog.config files, and ensure that all servers are using the correct database connection strings. While the Queuing Service (Option C) might only reside on the Services server, and the Workflow Service (Option B) is specific to AWF tasks, the Configuration Service is the "heartbeat" that connects any given Archer server to the instance's central management framework. If this service is stopped on a web server, that server will effectively become "orphaned" and will not be able to process user requests correctly or receive updates from the ACP.

This statement is FALSE . The default authentication mechanism for a fresh installation of Archer is Archer Native Authentication . As detailed in the Archer Installation and Troubleshooting guide, when an instance is first created, it relies on the internal Archer database to store usernames and encrypted passwords.

Single Sign-On (SSO), whether it be Windows Integrated, SAML, or LDAP-based, is an opt-in configuration that must be manually enabled and configured by a System Administrator within the Archer Control Panel (ACP) . Native authentication remains the fallback method and is used for the initial "System Administrator" account setup. While most enterprise organizations quickly transition to SSO for security and convenience, the platform itself defaults to its own internal authentication engine to ensure the system is accessible immediately after installation without requiring a pre-existing connection to an Identity Provider (IdP).