Backing up Tableau Server ensures recovery from failures or migrations. A full backup includes multiple data types—let’s dissect this comprehensively:

Backup Components:

Repository Data: PostgreSQL database with metadata (users, permissions, workbooks). Backed up via tsm maintenance backup -f .tsbak.

Configuration Data: Server settings (e.g., ports, authentication) also in the .tsbak file.

Server Secrets: Encryption keys, internal tokens, Repository passwords—critical for restoring functionality.

Extracts: .hyper files in File Store (optional, separate backup).

Option A (Server secrets and Repository passwords): Correct.

Details: Includes encryption keys (for extracts), internal tokens (process communication), and Repository credentials. Backed up separately or stored securely (e.g., tsm security export-keys).

Why Critical: Without these, restored data may be inaccessible or services may fail.

Option C (Configuration data): Correct.

Details: Ports, authentication settings, process topology—part of the .tsbak file.

Why Critical: Restores server behavior and connectivity post-recovery.

Option D (Repository data): Correct.

Details: Core metadata database—also in .tsbak.

Why Critical: Without it, all content and user data is lost.

Option B (Topology data): Incorrect.

Details: Topology (process distribution) is part of configuration data in the .tsbak, not a separate entity. It’s not distinctly backed up as “topology data.”

Why This Matters: A complete backup (secrets, config, repository) ensures full restoration—missing any piece risks an unusable server.

TSM commands manage Tableau Server maintenance—let’s validate their syntax:

Command Requirements:

Some need arguments (e.g., file paths); others are standalone.

Valid and Complete: Must work as-is without errors.

Option C (tsm maintenance cleanup): Correct.

Details: Removes temporary files and old logs—no arguments required (optional flags like -l exist).

Use: tsm maintenance cleanup—runs fully.

Option D (tsm maintenance ziplogs): Correct.

Details: Creates a zip of logs (e.g., tsm-logs.zip)—no arguments needed (optional -d for date range).

Use: tsm maintenance ziplogs—complete and valid.

Option A (tsm maintenance backup): Incorrect.

Why: Requires -f .tsbak (e.g., tsm maintenance backup -f backup.tsbak)—incomplete without it.

Option B (tsm maintenance restore): Incorrect.

Why: Needs -f .tsbak (e.g., tsm maintenance restore -f backup.tsbak)—not standalone.

Why This Matters: Correct syntax ensures maintenance tasks execute without errors—critical for server health.

Kerberos delegationallows Tableau Server to pass a user’s Kerberos credentials to a data source for seamless authentication (SSO)—let’s explore which sources support it:

Kerberos Overview:

Used with Active Directory (AD) for SSO in Windows environments.

Tableau Server delegates the user’s ticket to the data source, avoiding embedded credentials.

Requires:

Data source support for Kerberos.

Proper configuration (e.g., SPN, constrained delegation).

Supported Data Sources: Per Tableau’s documentation:

Option A (Teradata): Correct.

Details: Supports Kerberos delegation—common in enterprise data warehouses.

Config: Enable in TSM (tsm authentication kerberos configure) and set SPN for Teradata.

Option C (SQL Server): Correct.

Details: Fully supports Kerberos—widely used with AD-integrated SQL Server instances.

Config: Requires AD setup and "Trustworthy" delegation in SQL Server.

Option D (SAP HANA): Correct.

Details: Supports Kerberos SSO via delegation—popular in SAP ecosystems.

Config: Needs HANA Kerberos setup (e.g., keytab) and Tableau Server integration.

Option B (PostgreSQL): Incorrect.

Why: Supports Kerberos authentication natively, but Tableau Server doesn’t enable delegation to PostgreSQL—users must embed credentials or use other methods (e.g., OAuth).

Why This Matters: Kerberos delegation enhances security by avoiding stored passwords—knowing supported sources ensures SSO feasibility.

Tableau Server provides multiple methods to creategroups(collections of users) andprojects(content containers), catering to UI, CLI, and programmatic needs. Let’s dissect each option with depth:

Option B (Tableau Server browser interface): Correct.

Groups: Go toUsers > Groups > Add Group, name it, and optionally sync with Active Directory.

Projects: Go toContent > Projects > New Project, set name, description, and permissions.

Details: The web UI is intuitive, requiring server/site administrator rights. It’s ideal for manual, ad-hoc creation with immediate visibility.

Permissions: For projects, you can set default permissions or lock them here.

Option C (tabcmd): Correct.

Groups: tabcmd creategroup "GroupName" creates a local group. Add users with tabcmd addusers "GroupName" --users "user1,user2".

Projects: tabcmd createproject -n "ProjectName" -d "Description" creates a project.

Details: tabcmd is a command-line tool for batch operations or scripting (e.g., automating group/project setup). It requires a server admin login (tabcmd login).

Limitation: No AD sync via tabcmd—that’s UI or REST API territory.

Option D (REST API): Correct.

Groups: Use the POST /api/api-version/sites/site-id/groups endpoint with a payload (e.g., {"group": {"name": "GroupName"}}). Supports AD import too.

Projects: Use POST /api/api-version/sites/site-id/projects (e.g., {"project": {"name": "ProjectName", "description": "Desc"}}).

Details: The REST API is programmatic, ideal for integration with external systems or bulk automation. Requires authentication via a token and server/site admin rights.

Power: Offers full control, including nested projects and custom permissions.

Option A (tsm customize): Incorrect.

Purpose: tsm customize modifies TSM UI branding (e.g., logos, colors) via commands like tsm customize --logo "path/to/logo.png".

Why Wrong: It’s unrelated to creating groups or projects—it’s for cosmetic server configuration, not content/user management.

Why This Matters: Offering UI, CLI, and API options ensures flexibility—manual for small tasks, automation for scale—critical in enterprise deployments.

Backing up Tableau Server ensures recovery from failures or migrations. A full backup includes multiple data types—let’s dissect this comprehensively:

Backup Components:

Repository Data: PostgreSQL database with metadata (users, permissions, workbooks). Backed up via tsm maintenance backup -f .tsbak.

Configuration Data: Server settings (e.g., ports, authentication) also in the .tsbak file.

Server Secrets: Encryption keys, internal tokens, Repository passwords—critical for restoring functionality.

Extracts: .hyper files in File Store (optional, separate backup).

Option A (Server secrets and Repository passwords): Correct.

Details: Includes encryption keys (for extracts), internal tokens (process communication), and Repository credentials. Backed up separately or stored securely (e.g., tsm security export-keys).

Why Critical: Without these, restored data may be inaccessible or services may fail.

Option C (Configuration data): Correct.

Details: Ports, authentication settings, process topology—part of the .tsbak file.

Why Critical: Restores server behavior and connectivity post-recovery.

Option D (Repository data): Correct.

Details: Core metadata database—also in .tsbak.

Why Critical: Without it, all content and user data is lost.

Option B (Topology data): Incorrect.

Details: Topology (process distribution) is part of configuration data in the .tsbak, not a separate entity. It’s not distinctly backed up as “topology data.”

Why This Matters: A complete backup (secrets, config, repository) ensures full restoration—missing any piece risks an unusable server.

Tableau Server consists of multiple processes managed by TSM. When you stop Tableau Server (e.g., via tsm stop), most application processes halt, but some TSM-specific processes remain active to manage the server’s infrastructure. Let’s examine each:

TSM Processes: These include the Administration Controller, Administration Agent, and License Manager, which handle configuration, monitoring, and licensing.

Application Processes: These include VizQL Server, Backgrounder, Data Server, etc., which deliver Tableau’s core functionality and stop when the server is stopped.

When tsm stop is executed:

TheAdministration Controller(port 8850) continues running to manage TSM operations (e.g., restarts, status checks).

TheLicense Managerremains active to validate licenses and ensure compliance, even when the server is offline.

Application processes like VizQL Server and Backgrounder shut down, as they’re tied to user-facing services.

Option B (License Manager): Correct. It persists to handle licensing tasks, ensuring the server can restart without license issues.

Option D (Administration Controller): Correct. It’s the core TSM process, always running to accept commands and manage the server state.

Option A (VizQL Server): Incorrect. VizQL stops, as it renders visualizations for users—an application process tied to active server operation.

Option C (Backgrounder): Incorrect. Backgrounder stops, as it processes background tasks (e.g., extract refreshes), which halt when the server is down.

Why This Matters: Understanding which processes persist helps administrators troubleshoot and manage server lifecycle events effectively.

In Tableau Server, roles and permissions dictate who can perform specific administrative tasks. A "server administrator" has full control over the entire Tableau Server deployment, while site administrators manage specific sites. Some tasks are restricted to server administrators due to their server-wide impact.

Option B (Adding a site): Creating a new site in a multi-site Tableau Server environment is a server-level task that only a server administrator can perform. Sites are logical partitions within the server, and adding a site affects the overall server structure. Site administrators cannot create new sites; they can only manage existing ones.

Option D (Adding users): Adding users to Tableau Server (e.g., via the TSM interface or tabcmd) is a server administrator task when it involves adding users at the server level or assigning them to the default site. While site administrators can add users to their specific site in a multi-site environment, the initial addition of users to the server requires server administrator privileges. The question’s phrasing (“always require”) suggests a server-wide context, making this a correct choice.

Option A (Creating a schedule): This is incorrect because both server administrators and site administrators can create schedules for tasks like extract refreshes or subscriptions within their scope. It’s not exclusive to server administrators.

Option C (Locking project permissions): This is incorrect because locking project permissions can be done by a site administrator or project leader with appropriate permissions. It’s a project-level action, not a server-level task requiring a server administrator.