Archer-Expert Archer Certified Administrator-Expert Questions and Answers

The Advanced Workflow Job Troubleshooting tool is a runtime utility designed to manage individual "instances" of records currently enrolled in a workflow. It is used to fix records that are stuck due to errors. According to the Advanced Workflow Beyond the Basics guide, this tool is purely for operational maintenance (Cancel, Reset, Restart, or "Force" movement).

Editing the Advanced Workflow structure (changing the flowchart, adding nodes, or modifying logic) cannot be done within the Troubleshooting tool. Workflow design changes must be made in the Application Builder under the Workflow tab. Attempting to "fix" a logic error by changing the design is a development task, whereas the Troubleshooting tool is an administrative task for existing data. Furthermore, editing a workflow requires saving a new version and potentially migrating active jobs, a process entirely separate from the record-level "Reset/Cancel" functions found in the Job Troubleshooting interface.

Dynamic Filtering is a sophisticated feature that allows Archer to filter data based on the context of the current record or the current user. In Archer Administration II , this is highlighted as a tool for improving the user experience by reducing "data noise."

Record Lookup (A): Allows you to filter the available records in a lookup based on a value in the current record (e.g., only show "Users" that belong to the "Department" selected on the form).

Calculated Cross Reference (B): Uses dynamic logic to automatically link records based on matching field values.

Report Object (C): When a report is placed on a record as a "Record-Level Report," Dynamic Filtering ensures the report only shows data related to that specific record (e.g., showing only "Findings" related to "Asset A" when viewing Asset A).

Advanced Search (D) does NOT support Dynamic Filtering in the same "contextual" sense; Advanced Searches use static filters or "Current User" filters, but they do not dynamically react to field values in a specific source record during the search build process like the other three objects.

In Archer, the LDAP Synchronization process is a comprehensive identity management tool. According to the Archer Administration II curriculum, its primary purpose is to ensure that the Archer user database mirrors the corporate directory (Active Directory/LDAP). It is not limited to just creating accounts or linking groups; its most critical function is the automation of the user lifecycle .

When the sync runs, it checks for changes in the LDAP source. If a user’s department or email changes in Active Directory, Archer updates the user profile data accordingly. Most importantly for security, if a user is disabled or removed from the LDAP group/OU being synced, Archer can automatically deactivate the account (or move it to a "terminated" status) based on the "Missing Person" configuration in the LDAP setup. This prevents unauthorized access by former employees. Options C and D are "Only" statements that describe small portions of the tool's capability, whereas Option B captures the ongoing maintenance and security synchronization that is the hallmark of the Archer LDAP service.

In Archer, Values List fields are strictly validated against the pre-defined options in the field configuration. During a manual Data Import , if the source file contains a value that does not exactly match an existing entry in the Values List, the import for that specific record (or the entire process, depending on settings) will fail.

According to the Archer Administration II guide, for the import to succeed with new data, the administrator must first enable the "Create new values for Values List fields" option in the Data Import settings. If this is not enabled, Archer treats the unknown value as an error. This is a critical data integrity feature that prevents "dirty data" from entering the system. Unlike a Data Feed, which has more advanced "lookup" and "creation" logic, the Data Import tool is less flexible by default to ensure administrators are consciously deciding whether to expand the application's metadata.

In the Manage Users section of Archer, the platform uses global defaults to ensure that new accounts are created with a baseline security posture. According to the Archer Administration II security module, every new user record is automatically assigned the Default Security Parameter and the Default Access Role defined in the instance settings.

The Security Parameter (Option D) governs password complexity, expiration, and session timeouts. The Default Access Role typically provides very limited "Read" access to ensure the user can at least log in to the workspace, but usually requires further administrative adjustment to grant functional permissions. A Username (Option A) must be manually entered or mapped from LDAP; Archer cannot guess a unique username. Similarly, email addresses and passwords require specific input or integration triggers. By automatically assigning the default Security Parameter and Access Role, Archer ensures that no user is created without essential security governance already in place.

The Security Events Report is the primary auditing tool for tracking administrative and sensitive user actions within the Archer platform. According to the Archer Administration II curriculum, this report captures a broad spectrum of "event-based" security data that standard access reports do not cover.

Specifically, it logs every failed login attempt , which is critical for identifying potential brute-force attacks. It also tracks metadata changes to the security infrastructure, such as when an Access Role is created or deleted , providing an audit trail of who modified the system's permissions. Furthermore, it records password changes initiated by users. While the "Locked Accounts Report" (Option B) only shows users currently barred from the system, the Security Events Report provides the historical context of why those events occurred. It is an essential resource for compliance officers and system auditors to ensure that the integrity of the Archer environment's security configuration remains intact.

The Archer Web Services Transporter is used for "Archer-to-Archer" data feeds. For the "Load Fields" button to work, Archer must be able to successfully authenticate and connect to the source instance's API to retrieve the report metadata.

As detailed in the Archer Administration II Data Feed module, if no fields appear, it almost always indicates a communication failure between the Feed Manager and the Web Service. The Transport Configuration section (found on the Source Connection tab) contains the critical connection details: the Base URL, the Instance Name, and the User Credentials. If the credentials are incorrect, the URL is mistyped, or the "Session Token" cannot be generated, Archer cannot "see" the source report's structure, and thus the field list will remain empty. Checking the connection settings is the primary troubleshooting step before looking at filters or target mappings.

In the Archer security model, record-level access is determined by the complex intersection of Access Roles , Groups , and Record Permission Fields . According to the Archer Administration II curriculum, the Investigate Access tool is the primary diagnostic utility for troubleshooting "Why can't User X see Record Y?"

Unlike standard reports, Investigate Access allows an administrator to select a specific user and a specific record (or application) and run a simulation. The tool then provides a detailed breakdown of the "Final Access" (Read, Update, Delete) and, crucially, explains how that access was derived. It will highlight if the user is being granted access via a specific Group, if a Record Permission field is restricting them, or if their Access Role lacks the necessary rights. This is more efficient than the Access Control Reports (Option C), which provide a broad overview of permissions but do not provide the record-specific context that "Investigate Access" offers for pinpoint troubleshooting.

The scenario described is a classic implementation of Windows Integrated Authentication (WIA) , a form of Single Sign-On (SSO). As detailed in the Archer Installation and Troubleshooting guides, when Archer is configured for Windows Integrated SSO, it leverages the Kerberos or NTLM protocol. Since Sarah has already authenticated to the Windows Domain at the start of her shift, her browser passes her "security token" directly to the Archer web server (IIS).

The Archer Control Panel (ACP) must be configured to recognize the domain, and the user's Archer account must have their Windows account name (e.g., DOMAIN\Username) populated in the "Domain Account" field. This creates a seamless "handshake" that bypasses the Archer login screen entirely. Unlike a password manager (Option C), which still technically "types" the details, or biometrics (Option B), which requires a new physical scan, Windows Integrated SSO provides a passive experience where the existing OS-level authentication is trusted by the application, drastically improving user workflow and productivity.

In a Multi-Host (Distributed) Environment , Archer components (Web, Application, and Database tiers) are spread across multiple physical or virtual machines to ensure high availability and scalability. According to the Archer Installation and Troubleshooting guides within the Administration II curriculum, it is a technical requirement that all servers within the Archer instance be on the same network or have high-speed, low-latency connectivity between them. This is because the Archer Control Panel (ACP) and the various services (Async, Indexing, Queuing) must communicate constantly to synchronize metadata and process jobs.

Option A is incorrect because the File Store must be accessible by both the Web and Services servers to handle attachments. Option B describes a "Single-Host" setup, not a multi-host one. Option C is false because if you have multiple Web Servers, a Load Balancer is mandatory to distribute user traffic and provide failover. Without being on the same network/segment, the latency would cause the Archer Services to "time out," leading to job engine failures and significant performance degradation across the platform.

While you initiate a manual import from the Data Imports menu (Option C), the actual execution and processing details of that task are monitored through the Job Queue . According to the Archer Administration II curriculum, once a user clicks "Import," the task is handed off to the Job Engine.

To see if the import was successful, how many rows were processed, or if any errors occurred, the administrator must navigate to Integration > Review Job Queues . This interface provides the granular details of the "Job Status," including start/end times and the specific results of the processing. This is consistent with how Archer handles all background tasks (Feeds, Recalculations, etc.). The "Data Imports" screen itself primarily serves as the portal for uploading the file and mapping fields, whereas "Review Job Queues" is the operational dashboard for tracking the actual work performed by the Archer services.

Scheduled Report Distributions behave differently than standard "On-Demand" reports. According to the Archer Administration II curriculum, when a report is scheduled for distribution (e.g., emailed as a PDF or Excel file), the Archer platform must "impersonate" a user to run the query and generate the file.

The platform uses the security context of the user who configured the Scheduled Report Distribution (typically an administrator). This means that all recipients of the email will see the exact same data—the data that the administrator is authorized to see. This is a critical security consideration: if an administrator has "System Administrator" rights and schedules a report for a group of low-privilege users, those users may see sensitive data in the attachment that they would not be able to see if they logged into Archer directly. Option B is incorrect because the system does not run a separate query for every individual recipient's unique permissions at the time of the email burst.

While the standard Archer Application Builder supports a wide array of field types, the Questionnaire module uses a more specialized subset of fields within the Question Library . According to the Questionnaires and Assessment Maintenance curriculum, questions are designed to gather specific response data that can be scored.

Valid question types include Values List (for multiple choice), Date (for timestamped responses), Numeric (for quantitative data), and Text (for qualitative comments). The User/Groups List is also a valid question type, often used to identify stakeholders or owners during an assessment. However, an Attachment is not a standalone question type in the library. In Archer Questionnaires, attachments are typically handled as "supporting evidence" linked to a specific question or the record as a whole, but you cannot define a question as an "Attachment type" in the same way you define a "Values List" question.

The Archer Question Library is a centralized repository of questions used to build questionnaires. According to the Questionnaires and Assessment Maintenance curriculum, the "Out of the Box" (OOTB) content provided by Archer is modular. When an organization licenses a specific Use Case (e.g., IT Security Risk Management, Third Party Governance, or Business Continuity), the relevant question sets for those domains are imported into the library.

For example, an organization that only licenses Third Party Governance will have a Question Library populated with vendor-related assessments (like SIG or ISO-based questions), but they will not see Business Continuity-specific questions unless that use case is also licensed. This ensures that the platform remains uncluttered and relevant to the specific business needs of the organization. The deployment option (On-Premise vs. SaaS) and the support model have no impact on the actual metadata content of the library; it is strictly driven by the licensed functional modules.

Archer's functionality is governed by a License Key . As taught in Archer Administration II , all the code for all use cases usually exists within the installer, but they are "locked" based on your organization's specific entitlements.

When a new use case is purchased, Archer provides a new alphanumeric license key. The System Administrator must log into the Archer Control Panel (ACP) , navigate to the "Instance" settings, and update the license key field. Once saved, the new use case—including its applications, workflows, and reports—becomes available for installation or activation. You do not need to perform a full system upgrade (Option C) or wait for a "push" from Archer (Option B). While you may need to download the specific Package File (.zip) for the use case from the Archer Community, the "step to gain access" and unlock the rights within your specific instance is the application of the license key in the ACP.

In the Advanced Workflow Beyond the Basics curriculum, the Wait for Content Update node is identified as the primary tool for time-based automation. While its name suggests it is waiting for a user to change a field, its secondary function is to act as a SLA (Service Level Agreement) timer .

Within the node configuration, an administrator can define an "Escalation" or "Timeout" path. You can set a specific duration (e.g., 5 days). If the expected content update does not occur within that timeframe, the node "times out" and automatically reroutes the record down a secondary transition path—typically to a manager's review or an automated notification. While a User Action node (Option B) can have a "due date," it does not automatically move the record to a different path solely based on time without the Wait for Content Update node logic. Update Content (Option D) and Send Notification (Option A) nodes are instantaneous actions and do not possess the ability to "pause" and monitor for duration.

While the Data Feed Manager (Option C) is primarily used to bring data into Archer, the Data Publication Service (DPS) is the specific tool designed to push data out of Archer into an external SQL Server database. As taught in the Data Integration module of Administration II, Data Publication allows an administrator to define a "Publication Task" that maps Archer applications and levels to external database tables.

This is the ideal solution for Sarah's HR request because the HR department can then point their own reporting tools or databases to that external "target" database without ever needing an Archer login. Data Gateway (Option B) is a legacy term or refers to specific API connectors, and Data Import (Option D) is strictly for ingestion. Data Publication ensures that the most recent "Golden Record" of the business hierarchy in Archer is synchronized to the external environment on a scheduled basis, maintaining data consistency across the enterprise.

The primary driver for Single Sign-On (SSO) in an Archer environment is user convenience and centralized identity management. As taught in Archer Administration II , the "goal" of SSO is to reduce the friction of accessing the platform. By allowing users to leverage their existing corporate credentials (via SAML, Windows Integrated, or LDAP), they can access Archer without needing to maintain a separate, "native" Archer password.

This strategy improves security by centralizing credential management in a single Identity Provider (IdP), where Multi-Factor Authentication (MFA) and account revocation policies can be strictly enforced. Option A is incorrect because SSO actually helps enforce enterprise security parameters rather than bypassing them. Option B is false because SSO is intended for all users, not just admins. Option C describes the opposite of SSO. Ultimately, the successful implementation of SSO ensures that users have a seamless transition into Archer while the organization maintains a high standard of access control.