Explanation:

Why B is Correct?

A dedicated 'Run As' service account follows the principle of least privilege, ensuring Tableau Server has only the permissions it needs to function (e.g., file system access, network ports) without excessive rights.

This enhances security by reducing the attack surface—compromising the service account won’t grant broader system access.

Tableau’s Installation Guide for Windows explicitly recommends this practice.

Why Other Options Are Incorrect?

A. Unlimited administrative access: Dangerous—violates security best practices and risks system integrity.

C. Granting all users admin access: A major security flaw; service accounts are for system processes, not end users.

D. Automatic updates: Unrelated—updates are managed via Tableau Services Manager (TSM), not the service account.

Key Benefits of a Dedicated Service Account:

Security: Limits damage from potential breaches.

Stability: Prevents conflicts with other services/user accounts.

Auditability: Isolates Tableau Server actions in logs.

Reference:

Microsoft’s Service Account Best Practices.

Final Note:

B is the only secure and compliant approach. Options A/C/D introduce unnecessary risks or misunderstandings of service accounts. Always configure with least privilege.

Explanation:

Why B is Correct?

1. Financial institutions require high availability, data integrity, and compliance (e.g., GDPR, SOX, Basel III).
2. Frequent backups minimize data loss in case of failure.
3. Encryption ensures data security (mandatory for regulatory compliance).
4. Off-site storage protects against physical disasters (e.g., fire, flood).
5. Quick recovery mechanisms (e.g., failover clusters, standby servers) ensure business continuity.

Reference:
Tableau’s Disaster Recovery Best Practices recommend encrypted, geographically redundant backups.

Why Other Options Are Incorrect?

A) Infrequent on-site backups risk data loss and fail compliance (no off-site redundancy).
C) Manual backups on removable drives are error-prone, insecure, and non-scalable.
D) Cloud-only strategies may violate data sovereignty laws (some regulations require on-premises copies).

Key Takeaway:
A multi-layered, compliant disaster recovery plan is critical for financial institutions using Tableau Server.

Explanation:

Why B is Correct?

Redirection URI mismatches are the most common cause of OpenID Connect (OIDC) failures.

The exact URI (including protocol https://, path, and trailing slashes) must match identically in:

The OIDC provider’s app registration (e.g., Azure AD, Okta).

Tableau Server’s OIDC configuration (tsm authentication oidc).

Even minor discrepancies (e.g., http:// vs. https:// or missing /) will break authentication.

Why Other Options Are Less Likely?

A. Load balancing: Relevant for general server performance but unrelated to OIDC’s authentication flow.

C. SSL encryption strength: OIDC requires HTTPS, but failures are due to configuration errors, not certificate strength.

D. Token storage capacity: Rarely an issue—Tableau Server handles token caching efficiently.

Steps to Verify the Redirection URI:

Compare with the OIDC provider’s settings:

Ensure URIs match exactly (e.g., https://tableau.example.com/oidc/callback).

Test authentication: Use browser developer tools to check for redirect_uri errors.

Reference:

Tableau’s OIDC Troubleshooting Guide lists URI mismatches as the top issue.

OpenID Connect RFC 6749 mandates exact redirect URI matching.

Final Note:

Always start with B—90% of OIDC issues stem from URI mismatches. If resolved, then check SSL (C) or provider logs.

Explanation:

Why B is Correct?

A full backup is non-negotiable before any major upgrade to:

Prevent data loss if the upgrade fails.

Enable rollback to the previous version if critical issues arise.

Tableau’s Upgrade Documentation mandates this as the first step.

Why Other Options Are Less Critical?

A. Disabling user access: Necessary during the upgrade but doesn’t protect data integrity.

C. OS updates: Important for security but secondary to backing up Tableau’s repository/data.

D. Removing nodes: Risky—may destabilize the cluster; upgrades should handle nodes sequentially.

Key Steps for a Safe Multi-Node Upgrade:

Upgrade nodes one by one (starting with the primary node).

Validate functionality after each node upgrade.

Reference:

Tableau’s Backup and Recovery Guide.

Final Note:

B is the only step that ensures recoverability. Options A/C/D are procedural but don’t safeguard against catastrophic failure. Always test backups before upgrading!

Explanation:

Why Option B is Correct:

Connected Apps in Tableau Server use OAuth 2.0 for secure authentication. The critical step is:

Registering the app in Tableau Server (via Admin settings).

Generating client credentials (client ID and secret) to authenticate API calls.

This ensures:

Secure token-based access (no password sharing).

Granular permissions (scopes control what the app can do).

Reference: Tableau Connected Apps Guide.

Why Other Options Are Incorrect:

A) Unique user accounts:

Defeats the purpose of OAuth (apps should not use individual user accounts).

C) Extra storage:

Irrelevant to authentication (storage is managed separately).

D) Dedicated VPN:

Overkill for OAuth—SSL/TLS encryption is sufficient.

Steps to Configure a Connected App:

Go to Tableau Server Admin > Settings > Connected Apps.

Click Register App and enter:

App Name (e.g., "DataWarehouse-Integration").

Redirect URI (for OAuth callbacks).

Save to get Client ID and Secret.