EAEP2201 Practice Questions

The minimum number of instances for an ArcGIS Server service, whether using a dedicated or shared pool, is a per-machine setting. When an ArcGIS Server site is expanded from one to three machines, the service configurations are replicated across all machines in the site. Consequently, each of the three machines will run the specified minimum number of ArcSOC processes for every service. This results in the total minimum number of running ArcSOCs across the entire site being three times the original amount.

B. The same number of ArcSOCs will be running: This is incorrect because the minimum instance count is not a site-wide total that is distributed among machines. It is a setting applied individually to each machine in the site.

C. One and a half times as many ArcSOCs will be running: This is incorrect. The distribution of services between shared and dedicated instance pools does not change the scaling factor, which is directly proportional to the number of machines in the site.

1. Esri ArcGIS Enterprise Documentation. (2024). Configure service instance settings.

Section: "The number of instances"

Quote/Paraphrase: The documentation explicitly states

"The minimum and maximum number of instances settings are specified on a per-machine basis." This confirms that adding machines multiplies the total number of minimum instances by the number of machines in the site.

2. Esri ArcGIS Enterprise Documentation. (2024). About ArcGIS Server sites.

Section: "How a multiple-machine site works"

Quote/Paraphrase: This section explains that in a multiple-machine site

services run on all server machines within the site. It clarifies

"In a multiple-machine site

each machine has its own set of service instances to process requests." This supports the principle that instance counts are applied per machine.

3. Esri Training. (2023). ArcGIS Enterprise: Configuring a Base Deployment (Course materials).

Module: "Administering an ArcGIS Server Site"

Concept: The course materials detail that when a service is published to a multi-machine site

its configuration

including the minimum number of instances

is applied to each server participating in the site. Therefore

a service with a minimum of one instance on a three-machine site will have a total of three minimum instances running (one per machine).

When a map image layer is published to ArcGIS Enterprise, it captures the schema of the source data at that moment. This schema is stored within the service definition and is used by the service to draw the map and respond to requests. Subsequent changes to the underlying database schema, such as adding a new field, are not automatically detected by the running service. Restarting the service only reinitializes the existing service configuration; it does not re-read the source data's schema. To incorporate the schema change, the service must be overwritten with a new definition based on the updated data source.

B. The ArcGIS Enterprise portal is a client of the map service. If the new field is not exposed in the service's REST endpoint, the portal has no way to access or display it.

C. Schema locking prevents schema changes on the source data while a service is running. Re-enabling it would not help the service recognize a change that has already occurred.

D. There is no "enterprise geodatabase cache" that, when cleared, would cause a map service to re-read its source schema. The service's schema is fixed at the time of publishing.

1. Esri ArcGIS Pro Documentation

"Overwrite a map service": "You may need to overwrite a map service to reflect changes in the source data

such as updating the data's schema... Overwriting the service is the only way to update the service with these changes."

Source: https://pro.arcgis.com/en/pro-app/latest/help/sharing/overview/overwrite-a-map-service.htm (Accessed under the main section "Overwrite a map service").

2. Esri ArcGIS Enterprise Documentation

"What is a map service?": "When you publish a map service

the server exposes the contents of your map document to others... The map service makes maps

features

and attribute data available to client applications." This implies the service is a snapshot of the map document at the time of publishing.

Source: https://enterprise.arcgis.com/en/server/latest/publish-services/windows/what-is-a-map-service.htm (Accessed under the section "What can you do with a map service?").

3. Esri ArcGIS Enterprise Documentation

"Schema locking": "Schema locking prevents you from changing the schema of a dataset or class while it is in use... If you need to make changes to a dataset's schema

the lock must be released." This document explains the purpose of schema locking

confirming it is a preventative measure

not a tool for updating a service's awareness of schema changes.

Source: https://enterprise.arcgis.com/en/portal/latest/use/schema-locking.htm (Accessed under the main section "Schema locking").

When a 3D scene is published from ArcGIS Pro to ArcGIS Enterprise as a hosted scene layer, the data is stored in the tile cache data store. This data store is specifically configured to manage the caches for hosted scene layers and tile layers. Scene layers are pre-generated caches (in the I3S/SLPK format) optimized for fast visualization of large 3D datasets over the web. The tile cache data store provides a highly scalable, file-based storage solution required for these caches.

B. Relational: The relational data store is used for storing the data of hosted feature layers, not the caches for scene layers.

C. Raster: Raster is a data format, not a type of ArcGIS Data Store. While raster data can be published as a tile layer, its cache is stored in the tile cache data store.

1. Esri ArcGIS Enterprise Documentation. "An overview of ArcGIS Data Store." ArcGIS Enterprise 11.2 Documentation. This document explicitly states: "Tile cache data store—Stores caches for hosted scene layers."

2. Esri ArcGIS Enterprise Documentation. "Data stores used with ArcGIS Server." ArcGIS Enterprise 11.2 Documentation. This resource details the different data store types and their specific functions

clarifying that the tile cache data store is for scene layer caches.

3. Esri ArcGIS Enterprise Documentation. "Publish hosted scene layers." Portal for ArcGIS 11.2 Documentation. This guide explains the publishing workflow and notes: "The cache for the scene layer is stored in the tile cache data store that is registered with the portal's hosting server."

For a multi-machine ArcGIS Enterprise deployment, a domain account is necessary for the software components to communicate and access shared network resources. A group-managed service account (gMSA) is the recommended type of domain account for this purpose. A gMSA is managed by the domain controller, which handles password management automatically. This ensures that services can run continuously without interruption from password expiration policies, directly fulfilling the requirements of the scenario. Using a gMSA is a security best practice for enterprise environments.

A. A GIS administrator account: Using a personal administrator account is not best practice. If the administrator's password expires or the account is disabled, the ArcGIS services will fail.

C. Create local accounts for every machine being used: Local accounts do not have permissions to access network shares on other machines, which is a requirement for a distributed ArcGIS Enterprise deployment.

D. Windows built-in account with local admin privileges: Built-in accounts, such as the Local System account, have extensive local privileges but limited network access capabilities, making them unsuitable for multi-machine deployments.

1. Esri ArcGIS Enterprise Documentation. (2024). The ArcGIS Server account. ArcGIS Enterprise 11.2 Documentation. Retrieved from https://enterprise.arcgis.com/en/server/latest/install/windows/the-arcgis-server-account.htm.

Section: The ArcGIS Server account > Domain account: "For production systems

it's recommended that you use a domain account or group managed service account (gMSA)... A gMSA is a type of domain account that is managed by a domain controller. It provides a secure way to run services without having to manually manage the account's password."

2. Esri ArcGIS Enterprise Documentation. (2024). The Portal for ArcGIS account. ArcGIS Enterprise 11.2 Documentation. Retrieved from https://enterprise.arcgis.com/en/portal/latest/install/windows/the-portal-for-arcgis-account.htm.

Section: The Portal for ArcGIS account > Domain account: "For production environments

it is recommended that you use a domain account or a group managed service account (gMSA)."

3. Esri ArcGIS Enterprise Documentation. (2024). Accounts used by ArcGIS Enterprise. ArcGIS Enterprise 11.2 Documentation. Retrieved from https://enterprise.arcgis.com/en/portal/latest/administer/windows/accounts-used-by-arcgis-enterprise.htm.

Section: ArcGIS Server account: "In a multiple-machine site

the ArcGIS Server account must be a domain account because the account must be recognized by all machines in the site... For enhanced security

you can use a group Managed Service Account (gMSA)."

ArcGIS Enterprise components like Portal for ArcGIS and ArcGIS Server maintain their own certificate trust stores. When a new server certificate from a Domain Certificate Authority (CA) is imported (typically via a PKCS#12/PFX file), the software must be able to validate the entire certificate chain up to a trusted root. If the new certificate was issued by a new or different intermediate or root CA, those CA certificates must be explicitly imported into the trust stores of both Portal and ArcGIS Server. The fact that the ArcGIS Data Store accepts the certificate while Portal and Server do not indicates a trust chain validation failure specific to the Portal and Server components, which is resolved by importing the necessary CA certificates.

B: Domain CA certificates are a standard and recommended security practice for internal ArcGIS Enterprise deployments; they are fully supported.

C: The PKCS#12 (PFX) format is correct for importing a server certificate that includes its private key. The DER/CER format is used for importing public root or intermediate CA certificates into the trust store.

D: ArcGIS Server and Portal for ArcGIS are fully compatible with and support the import of certificates using the PKCS#12 (PFX) format.

1. Esri Official Documentation - ArcGIS Enterprise (Portal for ArcGIS): In the section on importing a certificate

the documentation states

"If you're using a new certificate from a CA that is not trusted by default

you must import the CA root and intermediate certificates into the portal." This confirms that the full chain of trust must be established by importing the issuing authority's certificates.

Source: ArcGIS Enterprise 11.0 Documentation

"Portal for ArcGIS > Administer > Security > Import a certificate into the portal".

2. Esri Official Documentation - ArcGIS Enterprise (ArcGIS Server): The documentation for securing ArcGIS Server with HTTPS explicitly notes the requirement to import the CA's certificates. "If the certificate is from a CA

you must also import the root and/or intermediate certificates of the CA into the site." This directly addresses the scenario where the server certificate is not recognized because its issuer is not trusted.

Source: ArcGIS Enterprise 11.0 Documentation

"ArcGIS Server > Administer > Security > Configure HTTPS on ArcGIS Server".

When ArcGIS Enterprise is configured to use enterprise groups for membership, accounts for new users are automatically created in the portal during their first sign-in attempt. This process assigns a pre-configured default user type and role. If the organization has exhausted the number of available licenses for that specific default user type, the portal cannot complete the account creation. This failure manifests as an inability for the new employee to log in, as their portal account cannot be provisioned. Existing users are unaffected because their accounts and licenses have already been provisioned.

A. Their Active Directory accounts have not been added to the portal

This is a symptom of the underlying issue, not the root cause. The accounts are failing to be added automatically upon login due to the provisioning failure.

C. Their Active Directory accounts have not had sufficient time to sync to the portal

ArcGIS Enterprise does not use a background synchronization process for IWA. It queries the identity store in real-time, and account creation occurs on-demand at the first login.

D. The Web Adaptor cache must be cleared

Clearing the Web Adaptor cache is a general troubleshooting step for site-wide configuration or connectivity issues, not for a specific user account provisioning problem based on licensing.

---

1. Esri

ArcGIS Enterprise Documentation. Portal for ArcGIS > Administrator > Manage your portal > Security > Configure enterprise logins. Under the "New member defaults" section

it states: "When a new member from an enterprise identity provider signs in to the portal for the first time

they are automatically added as a member and assigned the default role and user type configured for new members." This confirms the automatic provisioning process.

2. Esri

ArcGIS Enterprise Documentation. Portal for ArcGIS > Administrator > Manage your portal > Security > Troubleshoot accounts. In the section "I can't add a new enterprise member to the portal

" the documentation explicitly states: "This may be because the portal does not have any available licenses of the user type that is configured as the default for new members." This directly identifies the cause described in the correct answer.

3. Esri

ArcGIS Enterprise Documentation. Portal for ArcGIS > Administrator > Manage your portal > Organization > Manage members > User types

roles

and privileges. This document details how user types are tied to licenses. The section "User types" explains: "Each member must be assigned a user type... The number and type of user types available in your organization are determined by your license." This establishes the link between user types and license availability

which is central to the problem.

When an item is shared as a reference in an ArcGIS Enterprise-to-Enterprise distributed collaboration, the URL still points to the source service. Members of the receiving portal must supply credentials that are valid in the source portal each time they open the layer. The only way to remove the repeated credential prompt is to share the layer “as a copy,” which republishes the data to the receiving ArcGIS Enterprise so that it is accessed locally with the user’s own portal token and no cross-portal authentication is required.

B. Saving viewer credentials is not a capability of distributed collaborations; credentials cannot be embedded in, or passed through, the collaboration workspace.

C. Send-and-receive workspaces control flow direction, not authentication; they do not eliminate cross-portal sign-in requirements.

D. Enabling anonymous access would require making the imagery public on the source portal, which defeats security policy and is not necessary when collaboration can share a copy.

1. Esri

“Share content across collaborations

” ArcGIS Enterprise 11.2 Help

section “Share items as copies or references

” para. 3–4: “Items shared as references require users in the receiving organization to sign in to the source. To avoid this

share the item as a copy.”

2. Esri

“Best practices for distributed collaboration

” ArcGIS Enterprise 11.1 Help

“Authentication considerations

” para. 2.

3. Esri

“Understand collaboration workspaces

” ArcGIS Enterprise 10.9 Help

section “Send-and-receive workspaces

” clarifies they affect direction

not security.

To enable a single sign-on experience using a SAML-compliant identity provider (IdP), a trust relationship must be established between the IdP and ArcGIS Enterprise. In this configuration, ArcGIS Enterprise acts as the service provider (SP). A critical step in establishing this trust is to register the portal's service provider metadata with the IdP. This metadata file contains essential information, such as the portal's entity ID and assertion consumer service URLs, which the IdP requires to authenticate users and correctly redirect them back to the portal after successful authentication.

A. Configure ArcGIS Web Adaptor to use Integrated Windows Authentication

Integrated Windows Authentication (IWA) is a web-tier authentication method for Windows environments and is distinct from the SAML protocol specified in the question.

C. Set up Lightweight Directory Access Protocol with portal-tier authentication

LDAP is a protocol for accessing directory services. While it can be used for authentication, it is not the same as configuring a federated, SAML-based single sign-on system.

D. Register the identity provider as a web-tier authenticator

SAML is configured as a portal-tier authentication method directly within the Portal for ArcGIS settings, not at the web-tier level where the ArcGIS Web Adaptor operates.

1. Esri ArcGIS Enterprise Documentation. "Configure a SAML-compliant identity provider with your portal." ArcGIS Enterprise Documentation. Accessed October 2023.

Reference Detail: In the section "Register your portal with the SAML IDP

" the documentation states: "Log in to your SAML IDP's website and use the information you obtained in the previous step to register the portal as a trusted service provider." This directly supports the action described in option B.

2. Esri ArcGIS Enterprise Documentation. "Authentication in ArcGIS Enterprise." ArcGIS Enterprise Documentation. Accessed October 2023.

Reference Detail: This document categorizes authentication mechanisms. Under the "Portal-tier authentication" section

it lists "SAML" as an option. Under "Web-tier authentication

" it lists "Integrated Windows Authentication (IWA)" and "Public key infrastructure (PKI)." This confirms that SAML is a portal-tier authenticator

making option D incorrect.

ArcGIS Server Manager provides a built-in mechanism to collect, aggregate, and report on service statistics. These reports are specifically designed to help administrators understand usage trends over time, including metrics like request counts, average response times, timeouts, and instance usage. By creating and analyzing these reports, the administrator can gather the necessary data to determine if the minimum and maximum instance settings for services are configured appropriately to handle performance spikes, directly addressing the scenario's requirements before making changes.

A. Monitor Task Manager on each ArcGIS Server machine: Task Manager provides real-time system resource usage but does not offer historical trend analysis or service-specific statistics needed to make informed configuration changes.

B. Change the log level to Debug in ArcGIS Server Manager: Debug-level logging is for intensive, granular troubleshooting of specific errors. It does not provide performance trend summaries and can severely degrade server performance.

D. Enable Windows Performance Monitor: While a powerful tool for monitoring system counters, the native ArcGIS Server statistics reports provide more direct, service-oriented metrics (e.g., average response time) in a readily accessible format for this specific task.

1. Esri ArcGIS Enterprise Documentation

"Work with server statistics": "ArcGIS Server can generate reports with statistics on how your services are being used. Analyzing these statistics can help you tune your services for better performance and troubleshoot problems in your site." This directly supports using server statistics for performance tuning. (ArcGIS Enterprise 11.0 Documentation

Administer ArcGIS Server > Logs > Work with server statistics).

2. Esri ArcGIS Enterprise Documentation

"Reports in ArcGIS Server Manager": This page details the types of reports available

which include "Maximum running instances

" "Requests

" and "Average response time." These are the exact metrics needed to analyze usage trends and justify changes to instance settings. (ArcGIS Enterprise 11.0 Documentation

Administer ArcGIS Server > Logs > Work with server statistics > Reports in ArcGIS Server Manager).

3. Esri ArcGIS Enterprise Documentation

"Tune service instances": "You can use the statistics generated by ArcGIS Server to help you determine if you need to adjust the minimum and maximum number of instances for your services... For example

if you see that your service frequently has a high number of running instances

you might consider increasing the maximum number of instances." (ArcGIS Enterprise 11.0 Documentation

Services > Configure services > Tune services > Tune service instances).

When an organization purchases additional licenses for ArcGIS Pro to be managed through ArcGIS Enterprise, a new, updated license file must be obtained from My Esri. This file is cumulative; it contains all previously held entitlements (such as user types and other app licenses) in addition to the newly acquired 25 ArcGIS Pro licenses. The portal administrator then imports this single, consolidated file into Portal for ArcGIS to update the organization's entitlements. This process makes the new licenses available for assignment to users without disrupting existing license assignments.

A. New license file with just the 25 ArcGIS Pro licenses: Importing a license file with only the new licenses would overwrite all existing entitlements, potentially un-licensing all current users and apps.

B. An updated license file with only the 25 additional ArcGIS Pro licenses: This is functionally the same as option A. A license file must be comprehensive, containing all entitlements, not just the additional ones.

D. Any existing license file used previously: A previous license file does not contain the newly purchased 25 licenses, so it cannot be used to make them available for assignment.

1. Esri ArcGIS Enterprise Documentation (Portal for ArcGIS): "Obtain a portal license file." The documentation states

"If you add or change the user types or add-on app licenses in your organization

you must obtain a new portal license file and reapply it to the portal." This confirms that a new

updated file is required for any additions.

Source: ArcGIS Enterprise 11.0 Documentation

Portal for ArcGIS

Installation and deployment

"Obtain a portal license file".

2. Esri ArcGIS Enterprise Documentation (Portal for ArcGIS): "Manage licenses." This section details the process of importing the license file. It explains

"To update user types or add-on licenses

or to add more of either

you must obtain a new portal license file from My Esri and import it to the portal." This reinforces that a new

comprehensive file is the correct mechanism for adding licenses.

Source: ArcGIS Enterprise 11.0 Documentation

Portal for ArcGIS

Administer

"Manage licenses"

section "Import licenses".