Pass the Esri Technical EAEP2201 Questions and answers with ValidTests

In ArcGIS Enterprise, theCreatoruser type includes full privileges for content creation, sharing, and administration. When paired with thePublisherrole, it grants the user the ability to publish hosted feature layers, map image layers, and other services, as well as perform editing tasks on existing data. This combination is specifically designed for users who require both publishing and editing capabilities.

TheEditoruser type is limited to editing and cannot publish content. TheGIS Professionaluser type provides access to ArcGIS Pro but, when assigned theData Editorrole, restricts the user from publishing content. Therefore, only theCreator user type with Publisher rolesupports both publishing and editing workflows.

Reference Source:ArcGIS Enterprise Administrator Guide — User types and roles

=====================

Registering the database as a data store item in the ArcGIS Enterprise portal allows administrators to control who can publish services referencing the data. By sharing the data store item with specific groups or individuals, administrators can restrict publishing capabilities to authorized users. At the same time, all users can be granted appropriate permissions to access and edit the data directly in the user-managed database, independent of the publishing privileges.​

Registering the database as an ArcGIS-managed data store in Server Manager does not provide the same level of control over publishing permissions. Registering it as a relational data store in ArcGIS Data Store is intended for managed data storage and does not apply to user-managed databases.​

Reference Source:ArcGIS Enterprise documentation on registering user-managed data stores and controlling access.​

Workload separation is a best practice in ArcGIS Enterprise architecture. By dedicating a separate ArcGIS Server site for analysis tasks, such as geoprocessing services used in web tools, system resources can be managed more effectively, and performance can be improved. This configuration avoids overloading a single site and ensures that interactive web applications are not affected by resource-intensive analysis tools.

Adding more machines to the same site (Option A) does not isolate workloads and may still result in contention. Installing an entirely new ArcGIS Enterprise deployment (Option C) increases complexity and administration effort unnecessarily. The recommended solution is to implementa dedicated ArcGIS Server site for analysisas part of a federated multi-site deployment.

Reference Source:ArcGIS Enterprise System Design Strategies — Workload separation practices

=====================

When using aWeb Adaptorto accessArcGIS Server Manager,administrative access must be explicitly enabled during Web Adaptor configuration. If this setting is not enabled, even valid administrator accounts (including Windows accounts with elevated privileges) will be unable to access ArcGIS Server Manager via the Web Adaptor.

This is a common configuration oversight. The federation, IWA setup, and domain certificate are not the causes here. A domain certificate is valid within trusted enterprise networks, and Windows accounts can access services through IWA once configured correctly.

Reference Source:ArcGIS Enterprise documentation — Enabling administrative access for Web Adaptor

=====================

To prevent confusion among users who do not have access to certain functionalities, such as creating web maps and web scenes, the GIS administrator should configure the ArcGIS Enterprise home page to display only the items and tools that are accessible to the signed-in user. This customization ensures that users see a tailored interface that aligns with their permissions and responsibilities, reducing the likelihood of encountering inaccessible options.​

Configuring a maintenance notification (Option A) is more appropriate for temporary service outages or updates, not for managing user interface elements. Adjusting Pagevisibility settings (Option B) affects the visibility of entire pages but does not provide the granular control needed to tailor the home page based on user roles and permissions.​

Reference Source:ArcGIS Enterprise documentation on customizing the home page and user experience​

Web Adaptors in the DMZ must forward requests to internal components (Portal and Server). These internal services operate over HTTPS via ports:

7443 for Portal for ArcGIS

6443 for ArcGIS Server

Therefore, the firewall mustallow traffic over ports 6443 and 7443from the Web Adaptors (DMZ) to the respective internal services.

From ArcGIS Enterprise security documentation:

“When using Web Adaptors in the DMZ, make sure ports 6443 and 7443 are open between the Web Adaptors and the internal ArcGIS Server and Portal components respectively.”

OptionBis partially correct but leaves out Portal (7443).

OptionCis for HTTP/HTTPS access from the public,not internal communications.

OptionDincludes the Data Store admin port (2443), which isn’t required here.

To allow users to add new features without the ability to modify or delete existing ones, the feature service should have the "Create" and "Query" operations enabled. The "Create" operation permits users to add new features, while the "Query" operation allows them to view existing features. By not enabling the "Update" and "Delete" operations, users are restricted from making changes to or removing existing features. This configuration is ideal for workflows where data integrity is crucial, and only the addition of new data is permitted.​

Enabling "Update and sync" (Option A) would allow users to modify existing features and synchronize changes, which is not desired in this scenario. "Extract and create" (Option C) is not a standard combination of operations for controlling editing permissions in feature services.​

Reference Source:ArcGIS Server documentation on editor permissions for feature services

For map services that are infrequently updated and contain numerous detailed features with complex symbology, configuring the service to use cached tiles is the most effective way to improve drawing performance. Cached map services pre-render map images at various scales and store them, allowing for faster display to users. This approach is particularly beneficial when the data does not change frequently, as it reduces the server's processing load during user interactions.​

Eliminating scale-dependent rendering (Option B) may lead to performance degradation, as it could result in rendering all features at all scales, increasing the amount of data processed and displayed unnecessarily.​

Switching to dedicated instances (Option C) can improve performance in some scenarios, but it also increases resource usage on the server. Given that the service is infrequently updated and the primary concern is drawing performance, caching is the more efficient and scalable solution.​

Reference Source:ArcGIS Enterprise documentation on optimizing map services for performance.​

Esri recommends using aGroup Managed Service Account (gMSA)to run Portal for ArcGIS services in Windows environments. gMSAsautomatically manage passwords, align withActive Directory policies, and areideal for enterprise-scale deployments.

From Esri documentation:

“Using a group managed service account (gMSA) to run Portal for ArcGIS services improves security by allowing Windows to manage the password, reducing administrative overhead while meeting enterprise security requirements.”

OptionB(regular AD account) is acceptable butrequires manual password updates.

OptionCandDare not secure or scalable for enterprise environments.

The correct solution is toplace ArcGIS Enterprise in read-only mode. This is an administrative function designed specifically toprevent changes to content or configurationwhile still allowing users toview and access existing items.

From the official ArcGIS Enterprise documentation:

“Read-only mode allows an administrator to restrict changes to the portal. When enabled, no users (including administrators) can create, update, or delete items, groups, or users. However, users can still search for and view items, access content, and use apps and services.”

This feature is typically used duringmaintenance windowsor before performingdisaster recovery tasksto preserve system state.

OptionBis incorrect because changing user roles to Viewer wouldnot prevent content changes by administrators or other roleswith publishing privileges.

OptionCrefers to cloning, which isnot a preventive or temporary access control measure, but rather a method forstandby deployments or replication.

OptionD(disabling the Web Adaptor) would disrupt access entirely, which doesnot match the requirement to allow viewing.