Workday Updated Workday-Pro-Integrations Exam Questions and Answers by malia

When creating an Integration System User (ISU) in Workday, the goal is often to ensure that the user is restricted to performing tasks via web services (e.g., API calls or integrations) and cannot log into the Workday user interface (UI). This is a critical security measure to limit the ISU’s access to only what is necessary for integration purposes, adhering to the principle of least privilege. Let’s evaluate each option provided in the question to determine the correct approach based on Workday’s functionality and best practices as outlined in official documentation and the Workday Pro Integrations program.

Option A: Choose a constrained security group.In Workday, security groups define the permissions and access levels for users, including ISUs. There are two types of Integration System Security Groups (ISSGs): constrained and unconstrained. A constrained ISSG limits access to specific organizations or data scopes, while an unconstrained ISSG provides broader access across the tenant. While choosing a constrained security group can enhance security by limiting the scope of data the ISU can access, it does not directly control whether the ISU authenticates via web services or the UI. The type of security group affects data access permissions, not the authentication method or UI access. Therefore, this option does not address the requirement of ensuring authentication only via web services.

Option B: Select the Do Not Allow UI Sessions checkbox.When creating an ISU in Workday, the " Create Integration System User " task presents an option labeled " Do Not Allow UI Sessions. " Selecting this checkbox explicitly prevents the ISU from logging into the Workday UI using its credentials. This setting ensures that the ISU can only authenticate and operate through programmatic means, such as web service calls (e.g., SOAP or REST APIs), which is precisely the intent of the question. This is a standard security practice recommended by Workday to isolate integration activities from interactive user sessions, reducing the risk of misuse or unauthorized access through the UI. This option directly aligns with the requirement and is the correct answer.

Option C: Update the session timeout minutes.The " Session Timeout Minutes " field in the ISU creation task determines how long an ISU’s session remains active before it expires. By default, this is set to 0, meaning the session does not expire, which is suitable for integrations that require continuous operation without interruption. Updating this value (e.g., setting it to a specific number of minutes) would cause the session to time out after that period, potentially disrupting long-running integrations. However, this setting pertains to session duration, not the method of authentication or whether UI access is allowed. It does not prevent the ISU from logging into the UI or ensure that authentication occurs only via web services, making this option irrelevant to the question.

Option D: Generate a random password.Generating a random password for the ISU is a good security practice to ensure the credentials are strong and not easily guessable. However, the password itself does not dictate how the ISU authenticates or whether it can access the UI. A random password enhances security but does not inherently restrict the ISU to web service authentication. Without selecting " Do Not Allow UI Sessions, " the ISU could still log into the UI with that password, assuming no other restrictions are applied. Thus, this option does not fulfill the requirement of ensuring authentication only via web services.

Why Option B is Correct

The " Do Not Allow UI Sessions " checkbox is a specific configuration in the ISU setup process that directly enforces the restriction of authentication to web services. This setting is part of Workday’s security framework for integrations, ensuring that ISUs—designed as non-human accounts for programmatic access—cannot be used interactively. This aligns with Workday’s best practices for securing integrations, as outlined in the Workday Pro Integrations Study Guide and related documentation. For example, when an ISU is created with this checkbox selected, any attempt to log into the Workday UI with its credentials will fail, while web service requests (e.g., via SOAP or REST APIs) will succeed, assuming proper permissions are granted via an ISSG.

Practical Application

To implement this in Workday:

Log into your Workday tenant with administrative privileges.

Search for and select the " Create Integration System User " task.

Enter a username and password for the ISU.

Check the " Do Not Allow UI Sessions " checkbox.

Leave " Session Timeout Minutes " at 0 (default) to avoid session expiration during integrations.

Save the ISU and assign it to an appropriate ISSG (constrained or unconstrained, depending on the integration’s needs).

This configuration ensures the ISU is locked to web service authentication, meeting the question’s objective.

Verification with Workday Documentation

The Workday Pro Integrations Study Guide emphasizes securing ISUs by restricting them to integration-specific tasks. The " Do Not Allow UI Sessions " option is highlighted as a key control for preventing UI access, ensuring that ISUs operate solely through web services. This is also consistent with broader Workday security training materials, such as those available on Workday Community, which stress isolating integration accounts from human user activities.

Workday Pro Integrations Study Guide References

Section: Integration Security Fundamentals – Discusses the role of ISUs and the importance of restricting their access to programmatic interactions.

Section: Configuring Integration System Users – Details the " Create Integration System User " task, including the " Do Not Allow UI Sessions " checkbox as a security control.

Section: Best Practices for Integration Security – Recommends using this setting to enforce least privilege and protect the tenant from unauthorized UI access by integration accounts.

The task is to write XSLT within a template matching wd:Report_Data/wd:Report_Entry to categorize wd:Job_Skills data, outputting " HR Skills " if the value contains " HR " and " NON-HR Skills " if it does not, using a series of < xsl:if > elements. The correct syntax must use the contains() function to check for the substring " HR " within wd:Job_Skills, as the question implies partial matching (e.g., " HR Specialist " or " Senior HR " ), not exact equality.

Let’s analyze each option:

Option A:

xml

< job_skill >

< xsl:value-of select= " wd:Hiring_Restrictions/wd:Job_Skills= ' HR ' " >

< xsl:text > HR Skills < /xsl:text >

< xsl:if/ >

< xsl:value-of select= " not(wd:Hiring_Restrictions/wd:Job_Skills= ' HR ' ) " >

< xsl:text > NON-HR Skills < /xsl:text >

< xsl:if/ >

< /job_skill >

Issues:

< xsl:value-of > is misused here. It outputs the result of the expression (e.g., " true " or " false " for a comparison), not the conditional text. The < xsl:text > inside won’t execute as intended.

The = operator checks for exact equality (e.g., wd:Job_Skills must be exactly " HR " ), not substring presence, which contradicts the requirement to check if " HR " is contained within the value.

< xsl:if/ > is malformed (self-closing without a test attribute) and misplaced.

Verdict: Incorrect syntax and logic.

Option B:

xml

< job_skill >

< xsl:value-of select= " contains(wd:Hiring_Restrictions/wd:Job_Skills, ' HR ' ) " >

< xsl:text > HR Skills < /xsl:text >

< xsl:if/ >

< xsl:value-of select= " not(contains(wd:Hiring_Restrictions/wd:Job_Skills, ' HR ' )) " >

< xsl:text > NON-HR Skills < /xsl:text >

< xsl:if/ >

< /job_skill >

Issues:

Similar to A, < xsl:value-of > outputs the boolean result of contains() ( " true " or " false " ), not the conditional text " HR Skills " or " NON-HR Skills. "

The < xsl:text > elements are inside invalid < xsl:if/ > tags (self-closing, no test), rendering them ineffective.

While contains() is correct for substring checking, the structure fails to meet the < xsl:if > requirement.

Verdict: Incorrect structure despite using contains().

Option C:

xml

< job_skill >

< xsl:if test= " wd:Hiring_Restrictions/wd:Job_Skills= ' HR ' " >

< xsl:text > HR Skills < /xsl:text >

< /xsl:if >

< xsl:if test= " not(wd:Hiring_Restrictions/wd:Job_Skills= ' HR ' ) " >

< xsl:text > NON-HR Skills < /xsl:text >

< /xsl:if >

< /job_skill >

Analysis:

Uses < xsl:if > correctly with test attributes, satisfying the " series of < xsl:if > elements " requirement.

However, wd:Job_Skills= ' HR ' tests for exact equality, not whether " HR " is contained within the value. For example, " HR Specialist " would fail this test, outputting " NON-HR Skills " incorrectly.

Verdict: Semantically incorrect due to exact matching instead of substring checking.

Option D:

xml

< job_skill >

< xsl:if test= " contains(wd:Hiring_Restrictions/wd:Job_Skills, ' HR ' ) " >

< xsl:text > HR Skills < /xsl:text >

< /xsl:if >

< xsl:if test= " not(contains(wd:Hiring_Restrictions/wd:Job_Skills, ' HR ' )) " >

< xsl:text > NON-HR Skills < /xsl:text >

< /xsl:if >

< /job_skill >

Analysis:

Correctly uses < xsl:if > with test attributes, aligning with the question’s requirement.

The contains() function properly checks if " HR " is a substring within wd:Job_Skills (e.g., " HR Manager " or " Senior HR " returns true).

not(contains()) ensures the opposite condition, covering all cases (mutually exclusive).

< xsl:text > outputs the exact strings " HR Skills " or " NON-HR Skills " as required.

Note: The closing tag < /xs1:if > is a typo in the option (should be < /xsl:if > ), but in context, it’s an obvious formatting error, not a substantive issue.

Verdict: Correct logic and syntax, making D the best answer.

Correct Implementation in Context:

xml

< xsl:template match= " wd:Report_Data/wd:Report_Entry " >

< job_skill >

< xsl:if test= " contains(wd:Hiring_Restrictions/wd:Job_Skills, ' HR ' ) " >

< xsl:text > HR Skills < /xsl:text >

< /xsl:if >

< xsl:if test= " not(contains(wd:Hiring_Restrictions/wd:Job_Skills, ' HR ' )) " >

< xsl:text > NON-HR Skills < /xsl:text >

< /xsl:if >

< /job_skill >

< /xsl:template >

Example Input: < wd:Job_Skills > Senior HR Analyst < /wd:Job_Skills > → Output: < job_skill > HR Skills < /job_skill >

Example Input: < wd:Job_Skills > IT Specialist < /wd:Job_Skills > → Output: < job_skill > NON-HR Skills < /job_skill >

Workday Pro Integrations Study Guide: " Configure Integration System - TRANSFORMATION " section, detailing < xsl:if > and contains() for conditional XSLT logic in Workday.

Workday Documentation: " XSLT Transformations in Workday " under EIB, confirming wd: namespace usage and string functions.

W3C XSLT 1.0 Specification: Section 9.1, " Conditional Processing with < xsl:if > , " and Section 11.2, " String Functions " (contains()).

Workday Community: Examples of substring-based conditionals in XSLT for report transformations.

Because the calculated field already exists, the workflow should not begin by creating another calculated field. For a Core Connector: Organization non-IS integration, the output structure must be extended through the integration service configuration so the connector can support the additional custom field. The next step is to create the custom field override service that makes the custom calculated value available for the connector output. After that, Integration Field Overrides are configured to map the existing Legacy ID calculated field into the appropriate output location. Integration Attributes are used for integration-level settings and are not the correct mechanism for adding a calculated field to the output. Integration Maps transform values, but they do not add a new calculated field to the file structure.

When creating an outbound connector using the Workday Core Connector: Organization Outbound template, you need to configure the connector to meet specific vendor requirements, such as formatting output data and adjusting document retention policies. Let ' s break down the question and analyze the requirements and options based on Workday ' s integration framework, specifically focusing on the Core Connector and its configuration tasks.

Understanding the Requirements

Output Data Formatting:The vendor has provided a table specifying how organization types should appear in the output file (e.g., Cost Center as " CC " , Pay Group as " PAY " , Supervisory as " S " , and any other value as " OTHER " ). This indicates a need to transform or map Workday organization data into specific output values, which is typically handled by configuring how fields are processed or mapped in the integration.

Document Retention Policy Change:The vendor wants to change the default document retention policy from 30 days to 7 days. In Workday, document retention policies for integrations (e.g., files stored on SFTP or other delivery methods) are managed through integration settings, specifically attributes related to file retention or delivery options.

Analyzing Workday Core Connector: Organization Outbound

The Core Connector: Organization Outbound template is a pre-built Workday integration template used to extract organization-related data (e.g., cost centers, pay groups, supervisory organizations) and send it to an external system. It leverages Workday ' s integration framework, including integration maps, field overrides, and attributes, to customize data output and behavior.

Integration Maps: Used to define how data is transformed or mapped from Workday to the output format, often involving XSLT or predefined mappings.

Integration Field Overrides: Allow you to override or customize how specific fields are displayed or formatted in the output, such as mapping " Cost Center " to " CC " as per the vendor ' s table.

Integration Attributes: Control broader integration settings, such as delivery methods, file formats, and retention policies (e.g., document retention duration).

Integration Field Attributes: Typically focus on specific field-level properties but are less commonly used for retention policies or broad mappings compared to the above options.

Evaluating the Vendor ' s Output Requirements

The table provided (Cost Center → " CC " , Pay Group → " PAY " , Supervisory → " S " , any other value → " OTHER " ) suggests a need to transform or override the default output values for organization types. This is a field-level customization, best handled by Integration Field Overrides, which allow you to specify custom values or formats for specific fields in the output.

For example, in the Core Connector, you can use Integration Field Overrides to map the Workday organization type (e.g., " Cost_Center " ) to the vendor ' s desired output ( " CC " ). This is a common practice for outbound integrations where external systems require specific formatting.

Evaluating the Retention Policy Change

The default document retention policy of 30 days needs to be changed to 7 days. In Workday, retention policies for integration output files (e.g., files delivered via SFTP or email) are configured as part of the integration ' s attributes, not field-level settings.

Integration Attributes are used to manage integration-wide settings, including delivery options, file retention periods, and other global configurations. You can specify the retention period (e.g., 7 days) in the attributes section of the Core Connector configuration.

This is distinct from field-level overrides or maps, as retention is not tied to individual data fields but to the integration ' s output management.

Analyzing the Options

Now, let ' s evaluate each option to determine which tasks are needed to meet both requirements:

A. Configure Integration Maps and Configure Integration Attributes

Integration Maps: These are used for broader data transformations or mappings, such as converting Workday XML to another format or defining complex data relationships. While they could theoretically handle the output value mappings (e.g., Cost Center → " CC " ), they are typically more complex and less granular than field overrides for simple value changes.

Integration Attributes: Correct for configuring the retention policy (e.g., changing from 30 to 7 days), as attributes manage integration-wide settings like retention.

Why Not Sufficient?: Integration Maps are overkill for simple field value overrides like the vendor ' s table, and field-level customization is better handled by Integration Field Overrides for precision and ease.

B. Configure Integration Field Overrides and Configure Integration Field Attributes

Integration Field Overrides: Correct for mapping specific field values (e.g., Cost Center → " CC " ), as they allow granular control over output formats for individual fields.

Integration Field Attributes: These are less commonly used and typically focus on field-specific properties (e.g., data type, length), not broad integration settings like retention policies. Retention is not managed at the field level, so this is incorrect for the retention requirement.

Why Not Sufficient?: Integration Field Attributes do not handle retention policies, making this option incomplete.

C. Configure Integration Field Overrides and Configure Integration Attributes

Integration Field Overrides: Perfect for mapping the vendor ' s output values (e.g., Cost Center → " CC " , Pay Group → " PAY " , etc.), as they allow precise control over field-level output formatting.

Integration Attributes: Correct for configuring the retention policy (e.g., changing from 30 to 7 days), as attributes manage integration-wide settings like file retention.

Why Sufficient?: This combination addresses both requirements—field-level output formatting and integration-wide retention policy changes—making it the most accurate choice.

D. Configure Integration Maps and Configure Integration Field Attributes

Integration Maps: As explained, these are better for complex transformations, not simple field value overrides like the vendor ' s table. They could work but are less efficient than field overrides.

Integration Field Attributes: As noted, these do not handle retention policies or broad integration settings, making them incorrect for the retention requirement.

Why Not Sufficient?: This combination fails to address retention effectively and uses Integration Maps when Integration Field Overrides would be more appropriate for the output formatting.

Conclusion

Based on the analysis, the vendor ' s requirements for output formatting (mapping organization types to specific values) and changing the retention policy (from 30 to 7 days) are best met by:

Integration Field Overrides: To customize the output values for organization types (e.g., Cost Center → " CC " ) as shown in the table.

Integration Attributes: To adjust the document retention policy from 30 days to 7 days.