Free Workday Workday-Pro-Integrations Practice Exam with Questions & Answers | Set: 3

A valid XSLT file must include the following key components:

Root Element: < xsl:stylesheet > or < xsl:transform >

Namespace Declaration: Usually xmlns:xsl= " http://www.w3.org/1999/XSL/Transform "

At Least One < xsl:template > to define transformation behavior

From W3C and Workday documentation:

“A valid XSLT file must contain a stylesheet root element, a namespace, and at least one template to be considered executable.”

Why others are incorrect:

A. Prefix and header are not structural requirements.

B. " Transformation " is vague; it ' s the template that implements it.

C. Headers and footers are not required or defined elements in XSLT.

Because the calculated field already exists, the workflow should not begin by creating another calculated field. For a Core Connector: Organization non-IS integration, the output structure must be extended through the integration service configuration so the connector can support the additional custom field. The next step is to create the custom field override service that makes the custom calculated value available for the connector output. After that, Integration Field Overrides are configured to map the existing Legacy ID calculated field into the appropriate output location. Integration Attributes are used for integration-level settings and are not the correct mechanism for adding a calculated field to the output. Integration Maps transform values, but they do not add a new calculated field to the file structure.

Connector change detection relies on completed business process transactions that are eligible for extraction within the launch parameters. In the worker history, the One Time Payment transaction is still marked as In Progress. An in-progress transaction has not completed the business process lifecycle, so it is not treated as a finalized change ready for outbound integration processing. The due date is not the controlling reason, and there is no indication that the transaction was rescinded by an HR administrator. Although effective dates matter in connector processing, the most direct exclusion reason shown in the worker history is the transaction status. Workday integrations generally avoid sending incomplete business process results to external systems because doing so could transmit unapproved or unfinished compensation data.

================

For Core Connector: Worker, selecting fields in Integration Field Attributes is not always enough if the related integration service is not enabled. Worker qualification information, including education-related data, is controlled by the Worker Qualification Data Section Fields Service. If that service is not enabled, the connector does not extract the section’s data, even when individual field attributes appear to be selected or the section is marked for output. Enabling every service is excessive and not the controlled configuration choice. Marking fields as required affects validation or required output behavior, but it does not activate the underlying qualification service. The correct fix is to enable the specific service that supplies the worker qualification data to the connector output.

================

Population Eligibility controls which workers are included in the Core Connector output population. In this scenario, the Population Eligibility is configured to include all US workers, so the connector correctly outputs that entire eligible population. The Eligibility Criterion field does not replace Population Eligibility as the population filter. It can support eligibility-related logic, but it is not the correct place to enforce the final worker population restriction when the actual extract should include only Sales workers. To fix the output, the Sales organization condition must be moved into the Population Eligibility rule itself. Updating the criterion field or running a full file would not solve the problem because the population filter would still include all US workers. The integration population must be filtered at the source.

================

For an XSLT (Extensible Stylesheet Language Transformations) file to be considered valid in the context of Workday integrations (and per general XSLT standards), it must adhere to specific structural and functional requirements. The correct answer is that an XSLT file must contain a root element, a namespace, and at least one template. Below is a detailed explanation of why this is the case, grounded in Workday’s integration practices and XSLT specifications:

Root Element:

Every valid XSLT file must have a single root element, which serves as the top-level container for the stylesheet. In XSLT, this is typically the < xsl:stylesheet > or < xsl:transform > element (both are interchangeable, though < xsl:stylesheet > is more common).

The root element defines the structure of the XSLT document and encapsulates all other elements, such as templates and namespaces. Without a root element, the file would not conform to XML well-formedness rules, which are a prerequisite for XSLT validity.

Example:

< xsl:stylesheet version= " 1.0 " xmlns:xsl= " http://www.w3.org/1999/XSL/Transform " >

< /xsl:stylesheet >

Namespace:

An XSLT file must declare the XSLT namespace, typically http://www.w3.org/1999/XSL/Transform, to identify it as an XSLT stylesheet and enable the processor to recognize XSLT-specific elements (e.g., < xsl:template > , < xsl:value-of > ). This is declared within the root element using the xmlns:xsl attribute.

The namespace ensures that the elements used in the stylesheet are interpreted as XSLT instructions rather than arbitrary XML. Without this namespace, the file would not function as an XSLT stylesheet, as the processor would not know how to process its contents.

In Workday’s Document Transformation integrations, additional namespaces (e.g., for Workday-specific schemas) may also be included, but the XSLT namespace is mandatory for validity.

At Least One Template:

An XSLT file must contain at least one < xsl:template > element to define the transformation logic. Templates are the core mechanism by which XSLT processes input XML and produces output. They specify rules for matching nodes in the source XML (via the match attribute) and generating the transformed result.

Without at least one template, the stylesheet would lack any transformation capability, rendering it functionally invalid for its intended purpose. Even a minimal XSLT file requires a template to produce meaningful output, though built-in default templates exist, they are insufficient for custom transformations like those used in Workday.

Example:

< xsl:template match= " / " >

< result > Hello, Workday! < /result >

< /xsl:template >

Complete Minimal Valid XSLT Example:

< xsl:stylesheet version= " 1.0 " xmlns:xsl= " http://www.w3.org/1999/XSL/Transform " >

< xsl:template match= " / " >

< output > Transformed Data < /output >

< /xsl:template >

< /xsl:stylesheet >

Why Other Options Are Incorrect:

A. A root element, namespace, and at least one transformation: While this is close, " transformation " is not a precise term in XSLT. The correct requirement is a " template, " which defines the transformation logic. " Transformation " might imply the overall process, but the specific feature required in the file is a template.

C. A header, a footer, and a namespace: XSLT files do not require a " header " or " footer. " These terms are not part of XSLT or XML standards. The structure is defined by the root element and templates, not headers or footers, making this option invalid.

D. A template, a prefix, and a header: While a template is required, " prefix " (likely referring to the namespace prefix like xsl:) is not a standalone feature—it’s part of the namespace declaration within the root element. " Header " is not a required component, making this option incorrect.

Workday Context:

In Workday’s Document Transformation systems (e.g., Core Connectors or custom integrations), XSLT files are uploaded as attachment transformations. Workday enforces these requirements to ensure the stylesheets can process XML data (e.g., from Workday reports or connectors) into formats suitable for external systems. The Workday platform validates these components when an XSLT file is uploaded, rejecting files that lack a root element, namespace, or functional templates.

Workday Pro Integrations Study Guide References:

Workday Integration System Fundamentals: Describes the structure of XSLT files, emphasizing the need for a root element ( < xsl:stylesheet > ), the XSLT namespace, and templates as the building blocks of transformation logic.

Document Transformation Module: Details the requirements for uploading valid XSLT files in Workday, including examples that consistently feature a root element, namespace declaration, and at least one template (e.g., " XSLT Basics for Document Transformation " ).

Core Connectors and Document Transformation Course Manual: Provides sample XSLT files used in labs, all of which include these three components to ensure functionality within Workday integrations.

Workday Community Documentation: Reinforces that XSLT files must be well-formed XML with an XSLT namespace and at least one template to be processed correctly by Workday’s integration engine.

When creating an Integration System User (ISU) in Workday, the goal is often to ensure that the user is restricted to performing tasks via web services (e.g., API calls or integrations) and cannot log into the Workday user interface (UI). This is a critical security measure to limit the ISU’s access to only what is necessary for integration purposes, adhering to the principle of least privilege. Let’s evaluate each option provided in the question to determine the correct approach based on Workday’s functionality and best practices as outlined in official documentation and the Workday Pro Integrations program.

Option A: Choose a constrained security group.In Workday, security groups define the permissions and access levels for users, including ISUs. There are two types of Integration System Security Groups (ISSGs): constrained and unconstrained. A constrained ISSG limits access to specific organizations or data scopes, while an unconstrained ISSG provides broader access across the tenant. While choosing a constrained security group can enhance security by limiting the scope of data the ISU can access, it does not directly control whether the ISU authenticates via web services or the UI. The type of security group affects data access permissions, not the authentication method or UI access. Therefore, this option does not address the requirement of ensuring authentication only via web services.

Option B: Select the Do Not Allow UI Sessions checkbox.When creating an ISU in Workday, the " Create Integration System User " task presents an option labeled " Do Not Allow UI Sessions. " Selecting this checkbox explicitly prevents the ISU from logging into the Workday UI using its credentials. This setting ensures that the ISU can only authenticate and operate through programmatic means, such as web service calls (e.g., SOAP or REST APIs), which is precisely the intent of the question. This is a standard security practice recommended by Workday to isolate integration activities from interactive user sessions, reducing the risk of misuse or unauthorized access through the UI. This option directly aligns with the requirement and is the correct answer.

Option C: Update the session timeout minutes.The " Session Timeout Minutes " field in the ISU creation task determines how long an ISU’s session remains active before it expires. By default, this is set to 0, meaning the session does not expire, which is suitable for integrations that require continuous operation without interruption. Updating this value (e.g., setting it to a specific number of minutes) would cause the session to time out after that period, potentially disrupting long-running integrations. However, this setting pertains to session duration, not the method of authentication or whether UI access is allowed. It does not prevent the ISU from logging into the UI or ensure that authentication occurs only via web services, making this option irrelevant to the question.

Option D: Generate a random password.Generating a random password for the ISU is a good security practice to ensure the credentials are strong and not easily guessable. However, the password itself does not dictate how the ISU authenticates or whether it can access the UI. A random password enhances security but does not inherently restrict the ISU to web service authentication. Without selecting " Do Not Allow UI Sessions, " the ISU could still log into the UI with that password, assuming no other restrictions are applied. Thus, this option does not fulfill the requirement of ensuring authentication only via web services.

Why Option B is Correct

The " Do Not Allow UI Sessions " checkbox is a specific configuration in the ISU setup process that directly enforces the restriction of authentication to web services. This setting is part of Workday’s security framework for integrations, ensuring that ISUs—designed as non-human accounts for programmatic access—cannot be used interactively. This aligns with Workday’s best practices for securing integrations, as outlined in the Workday Pro Integrations Study Guide and related documentation. For example, when an ISU is created with this checkbox selected, any attempt to log into the Workday UI with its credentials will fail, while web service requests (e.g., via SOAP or REST APIs) will succeed, assuming proper permissions are granted via an ISSG.

Practical Application

To implement this in Workday:

Log into your Workday tenant with administrative privileges.

Search for and select the " Create Integration System User " task.

Enter a username and password for the ISU.

Check the " Do Not Allow UI Sessions " checkbox.

Leave " Session Timeout Minutes " at 0 (default) to avoid session expiration during integrations.

Save the ISU and assign it to an appropriate ISSG (constrained or unconstrained, depending on the integration’s needs).

This configuration ensures the ISU is locked to web service authentication, meeting the question’s objective.

Verification with Workday Documentation

The Workday Pro Integrations Study Guide emphasizes securing ISUs by restricting them to integration-specific tasks. The " Do Not Allow UI Sessions " option is highlighted as a key control for preventing UI access, ensuring that ISUs operate solely through web services. This is also consistent with broader Workday security training materials, such as those available on Workday Community, which stress isolating integration accounts from human user activities.

Workday Pro Integrations Study Guide References

Section: Integration Security Fundamentals – Discusses the role of ISUs and the importance of restricting their access to programmatic interactions.

Section: Configuring Integration System Users – Details the " Create Integration System User " task, including the " Do Not Allow UI Sessions " checkbox as a security control.

Section: Best Practices for Integration Security – Recommends using this setting to enforce least privilege and protect the tenant from unauthorized UI access by integration accounts.

In Workday, after configuring an Integration System User (ISU) and an Integration System Security Group (ISSG) with the appropriate security policies and assigning them to an Enterprise Interface Builder (EIB) integration, there is a critical step required before the EIB can be launched successfully. This step ensures that all security configurations and permissions assigned to the ISSG take effect in the Workday tenant. Let’s analyze the question and evaluate each option systematically to determine the correct task, ensuring the answer aligns with Workday’s documented processes and the Workday Pro Integrations Study Guide.

Context of the Scenario

You’ve completed the following:

Created an ISU and configured it (e.g., with " Do Not Allow UI Sessions " checked for web service-only access).

Set up an ISSG and assigned the ISU to it.

Defined the necessary security policies (e.g., domain security policies with " Get " and/or " Put " access) for the ISSG to support the EIB’s operations.

Assigned the ISU and ISSG to the EIB integration system.

The question now is what must be done before launching the EIB to ensure it functions as intended. In Workday, changes to security policies—such as adding permissions to an ISSG—do not take effect immediately. They remain in a " pending " state until activated, which is a key aspect of Workday’s security administration process.

Evaluation of Options

Option A: Activate Pending Security Policy ChangesIn Workday, whenever you modify security policies (e.g., granting domain permissions like " Integration Build " or " Custom Report Creation " to an ISSG), these changes are staged as " pending. " To apply them to the tenant and make them active, you must run the " Activate Pending Security Policy Changes " task. This task reviews all pending security updates, allows you to add a comment for audit purposes, and, upon confirmation, activates the changes. Without this step, the ISSG will not have the effective permissions required for the EIB to access data or execute its operations, potentially causing the launch to fail due to insufficient authorization. This aligns directly with the scenario, as security policies have been configured and assigned, but not yet activated.

Option B: View Security for Securable ItemThe " View Security for Securable Item " report is a diagnostic tool in Workday that allows you to inspect the security configuration for a specific object (e.g., a web service operation, report, or task). It shows which security groups have access and what permissions (e.g., " Get, " " Put, " " View, " " Modify " ) are granted. While this is useful for verifying that the ISSG has the correct policies assigned, it is a passive report—it does not modify or activate anything. Running this task would not enable the EIB to launch, as it doesn’t affect the pending security changes. Thus, it’s not the required step before launching the EIB.

Option C: Assign the ISSG to only one security policyThis option suggests limiting the ISSG to a single security policy, but this is neither a standard Workday requirement nor a task that exists as a standalone action. ISSGs can and often do have multiple security policies assigned (e.g., permissions for various domains like " Integration Build, " " Custom Report Access, " etc.), depending on the integration’s needs. Moreover, the question states that the ISSG has already been configured with the " correct security policies " and assigned to the EIB, implying this step is complete. Restricting the ISSG to one policy after the fact would require editing permissions again, triggering more pending changes, and still necessitate activation—making this option illogical and incorrect.

Option D: Maintain Integration Security PoliciesThere is no specific task in Workday called " Maintain Integration Security Policies. " This option seems to be a misnomer or a conflation of other tasks, such as " Maintain Domain Permissions for Security Group " (used to assign permissions to an ISSG) or broader security maintenance activities. However, the question indicates that the security policies are already correctly configured and assigned. If this option intended to imply further configuration, it would still result in pending changes requiring activation via Option A. As a standalone action, it does not represent a valid or necessary task to enable the EIB launch.

Why Option A is Correct

The " Activate Pending Security Policy Changes " task is a mandatory step in Workday’s security workflow after modifying security policies, such as those assigned to an ISSG for an EIB. Workday’s security model uses a pending changes queue to ensure that updates are reviewed and deliberately applied, maintaining control and auditability. Without activating these changes:

The ISSG will lack the effective permissions needed for the EIB to access required domains or perform its operations (e.g., retrieving data from a custom report or delivering a file).

The EIB launch could fail with errors like " Insufficient Privileges " or " Access Denied. "

Running this task ensures that the security configuration is live, allowing the ISU (via the ISSG) to authenticate and execute the EIB successfully. This is a standard practice in Workday integration setup, as emphasized in the Workday Pro Integrations curriculum.

Practical Steps to Perform Option A

Log into the Workday tenant with a security administrator role.

Search for and select the " Activate Pending Security Policy Changes " task.

Review the list of pending changes (e.g., new permissions added to the ISSG).

Enter a comment (e.g., " Activating security for EIB launch – ISSG permissions " ).

Check the " Confirm " box and click " OK " to activate the changes.

Once completed, the security policies are live, and the EIB can be launched.

Verification with Workday Documentation

The Workday Pro Integrations Study Guide and related training materials confirm that activating pending security policy changes is a prerequisite after configuring security for integrations. This step ensures that all permissions are in effect, enabling the ISU and ISSG to support the EIB’s functionality. Community resources and implementation guides also consistently highlight this task as the final step before launching integrations that rely on updated security settings.

Workday Pro Integrations Study Guide References

Section: Integration Security Configuration – Explains the process of assigning security policies to ISSGs and the need to activate changes to operationalize them.

Section: Enterprise Interface Builder (EIB) – Notes that security updates for EIBs must be activated before launching to ensure proper access.

Section: Security Administration – Details the " Activate Pending Security Policy Changes " task as the mechanism to apply pending security modifications across the tenant.

The XML fragment shown follows the ReportasaService (RaaS) structure typical for Workday custom report output:

< wd:Report_Entry >

< wd:Dependents_Group >

< wd:Name > Megan McNeil < /wd:Name >

< wd:Age > 25 < /wd:Age >

< wd:Relationship wd:Descriptor= " Child " >

< wd:ID wd:type= " WID " > 7507df6a99664ce7bc0cb902cf370543 < /wd:ID >

< wd:ID wd:type= " Relationship_ID " > Child < /wd:ID >

< /wd:Relationship >

< /wd:Dependents_Group >

< /wd:Report_Entry >

Inside each < wd:Report_Entry > , the target value Relationship_ID resides under:

wd:Dependents_Group

→ wd:Relationship

→ wd:ID (wd:type= " Relationship_ID " )

When writing the template:

< xsl:template match= " wd:Report_Entry " >

XSLT uses a relative XPath (starting with ./) to navigate from the matched node.

Therefore, the correct XPath should be:

/wd:Dependents_Group/wd:Relationship/wd:ID

That expression selects the wd:ID element so you can then test/extract where wd:type= " Relationship_ID " .

Why the other options are incorrect:

Option

Why Incorrect

A & B

These use an equality test incorrectly inside the XPath expression — they would not return the node value and are syntactically invalid for value extraction.

C

Missing ./ — would still work in many cases, but Workday XSLT best practice is to use relative paths when inside a match.

Workday Pro Integration guidance for RaaS/XSLT stresses:

Always scope node selection relative to the current context tree using prefixqualified XPath expressions.

The Test Security Related Action shows Available by User = No when the security group running the integration lacks View permissions to the fields used in the override logic.

From Workday documentation:

Field Overrides require the ISSG to have View access to the domain policies securing each field referenced in the override, otherwise Workday blocks the field from execution.

Therefore, the appropriate fix is to:

• Identify the domains that secure the calculated fields and overridden fields

• Grant the ISSG View access in those domain security policies

• Activate pending changes

Options B and C incorrectly focus only on web service operations.

Option D incorrectly suggests Modify access — but View is the required minimum.