Workday-Pro-Integrations Exam Dumps - Workday Pro Integrations Certification Exam

When creating an Integration System User (ISU) in Workday, the goal is often to ensure that the user is restricted to performing tasks via web services (e.g., API calls or integrations) and cannot log into the Workday user interface (UI). This is a critical security measure to limit the ISU’s access to only what is necessary for integration purposes, adhering to the principle of least privilege. Let’s evaluate each option provided in the question to determine the correct approach based on Workday’s functionality and best practices as outlined in official documentation and the Workday Pro Integrations program.

Option A: Choose a constrained security group.In Workday, security groups define the permissions and access levels for users, including ISUs. There are two types of Integration System Security Groups (ISSGs): constrained and unconstrained. A constrained ISSG limits access to specific organizations or data scopes, while an unconstrained ISSG provides broader access across the tenant. While choosing a constrained security group can enhance security by limiting the scope of data the ISU can access, it does not directly control whether the ISU authenticates via web services or the UI. The type of security group affects data access permissions, not the authentication method or UI access. Therefore, this option does not address the requirement of ensuring authentication only via web services.

Option B: Select the Do Not Allow UI Sessions checkbox.When creating an ISU in Workday, the "Create Integration System User" task presents an option labeled "Do Not Allow UI Sessions." Selecting this checkbox explicitly prevents the ISU from logging into the Workday UI using its credentials. This setting ensures that the ISU can only authenticate and operate through programmatic means, such as web service calls (e.g., SOAP or REST APIs), which is precisely the intent of the question. This is a standard security practice recommended by Workday to isolate integration activities from interactive user sessions, reducing the risk of misuse or unauthorized access through the UI. This option directly aligns with the requirement and is the correct answer.

Option C: Update the session timeout minutes.The "Session Timeout Minutes" field in the ISU creation task determines how long an ISU’s session remains active before it expires. By default, this is set to 0, meaning the session does not expire, which is suitable for integrations that require continuous operation without interruption. Updating this value (e.g., setting it to a specific number of minutes) would cause the session to time out after that period, potentially disrupting long-running integrations. However, this setting pertains to session duration, not the method of authentication or whether UI access is allowed. It does not prevent the ISU from logging into the UI or ensure that authentication occurs only via web services, making this option irrelevant to the question.

Option D: Generate a random password.Generating a random password for the ISU is a good security practice to ensure the credentials are strong and not easily guessable. However, the password itself does not dictate how the ISU authenticates or whether it can access the UI. A random password enhances security but does not inherently restrict the ISU to web service authentication. Without selecting "Do Not Allow UI Sessions," the ISU could still log into the UI with that password, assuming no other restrictions are applied. Thus, this option does not fulfill the requirement of ensuring authentication only via web services.

Why Option B is Correct

The "Do Not Allow UI Sessions" checkbox is a specific configuration in the ISU setup process that directly enforces the restriction of authentication to web services. This setting is part of Workday’s security framework for integrations, ensuring that ISUs—designed as non-human accounts for programmatic access—cannot be used interactively. This aligns with Workday’s best practices for securing integrations, as outlined in the Workday Pro Integrations Study Guide and related documentation. For example, when an ISU is created with this checkbox selected, any attempt to log into the Workday UI with its credentials will fail, while web service requests (e.g., via SOAP or REST APIs) will succeed, assuming proper permissions are granted via an ISSG.

Practical Application

To implement this in Workday:

Log into your Workday tenant with administrative privileges.

Search for and select the "Create Integration System User" task.

Enter a username and password for the ISU.

Check the "Do Not Allow UI Sessions" checkbox.

Leave "Session Timeout Minutes" at 0 (default) to avoid session expiration during integrations.

Save the ISU and assign it to an appropriate ISSG (constrained or unconstrained, depending on the integration’s needs).

This configuration ensures the ISU is locked to web service authentication, meeting the question’s objective.

Verification with Workday Documentation

The Workday Pro Integrations Study Guide emphasizes securing ISUs by restricting them to integration-specific tasks. The "Do Not Allow UI Sessions" option is highlighted as a key control for preventing UI access, ensuring that ISUs operate solely through web services. This is also consistent with broader Workday security training materials, such as those available on Workday Community, which stress isolating integration accounts from human user activities.

Workday Pro Integrations Study Guide References

Section: Integration Security Fundamentals – Discusses the role of ISUs and the importance of restricting their access to programmatic interactions.

Section: Configuring Integration System Users – Details the "Create Integration System User" task, including the "Do Not Allow UI Sessions" checkbox as a security control.

Section: Best Practices for Integration Security – Recommends using this setting to enforce least privilege and protect the tenant from unauthorized UI access by integration accounts.

The XML fragment shown follows the Report‑as‑a‑Service (RaaS) structure typical for Workday custom report output:

Megan McNeil

25

7507df6a99664ce7bc0cb902cf370543

Child

Inside each , the target value Relationship_ID resides under:

wd:Dependents_Group

→ wd:Relationship

→ wd:ID (wd:type="Relationship_ID")

When writing the template:

XSLT uses a relative XPath (starting with ./) to navigate from the matched node.

Therefore, the correct XPath should be:

/wd:Dependents_Group/wd:Relationship/wd:ID

That expression selects the wd:ID element so you can then test/extract where wd:type="Relationship_ID".

Why the other options are incorrect:

Option

Why Incorrect

A & B

These use an equality test incorrectly inside the XPath expression — they would not return the node value and are syntactically invalid for value extraction.

C

Missing ./ — would still work in many cases, but Workday XSLT best practice is to use relative paths when inside a match.

Workday Pro Integration guidance for RaaS/XSLT stresses:

Always scope node selection relative to the current context tree using prefix‑qualified XPath expressions.

In Workday integrations, XSLT is used to transform XML data, such as the output from an Enterprise Interface Builder (EIB) or a web service-enabled report, into a desired format for third-party systems. In this scenario, you need to write XSLT to process wd:Dependents_Group elements and output a relationship code based on the value of the wd:Relationship attribute or element. The requirement is to output "SP" for a "Spouse" relationship, "CH" for a "Child" relationship, and "OTHER" for any other relationship, using an statement within a template matching wd:Dependents_Group.

Here’s why option C is correct:

XSLT Structure: The element in XSLT provides conditional logic similar to a switch statement. It evaluates conditions in elements sequentially, executing the first matching condition, and uses for any case that doesn’t match.

Relationship as an Attribute: Based on the provided XML snippet, wd:Relationship is an attribute (e.g., Spouse within wd:Dependents_Group). However, in Workday XML for integrations, wd:Relationship is often represented as an attribute (@wd:Relationship) rather than a child element, especially in contexts like dependent data in reports. The syntax @wd:Relationship in the test attribute of correctly references this attribute, aligning with Workday’s typical XML structure for such data.

Condition Matching:

The first SP checks if the wd:Relationship attribute equals "Spouse" and outputs "SP" if true.

The second CH checks if the wd:Relationship attribute equals "Child" and outputs "CH" if true.

The OTHER handles all other cases, outputting "OTHER" if the relationship is neither "Spouse" nor "Child."

Context in Template: Since the template matches on wd:Dependents_Group, the test conditions operate on the current wd:Dependents_Group element and its attributes, ensuring the correct relationship code is output for each dependent. The XML snippet shows wd:Relationship as an element, but Workday documentation and integration practices often standardize it as an attribute in XSLT transformations, making @wd:Relationship appropriate.

Why not the other options?

A.

xml

WrapCopy

SP

CH

OTHER

This assumes wd:Relationship is a child element of wd:Dependents_Group, not an attribute. The XML snippet shows wd:Relationship as an element, but in Workday integrations, XSLT often expects attributes for efficiency and consistency, especially in report outputs. Using wd:Relationship without @ would not match the attribute-based structure commonly used, making it incorrect for this context.

B.

xml

WrapCopy

SP

CH

OTHER

This correctly uses @wd:Relationship for an attribute but has a logical flaw: if wd:Relationship='Child', the second would output "CH," but the order of conditions matters. However, the primary issue is that it doesn’t match the exact structure or intent as clearly as option C, and Workday documentation often specifies exact attribute-based conditions like those in option C.

D.

xml

WrapCopy

SP

CH

OTHER

This uses an absolute path (/wd:Relationship), which searches for a wd:Relationship element at the root of the XML document, not within the current wd:Dependents_Group context. This would not work correctly for processing dependents in the context of the template matching wd:Dependents_Group, making it incorrect.

To implement this in XSLT:

Within your template matching wd:Dependents_Group, you would include the statement from option C to evaluate the wd:Relationship attribute and output the appropriate relationship code ("SP," "CH," or "OTHER") based on its value. This ensures the transformation aligns with Workday’s XML structure and integration requirements for processing dependent data in an EIB or web service-enabled report, even though the provided XML shows wd:Relationship as an element—XSLT transformations often normalize to attributes for consistency.

Workday Pro Integrations Study Guide: Section on "XSLT Transformations for Workday Integrations" – Details the use of , , , and XPath for conditional logic in XSLT, including handling attributes like @wd:Relationship.

Workday EIB and Web Services Guide: Chapter on "XML and XSLT for Report Data" – Explains the structure of Workday XML (e.g., wd:Dependents_Group, @wd:Relationship) and how to use XSLT to transform dependent data, including attribute-based conditions.

Workday Reporting and Analytics Guide: Section on "Web Service-Enabled Reports" – Covers integrating report outputs with XSLT for transformations, including examples of conditional logic for relationship codes.

The Document Transformation Connector is used in Workday to process and reformat XML outputs — often from Core Connector or EIB integrations — into custom formats like CSV, JSON, or flattened XML.

“The primary role of the Document Transformation Connector is to apply XSLT-based formatting, data reorganization, and validation to the output of Workday integrations before delivery to downstream systems.”

This is especially useful when third-party vendors require a specific format not natively supported by the integration system.

Why the other options are incorrect:

A. Managing business processes is not a DT Connector’s function.

B. Calculations are not the main purpose — that’s more for Calculated Fields or Studio.

D. While security is essential, secure connections are managed through Workday’s integration system and transport configuration, not the DT connector.

The scenario involves a Core Connector: Candidate Outbound integration with the Data Initialization Service (DIS), where the vendor requires the "Country" field to be formatted differently (e.g., "United States of America" to "USA"). This is a data transformation requirement, and Core Connectors provide specific tools to handle such formatting. Let’s evaluate the solution:

Requirement:The vendor needs a shortened country code (e.g., "USA" instead of "United States of America") in the output file. This involves transforming the delivered "Country" field value from the Candidate business object into a vendor-specific format.

Integration Maps:In Workday Core Connectors, integration maps are used to transform or map field values from Workday’s format to a vendor’s required format. For example, you can create a map that replaces "United States of America" with "USA," "Canada" with "CAN," etc. This is configured via the "Configure Integration Maps" related action on the integration system, allowing you to define a lookup table or rule-based transformation for the Country field.

Option Analysis:

A. Use an Evaluated Expression calculation and add it to the integration’s report data source: Incorrect. While an Evaluate Expression calculated field could transform the value (e.g., if-then logic), Core Connectors don’t directly use report data sources for output formatting. Calculated fields are better suited for custom reports or EIBs, not Core Connector field mapping.

B. Use the integration related action Configure Integration Population Eligibility: Incorrect. This action filters the population of candidates included (e.g., based on eligibility criteria), not the formatting of individual fields like Country.

C. Use the integration services to only output shortened country codes: Incorrect. Integration services define the dataset or events triggering the integration, not field-level formatting or transformations.

D. Use the integration related action Configure Integration Maps: Correct. Integration maps are the standard Core Connector tool for transforming field values (e.g., mapping "United States of America" to "USA") to meet vendor requirements.

Implementation:

Navigate to the Core Connector: Candidate Outbound integration system.

Use the related action Configure Integration Maps.

Create a new map for the "Country" field (e.g., Source Value: "United States of America," Target Value: "USA").

Apply the map to the Country field in the integration output.

Test the output file to ensure the transformed value (e.g., "USA") appears correctly.

References from Workday Pro Integrations Study Guide:

Core Connectors & Document Transformation: Section on "Configuring Integration Maps" details how to transform field values for vendor-specific formatting.

Integration System Fundamentals: Explains how Core Connectors handle data transformation through maps rather than calculated fields or services for field-level changes.

The Exempt field is being used in Population Eligibility, and eligibility fields must be readable by the ISSG. If the domain security policy for a field denies View access, Workday cannot evaluate the eligibility and returns no data.

From Workday security governance:

“For integrations using Population Eligibility, the ISSG must have View permission on all fields referenced in eligibility rules.”

If View is missing, the eligibility rule cannot execute → No workers are considered eligible → Output contains zero records → Error logged for denied field access.

Therefore, the solution is:

• Grant the ISSG View access to the domain that secures the Population Eligibility field

Modify access (A/C) is not needed — eligibility only needs read-access.

In Workday integrations, XSLT is used to transform XML data, such as the output from a web service-enabled report or EIB, into a desired format for third-party systems. In this scenario, you need to create an XSLT template that matches the wd:Education_Group element in the provided XML and transforms it to produce the degree data in the format shown in the Transformed_Record example. The goal is to output each degree (e.g., "California University MBA" and "Georgetown University B.S.") as a element within a parent element.

Here’s why option A is correct:

Template Matching: The correctly targets the wd:Education_Group element in the XML, which contains multiple wd:Education elements, each with a wd:Degree child, as shown in the XML snippet (e.g., California UniversityMBA).

Transformation Logic:

creates the outer element for each education group, matching the structure in the Transformed_Record example (e.g., California University MBA).

copies the content of the child elements (wd:Education and wd:Degree) and concatenates their values into a single string. The select="*" targets all child elements of wd:Education_Group, and xsl:value-of outputs their text content (e.g., "California University" and "MBA" become "California University MBA").

This approach ensures that each wd:Education_Group is transformed into a single element with the combined text of the wd:Education and wd:Degree values, matching the example output.

Context and Output: The template operates on each wd:Education_Group, producing the nested structure shown in the Transformed_Record (e.g., California University MBAGeorgetown University B.S.), assuming a parent template or additional logic wraps the elements in .

Why not the other options?

B.

xml

WrapCopy

This uses without , which outputs the concatenated text of all child elements but does not preserve any XML structure or formatting. It would produce plain text (e.g., "California UniversityMBACalifornia UniversityB.S.") without the proper tags, failing to match the structured output in the example.

C.

xml

WrapCopy

This uses , but does not take a select attribute—it simply copies the current node. This would result in an invalid XSLT syntax and fail to produce the desired output, making it incorrect.

D.

xml

WrapCopy

This uses , which copies all child nodes (e.g., wd:Education and wd:Degree) as-is, including their element structure, resulting in output like California UniversityMBA. This does not match the flattened, concatenated text format in the Transformed_Record example (e.g., California University MBA), making it incorrect.

To implement this in XSLT for a Workday integration:

Use the template from option A to match wd:Education_Group, apply to concatenate and output the wd:Education and wd:Degree values as a single element. This ensures the transformation aligns with the Transformed_Record example, producing the required format for the integration output.

Workday Pro Integrations Study Guide: Section on "XSLT Transformations for Workday Integrations" – Details the use of , , and for transforming XML data, including handling grouped elements like wd:Education_Group.

Workday EIB and Web Services Guide: Chapter on "XML and XSLT for Report Data" – Explains the structure of Workday XML (e.g., wd:Education_Group, wd:Education, wd:Degree) and how to use XSLT to transform education data into a flattened format.

Workday Reporting and Analytics Guide: Section on "Web Service-Enabled Reports" – Covers integrating report outputs with XSLT for transformations, including examples of concatenating and restructuring data for third-party systems.