All Pegasystems exams

Free PEGACPSSA25V1 practice test: 30 questions with answers

30 original questions for Certified Pega Senior System Architect (Pega Platform '25), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
60 questions, 90 min
Passing score
70%

PEGACPSSA25V1 exam guide: topics, cost and format

All 30 PEGACPSSA25V1 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Application Development (5 questions)

  1. Question 1

    A developer adds a circumstance-qualified version of a rule named CalculateFee to the class Work-Claim. The circumstance applies when the Region property equals EMEA. An unqualified base CalculateFee rule also exists in the same class. A case where Region is EMEA runs the rule. Which rule does Pega execute?

    1. AThe unqualified base rule, because circumstanced rules apply only to data pages
    2. BThe circumstanced rule, because its circumstance matches and it overrides the base rule
    3. CBoth rules run in sequence, with the base rule executing first
    4. DThe rule in the highest-numbered ruleset version, ignoring the circumstance condition
    Show answer and explanation
    Correct answer: B

    A circumstance-qualified rule takes precedence over the unqualified rule with the same name when its circumstance matches, and the base rule is used only when no circumstance applies. Option A is wrong because circumstances apply to many rule types, not only data pages, C is wrong because rules are not chained by default, and D is wrong because the circumstance is part of how Pega selects the rule.

  2. Question 2

    A retail application must process each order-confirmation message as soon as a customer places an order. The case flow places each message on a queue, and the messages must be handled one at a time in the background without holding up the user. Which Pega mechanism is most appropriate?

    1. AA queue processor that picks up queued items asynchronously as they arrive
    2. BA keyed data page that caches confirmation messages for each order number
    3. CA job scheduler that runs every night and processes all pending orders in one batch
    4. DA declare expression that recalculates the confirmation whenever the order changes
    Show answer and explanation
    Correct answer: A

    A queue processor consumes items placed on a queue asynchronously, so the user does not wait for the work. A nightly job scheduler runs at set times rather than reacting to each item, a keyed data page loads and caches data rather than processing queued work, and a declare expression recalculates values without sending messages.

  3. Question 3

    An architect is modelling a set of country and currency reference records that are shared across many applications. The records are not work items that move through a flow. Which class type is most appropriate to hold them?

    1. AA data class, because it holds reference records that are not work items
    2. BA work class, because every record in Pega must be a case
    3. CA flow class, because reference records are always processed by a flow
    4. DA rule class, because reference records must be stored as rule instances
    Show answer and explanation
    Correct answer: A

    Data classes hold reference and business data that is not a work item, and their names carry a Data- prefix. A work class holds case instances, so option B is wrong, and reference records are not stored as flows or as rule instances, so C and D are also wrong.

  4. Question 4

    Three business-line applications all need the same customer identity verification rules. The team wants to maintain those rules in one place and have each application use them without copying. What is the best approach?

    1. ACopy the verification rules into each application's ruleset so each team can adjust them
    2. BRewrite the verification logic as a flow in each application's case type
    3. CExport the rules to a spreadsheet and import them into each application when needed
    4. DPlace the rules in a shared ruleset in a common base application that all three build on
    Show answer and explanation
    Correct answer: D

    Built-on applications let several applications share a common ruleset stack, so the rules are maintained once and inherited by each application. Copying the rules creates duplicates that drift apart, rewriting them in each application repeats effort, and a spreadsheet is not a way to share live rules.

  5. Question 5

    A developer needs to change a rule that lives in a ruleset version that has already been locked. The change must be delivered in the next build. What should the developer do?

    1. ACreate a new ruleset version, save the changed rule into it, and add that version to the application
    2. BUnlock the existing version and edit the rule, since locking is only a warning
    3. CDelete the locked version and recreate the rules from memory in the same version
    4. DEdit the rule directly in the production database so the change takes effect immediately
    Show answer and explanation
    Correct answer: A

    A locked ruleset version is protected against changes, so the correct path is a new ruleset version that carries the updated rule. Treating a lock as only a warning, deleting the version, or editing the database directly would all bypass Pega's rule management.

Case Management (5 questions)

  1. Question 6

    A claims team wants new review assignments to be picked up by any available member of the Claims Review team, rather than held for one named operator who may be away. Which routing approach meets this need?

    1. ARoute each assignment to the team lead's operator ID so the lead can reassign it later
    2. BHard-code one team member's operator ID in the flow so the assignment is always visible
    3. CRoute each assignment to the Claims Review work group so any available member can work it
    4. DRoute the assignment to the operator who created the case so the original context is kept
    Show answer and explanation
    Correct answer: C

    Routing to a work group lets any member of the team pick up the assignment, which avoids stalling the case when one person is unavailable. Routing to a single named operator, including the lead or the case creator, leaves the work stuck if that person is away.

  2. Question 7

    A loan case must start three independent verification subprocesses at the same time: credit, identity and fraud. The next step must run only after all three have finished. Which flow design meets this requirement?

    1. ARun the three checks one after another in a loop until each one reports complete
    2. BStart the three checks in parallel from a split, then wait at a join until every branch completes
    3. CStart the three checks and continue at once, checking their status on a daily schedule
    4. DMove the three checks into a data page so they are cached and run once per session
    Show answer and explanation
    Correct answer: B

    A split starts parallel branches and a join holds the flow until every branch has completed, which matches the dependency. Sequential checks take longer than needed, continuing at once ignores the requirement, and a data page caches data rather than running verification steps.

  3. Question 8

    Two users open the same case at the same time. The first user saves their edits. When the second user saves, Pega detects that the case changed after they opened it and rejects the save. Which locking approach does this describe?

    1. APessimistic locking, which blocks the second user from opening the case while the first user edits
    2. BNo locking, so the second save silently overwrites the first user's changes
    3. CA shared read lock, which lets both users save changes to the same case at once
    4. DOptimistic locking, which checks for changes made since the case was opened before saving
    Show answer and explanation
    Correct answer: D

    Optimistic locking lets both users work and checks at save time whether the record changed since it was read, so the conflicting save is rejected. Pessimistic locking blocks access up front, no locking lets the last save overwrite earlier changes, and a shared read lock does not allow safe concurrent saves.

  4. Question 9

    A flow action on a case must set a default reference number before the action's own processing starts. A separate step must send a confirmation email only after the action has completed. Which pairing of flow action features fits?

    1. AA data page that sends the confirmation email whenever the case is opened
    2. BPost-processing for the reference number and pre-processing for the confirmation email
    3. CValidation rules for the reference number and a report definition for the email
    4. DPre-processing for the reference number and post-processing for the confirmation email
    Show answer and explanation
    Correct answer: D

    Pre-processing runs before the flow action's own processing, so it can set values the action depends on, and post-processing runs after the action completes, which suits follow-up work such as notifications. Validation rules check input, a report definition reads data, and a data page loads or caches data rather than sending messages.

  5. Question 10

    A case type's SLA has a goal of two days and a deadline of three days. On day two the case is still open. Which statement describes the SLA state?

    1. AThe case is cancelled automatically because the goal time has passed and no action was taken
    2. BThe goal has passed, but the deadline is not yet reached, so the case is not in breach
    3. CThe deadline has passed, so escalation has already run and the case is marked as breached
    4. DNothing is tracked against the SLA until the case reaches the deadline on day three
    Show answer and explanation
    Correct answer: B

    In a Pega SLA the goal is the target completion time and the deadline is the later point at which the SLA is breached and escalation applies. On day two the goal has passed but the deadline has not, so the case is not yet in breach, and the other options misstate what the goal and deadline do.

Data and Integration (5 questions)

  1. Question 11

    A form requires a product code made of exactly three uppercase letters followed by four digits, such as ABC1234. The system must reject any other format before the case is saved. Which approach fits?

    1. AA keyed data page that stores valid product codes for lookup
    2. BAn edit validate rule that tests the entered text against a regular-expression pattern
    3. CA formatting utility that changes the code to uppercase for display without checking it
    4. DA report definition that lists malformed product codes after the case is saved
    Show answer and explanation
    Correct answer: B

    An edit validate rule can test input against a regular-expression pattern so that values not matching the format are rejected before the save. A keyed data page loads reference data, a report definition finds problems only after saving, and a formatting utility changes display without enforcing the format.

  2. Question 12

    A customer service screen shows the address of whichever customer is selected, and the same customer may be requested several times in one session. The address should be retrieved once per customer and reused. Which data page type fits?

    1. AA keyed data page that is keyed by customer ID so each customer's address loads once
    2. BA report definition that returns all customers and must be filtered on screen each time
    3. CA non-keyed data page that holds one shared set of addresses for all customers
    4. DA field value rule that stores each customer's address as fixed text
    Show answer and explanation
    Correct answer: A

    A keyed data page is identified by a key such as a customer ID, so each customer's data can be loaded once and reused. A non-keyed page cannot separate customers, a report definition returns more than the screen needs, and a field value rule stores fixed values rather than retrieved records.

  3. Question 13

    A lookup list is identical for everyone using a server node, and the team wants one loaded copy shared by all requestors on that node. Which data page scope should be used?

    1. ANode, which shares one loaded copy across all requestors on the same node
    2. BThread, which keeps the data only for the processing thread that loaded it
    3. CRequestor, which keeps a separate copy for each user session
    4. DCase, which keeps the data for the life of a single case
    Show answer and explanation
    Correct answer: A

    Node scope loads the data once per node and shares it across the requestors on that node, which suits common lookup lists. Thread and requestor scopes keep narrower copies, and case is not a data page scope option.

  4. Question 14

    A partner's system must call Pega over HTTP to create a new case and receive a JSON response. Which Pega rule exposes this inbound endpoint?

    1. AA Service REST rule, which exposes Pega processing as a REST endpoint for callers
    2. BA Service SOAP rule, which exposes Pega processing only as XML-based messages
    3. CA data transform, which maps incoming fields to property values inside Pega
    4. DA Connect REST rule, which sends requests from Pega to an external service
    Show answer and explanation
    Correct answer: A

    A Service REST rule defines an inbound REST endpoint that external callers can invoke, whereas a Connect REST rule handles outbound calls from Pega. A Service SOAP rule exposes SOAP messages rather than REST, and a data transform maps values without providing an endpoint.

  5. Question 15

    A Connect REST integration to an external provider starts returning HTTP 401 Unauthorized, while the endpoint address has not changed. Which cause is most likely?

    1. AThe credentials or authentication settings sent with the request are missing or invalid
    2. BThe endpoint path was changed to one that no longer exists on the provider
    3. CThe external provider is temporarily overloaded and cannot accept new requests
    4. DThe request payload is larger than the size the provider is willing to accept
    Show answer and explanation
    Correct answer: A

    HTTP 401 means the request was not authenticated, so missing or invalid credentials or authentication settings are the most likely cause. Overload typically appears as 503, a missing path as 404, and an oversized request as 413, so those do not explain a 401.

System Administration (5 questions)

  1. Question 16

    A developer needs to see the order in which activities and rules ran during one slow transaction, with the time each step took. Which Pega tool provides this?

    1. AThe Clipboard, which displays the property values held by the current requestor
    2. BThe alert log, which lists only the errors raised during the session
    3. CThe Tracer, which records the rules executed in a session along with their timings
    4. DThe Application Explorer, which lists the rules that belong to each class in the application
    Show answer and explanation
    Correct answer: C

    Tracer records the sequence of rules and activities executed in a session with their timings, which suits pinpointing slow steps in one transaction. The Clipboard shows property values, the alert log lists alerts and exceptions rather than a step-by-step run, and the Application Explorer only browses rules.

  2. Question 17

    Operations staff want a view that collects performance alerts and exceptions from the system over time, so they can see which problems recur most often and prioritise tuning. Which tool is most suitable?

    1. ATracer, started for one requestor to capture a single step-by-step session
    2. BThe Clipboard, opened for each user to inspect their property values
    3. CPega Predictive Diagnostic Cloud, which gathers alerts and exceptions over time
    4. DThe data page scope setting, which changes how long cached data is kept
    Show answer and explanation
    Correct answer: C

    Pega Predictive Diagnostic Cloud collects alerts and exceptions from the system over time and highlights recurring problems, which supports prioritising tuning. Tracer suits a single session, the Clipboard shows property values for one requestor, and data page scope controls caching rather than measuring performance.

  3. Question 18

    Users report that a screen becomes slow only after many cases are opened in one session. The team wants to find the cause without guessing. Which approach is best?

    1. ARestart the application servers every night so that memory is released
    2. BRaise every timeout value in the application so that slow requests are allowed to finish
    3. CTurn off logging so the servers have more capacity for the users
    4. DReproduce the slow path in a test environment and measure it with Tracer or Performance Analyzer
    Show answer and explanation
    Correct answer: D

    Reproducing the scenario in a test system and measuring it identifies the rules or data loads responsible before any change is made. Nightly restarts and higher timeouts can hide symptoms without finding the cause, and turning off logging removes evidence while adding little capacity.

  4. Question 19

    An activity fails only for certain cases, and the user sees a generic error message on screen. An administrator needs the underlying exception and stack trace. Where should they look first?

    1. AThe report definition that lists the cases affected by the error
    2. BThe PegaRULES log files, which record exceptions and stack traces for the failed activity
    3. CThe screenshot the user attached to the case, which shows only what was displayed
    4. DThe access group assigned to the user, which lists the errors they are allowed to see
    Show answer and explanation
    Correct answer: B

    The PegaRULES log records exceptions and stack traces that a generic on-screen message hides, so it is the first place to find the root cause. A report definition shows case data, a screenshot shows only what the user saw, and an access group controls permissions rather than recording errors.

  5. Question 20

    A team has an external payment service with one endpoint address for test and a different address for production. It wants to change the address per environment without editing the rules that call the service. Which feature should it use?

    1. AAn access group that gives each environment its own permission set
    2. BAn Application Settings rule that holds the endpoint, with a different value set in each environment
    3. CA hard-coded URL inside each Connect REST rule, updated by hand during deployment
    4. DA data page with a refresh strategy that copies the production address into test
    Show answer and explanation
    Correct answer: B

    Application Settings rules hold environment-specific values such as endpoint addresses, so the value can differ between systems without editing the rules that read it. A hard-coded URL forces rule changes in each environment, access groups control permissions, and a data page refresh copies values rather than configuring a per-environment address.

Security (5 questions)

  1. Question 21

    A supervisor should see only cases whose Region property matches the supervisor's own Region value. Access depends on comparing attributes of the user and the case, not on the role alone. Which access control model does this describe?

    1. ARole-based access control, because the supervisor role alone determines visibility
    2. BEncryption of data, because only encrypted Region values are visible to the supervisor
    3. CAttribute-based access control, because access depends on comparing user and case attributes
    4. DSingle sign-on, because the supervisor signs in once to reach all cases
    Show answer and explanation
    Correct answer: C

    Attribute-based access control grants or denies access by comparing attributes such as Region on the user and on the case. Role-based control decides by role alone, encryption protects stored values rather than controlling visibility, and single sign-on governs authentication rather than record-level access.

  2. Question 22

    Which two measures help protect case attachments that contain sensitive documents? (Choose two.)

    1. AMake each attachment open to anyone who has its link so reviewers can reach it quickly
    2. BRestrict who can view attachments by applying access control to the case and its attachments
    3. CStore the attachment password in the case description so reviewers can open the file
    4. DEncrypt sensitive attachment content in storage so copies on disk are unreadable without keys
    Show answer and explanation
    Correct answer: B, D

    Limiting who can view attachments through access control and encrypting stored content both reduce exposure of sensitive documents. Open links and passwords stored in free-text fields weaken protection, so they are not valid measures.

  3. Question 23

    A new claims adjuster joins the team and needs the same access as the existing adjusters. The administrator wants the least effort and no excess rights. What should be done?

    1. AGrant the new adjuster the system administrator role, then remove rights later
    2. BCopy an existing adjuster's login details so the new user inherits the same access
    3. CAssign the existing role that the adjusters already hold to the new operator
    4. DGive the new adjuster a shared password that the whole team already uses
    Show answer and explanation
    Correct answer: C

    Assigning the role the team already uses gives the adjuster the same access through role-based control, with no excess rights. Copying or sharing logins breaks accountability, and the administrator role grants far more than the job needs.

  4. Question 24

    A database backup that holds customer tax identifiers is copied to removable media and read by an unauthorised person. Which control would have protected the stored values?

    1. AA longer session timeout for operators who view the tax identifiers, so their sessions stay open while they work
    2. BEncryption in transit only, which protects the connection while data is being sent
    3. CEncryption at rest for the stored data, so the backup cannot be read without the key
    4. DA report definition that masks the identifiers when it is printed for the review team
    Show answer and explanation
    Correct answer: C

    Encryption at rest protects stored data, including backups, so the contents cannot be read without the decryption key. Encryption in transit protects data only while it moves, a session timeout does nothing for a copied backup, and masking in a report does not secure the stored values.

  5. Question 25

    A compliance team asks who changed a case's approved amount last month and what the value was before the change. Which capability supports this?

    1. AA data page refresh, which reloads the latest value each time the data page is loaded for the screen
    2. BAudit history on the tracked property, recording each change, who made it and when
    3. CAn access group, which lists the operators who were allowed to view the case
    4. DA flow action validation, which checks the entered amount before the case is saved
    Show answer and explanation
    Correct answer: B

    Audit tracking records changes to tracked values along with who made them and when, which answers the compliance question. A data page refresh only reloads data, a validation checks input without keeping history, and an access group controls visibility rather than recording changes.

User Experience (5 questions)

  1. Question 26

    A company's intranet team wants to show a Pega case list inside an existing web page built by another team, without rebuilding that page in Pega. Which capability supports this?

    1. AA custom portal rebuilt as a standalone Pega application with its own login
    2. BPega Web Embed, which lets an external web page host Pega content
    3. CA Constellation DX component that replaces the intranet's navigation menu
    4. DA keyed data page that exports the case list as an HTML table each night
    Show answer and explanation
    Correct answer: B

    Pega Web Embed is designed to place Pega content inside external web pages without rebuilding them. A standalone portal replaces the page rather than embedding into it, a data page only caches data, and a DX component is built for Pega's own user interfaces rather than an existing intranet menu.

  2. Question 27

    A company wants external customers to see only their own cases in a separate portal. Which configuration supports this?

    1. AGive external customers the administrator role so they can find their own cases
    2. BUse one shared portal for all users and hide the menu items that internal staff should not see with stylesheet changes
    3. CCreate a portal for external users and link it to an access group that limits what they can see
    4. DBuild a separate case type for each customer so each one has its own portal
    Show answer and explanation
    Correct answer: C

    A dedicated portal tied to an access group, with its own access restrictions, limits external users to their own cases. Administrator access exposes far more than needed, hiding menu items with styling does not restrict data, and a separate case type per customer does not solve visibility.

  3. Question 28

    A team wants a custom user interface widget, built once, that appears on several Constellation pages. Which Pega capability is designed for this?

    1. AA keyed data page that stores the widget's HTML for reuse across pages
    2. BA report definition that displays the widget's data in a table on each page, with its own filters
    3. CAn access group that shows the widget only to selected operators
    4. DA custom DX component built with the Constellation SDK and reused across pages
    Show answer and explanation
    Correct answer: D

    Custom DX components built with the Constellation SDK can be reused across Constellation pages, which matches the requirement. A data page stores data rather than UI, a report definition shows data without providing a reusable widget, and an access group controls visibility rather than building components.

  4. Question 29

    An external mobile app must create a case and read its current assignment without using the Pega user interface. Which approach fits?

    1. AConnect the mobile app directly to the Pega database tables for reading and writing
    2. BEmbed the Pega user interface in a web view inside the mobile app
    3. CCall the DX API REST endpoints with authenticated requests from the mobile app
    4. DExport the cases to a CSV file each night and let the mobile app read that file
    Show answer and explanation
    Correct answer: C

    The DX API exposes Pega operations over REST, so an authenticated external app can create cases and read assignments without the Pega user interface. Embedding the UI, reading database tables directly, or using nightly exports does not give the app safe, current access through a supported interface.

  5. Question 30

    A team wants its Constellation screens to match Pega's standard look and behaviour and to stay upgrade-safe. Which approach fits best?

    1. AUse the standard Constellation components and design system tokens, adding customisation only where needed
    2. BBuild each screen from scratch with its own components, so no standard behaviour is inherited
    3. COverride the design with custom stylesheets that change every standard component's appearance
    4. DCopy the standard components into the application and edit the copies, so the originals are never used again
    Show answer and explanation
    Correct answer: A

    Using the standard components and design system tokens keeps screens consistent and upgrade-safe, with customisation only where it is truly needed. Heavy stylesheet overrides break consistency and upgrades, building from scratch loses standard behaviour, and copying components creates copies that must be maintained separately.