Get Ready to Pass the Identity-and-Access-Management-Architect exam with Salesforce Latest Practice Exam
Get Prepared for Your Identity-and-Access-Management-Architect Exam With Actual Salesforce Study Guide!
NEW QUESTION # 45
An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenario?
- A. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
- B. If the number of provisioned users exceeds Salesforce licence allowances, Identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.
- C. Identify Connect can be deployed as a managed package on Salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.
- D. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session is revoked immediately.
Answer: D
Explanation:
Identity Connect is positioned primarily as a user provisioning and deprovisioning bridge between Microsoft Active Directory and Salesforce. In designs where AD is the authoritative source for user status, deactivating a user upstream should be reflected quickly in Salesforce access. That is why architects pay attention to what happens to existing sessions when a user is disabled in the source directory. The feature is not a managed package, and it is not an identity provider that automatically brokers SSO by itself. It also does not "solve" license overages by disabling users in a FIFO pattern. The relevant capability is operational user-state synchronization: when identity status changes in directory services, Salesforce access should be withdrawn in a controlled, security-focused way. This is why option D is the best answer in Salesforce terms.
NEW QUESTION # 46
Universal containers (UC) have a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properlysecure access to the app. Which two are recommendations to make the UC? Choose 2 answers
- A. Set login IP ranges to the internal network for all of the app users profiles.
- B. Use Google Authenticator as an additional part of the logical processes.
- C. Require high assurance sessions in order to use the connected App
- D. Disallow the use of single Sign-on for any users of the mobile app.
Answer: B,C
Explanation:
High assurance sessions are sessions that require a stronger level of identity verification, such astwo-factor authentication or SAML assertions1. Google Authenticator is an app that generates verification codes on your mobile device that you canuse as a second factor of authentication2. These measures can help prevent unauthorized access to the connected app by ensuring that the useris who they claim to be and that they have access to their mobile device. Disallowing the use of single sign-on (SSO) for the mobile app is not a recommendation because SSO can provide a seamless and secure user experience across multiple applications3. Setting login IP ranges totheinternal network for the app users profiles is not a recommendation because it can limit the mobility and flexibility of the users who are commonly out of the office.
References: 1: Session Security Levels 2: Google Authenticator 3: Connected Apps : [Restrict Login Access by IP Address]
NEW QUESTION # 47
In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?
- A. Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.
- B. Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA
- C. Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.
- D. Use of self-signed certificate leads to lowermaintenance for trusting party because there is no trusted CA cert to maintain.
Answer: A
Explanation:
D is correct because using aself-signed certificate leads to higher maintenance for the trusting party, which is the client or browser that connects to the server. The trusting party needs to add the self-signed certificate to their truststore, which is a repository of trusted certificates, in order to establish a secure connection with the server. Otherwise, the trusting party will see a warning message or an error when accessing the server.
A is incorrect because using a self-signed certificate leads to higher maintenance for the trusted party, not lower. The trusted party needs to maintain multiple self-signed certificates from different servers in their truststore.
B is incorrect because using a self-signed certificate does not make the trusted party act as the trusted CA (Certificate Authority). The trusted CA is the entity that issues and validates certificates for servers. The trusted party only needs to trust the CA's root certificate, which is usually pre-installed in their truststore.
C is incorrect because using a self-signed certificate leads to higher maintenance for the trusting party, not lower. The trusting party still needs to maintain a trusted CA cert in their truststore, which is the self-signed certificate itself.
References: 1: SSL Certificate Installation Instructions & Tutorials - DigiCert 2: How To Install an SSL Certificate from a Commercial ... - DigitalOcean 3: Setup SSL CSR Creation and SSL Certificate Installation
- DigiCert
NEW QUESTION # 48
Refer to the exhibit.
Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?
- A. Authorize third-party service by sending authorization requests to the community-url/services/oauth2
/authonze/expid_value. - B. Authorize third-party service by sending authorization requests to the community-url/services/oauth2
/authorize/cookie_value. - C. For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.
- D. Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.
Answer: A
Explanation:
OAuth 2.0 is an open standard for authorization that allows a third-party application to obtain limited access to a protected resource on behalf of auser. To authorize a third-party service using OAuth 2.0 with the Salesforce Experience Cloud site, the identity architect should do the following steps:
* Create a connected app for the third-party service in Salesforce. A connected app is an applicationthat integrates with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect. To create a connected app, you need to provide the basic information, such as the app name, logo URL, contact email, and API name. You also need toenable OAuth and configure the OAuth settings, such as the callback URL, the scopes, and the policies.
* Authorize the third-party service by sending authorization requests to the community-url/services
/oauth2/authorize/expid_value. This is a special endpoint that allows you to specify an experience ID (expid) as a query parameter in the authorization request. The experience ID is a unique identifier for each experience (community or site) in Salesforce. By using this endpoint, you can dynamically render thelogin page images based on the user's brand preference selected in the third-party service before authorization.
References:
OAuth 2.0
OAuth 2.0 Web Server Authentication Flow
Connected Apps
Create a Connected App
Experience ID
Authorize Apps with OAuth
NEW QUESTION # 49
Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financial system, and CPQ system. Below is the SSO implementation landscape.
What role combination is represented by the systems in this scenario''
- A. Salesforce Org1 and PingFederate are acting as Identity Providers.
- B. Financial System and CPQ System are the only Service Providers.
- C. Salesforce Org1 and Salesforce Org2 are the only Service Providers.
- D. Salesforce Org1 and Salesforce Org2 are acting as Identity Providers.
Answer: C
Explanation:
Explanation
In a SAML-based SSO scenario, the identity provider (IdP) is the system that performs authentication and passes the user's identity and authorization level to the service provider (SP), which trusts the IdP and authorizes the user to access the requested resource1. In this case, PingFederate is the IdP that authenticates users for UC and sends SAML assertions to the SPs. The SPs are the systems that rely on PingFederate for authentication and provide access to their services based on the SAML assertions. The SPs in this scenario are Salesforce Org1, Salesforce Org2, Financial System, and CPQ System2. Therefore, the correct answer is B.
References:
SAML web-based authentication guide
SAML-based single sign-on: Configuration and Limitations
NEW QUESTION # 50
Universal containers (UC) built a customer Community for customers to buy products, review orders, and manage their accounts. UC has provided three different options for customers to log in to the customer Community: salesforce, Google, and Facebook. Which two role combinations are represented by the systems in the scenario? Choose 2 answers
- A. Salesforce is the service provider and Google is the identity provider
- B. Google is the service provider and Facebook is the identity provider
- C. Salesforce is the service provider and Facebook is the identity provider
- D. Facebook is the service provider and salesforce is the identity provider
Answer: A,C
Explanation:
Explanation
The two role combinations that are represented by the systems in the scenario are Salesforce as the service provider and Google as the identity provider, and Salesforce as the service provider and Facebook as the identity provider. This means that Salesforce hosts the customer community app and relies on Google or Facebook to authenticate the users who log in with those options4. Therefore, option B and D are the correct answers.
References: Salesforce as Service Provider and Identity Provider for SSO
NEW QUESTION # 51
An identity architect is setting up an integration between Salesforce and a third-party system. The third-party system needs to authenticate to Salesforce and then make API calls against the REST API.
One of the requirements is that the solution needs to ensure the third party service providers connected app in Salesforce mini need for end user interaction and maximizes security.
Which OAuth flow should be used to fulfill the requirement?
- A. User Agent Flow
- B. Username-Password Flow
- C. JWT Bearer Flow
- D. Web Server Flow
Answer: C
Explanation:
Explanation
JWT Bearer Flow allows the third-party system to authenticate to Salesforce using a digital certificate and a JSON Web Token (JWT) without any user interaction. It also provides a high level of security as it does not require sharing credentials or storing tokens. References: OAuth 2.0 JWT Bearer Token Flow
NEW QUESTION # 52
Universal Containers built a custom mobile app for their field reps to create orders in Salesforce. OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained automatically without forcing the user to log in again. While that improved the field reps' productivity, UC realized that they need a "logout" feature.
What should the logout function perform in this scenario, where user sessions are refreshed automatically?
- A. Invoke the revocation URL and pass the access token.
- B. Clear out the client Id to stop auto session refresh.
- C. Invoke the revocation URL and pass the refresh token.
- D. Clear out all the tokens to stop auto session refresh.
Answer: C
Explanation:
Explanation
The refresh token is used to obtain a new access token when the previous one expires. To revoke the user session, the logout function should invoke the revocation URL and pass the refresh token as a parameter. This will invalidate both the refresh token and the access token, and prevent the user from accessing Salesforce without logging in again2.
References:
Certification Exam Guide
Revoke OAuth Tokens
NEW QUESTION # 53
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self- service. Guests of the portal be able toself-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have been purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate accountand contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers
- A. Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.
- B. Set jp an external login page and call Salesforce APIs for user creation.
- C. Customize me self-registrationApex handler to create only the user record.
- D. Enable "Allow customers and partners to self-register".
- E. Select the "Configurable Self-Reg Page" optionunder Login & Registration.
Answer: C,D,E
Explanation:
Enabling "Allow customers and partners to self-register" allows guests to create their own user accounts in the portal. Selecting the "Configurable Self-Reg Page" option allows the administratorto customize the self- registration page to capture the required fields. Customizing the self-registration Apex handler to create only the user record prevents the automatic creation of a contact record until verification. References: Enable Self- Registration, Customize Self-Registration
NEW QUESTION # 54
A public sector agency is setting up an identity solution for its citizens using a Community built on Experience Cloud and requires the new user registration functionality to capture first name, last name, and phone number. The phone number will be used for identity verification.
Which feature should an identity architect recommend to meet therequirements?
- A. Use an external Identity Provider
- B. Use Login Discovery
- C. Create a custom Lightning Web Component
- D. Integrate with social websites (Facebook, Linkedin. Twitter)
Answer: B
Explanation:
Login Discovery allows the administrator to configure a custom login page that collects additional information from users, such as phone number, and use it for identity verification. Login Discovery can also be used to route users to different identity providers based on their input. References: Login Discovery, Customize Your Experience Cloud Site Login Process
NEW QUESTION # 55
A global fitness equipment manufacturer uses Salesforce to manage its sales cycle. The manufacturer has a custom order fulfillment app that needs to request order data from Salesforce. The order fulfillment app needs to integrate with the Salesforce API using OAuth 2.0 protocol.
What should an identity architect use to fulfill this requirement?
- A. Connected App and OAuth scopes
- B. Authentication Providers
- C. Canvas App Integration
- D. OAuth Tokens
Answer: A
Explanation:
Explanation
To integrate the order fulfillment app with the Salesforce API using OAuth 2.0 protocol, the identity architect should use a Connected App and OAuth scopes. A Connected App is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as OAuth 2.0. OAuth scopes are permissions that define the specific data that an external application can access or modify in Salesforce. To use OAuth 2.0 protocol, the identity architect needs to configure a Connected App in Salesforce and assign the appropriate OAuth scopes to it, such as "api" or "full". References: Connected Apps, OAuth Scopes
NEW QUESTION # 56
Northern Trail Outfitters (NTO) is setting up Salesforce to authenticate users with an external identity provider. The NTO Salesforce Administrator is having trouble getting things setup.
What should an identity architect use to show which part of the login assertion is failing?
- A. SAML Metadata file importer
- B. Security Assertion Markup Language Validator
- C. Connected App Manager
- D. Identity Provider Metadata download
Answer: B
Explanation:
When SAML sign-on fails during setup, the fastest Salesforce-native diagnostic tool is the SAML Validator.
It breaks down the assertion and shows where validation fails, such as certificate issues, audience mismatches, subject formatting, missing attributes, or timestamp problems. That is much more useful than simply reviewing connected app settings or downloading metadata again, because the architect needs visibility into the actual assertion being posted to Salesforce. SAML integrations succeed or fail based on the signed XML and the trust configuration around it, so a validator that exposes the assertion details is the right troubleshooting instrument. In practice, this is the tool admins use to determine whether the issue sits in the identity provider output or in Salesforce configuration. This is why option A is the best answer in Salesforce terms.
NEW QUESTION # 57
Universal Containers (UC) has implemented SSO according to the diagram below. uses SAML while Salesforce Org 1 uses OAuth 2.0. Users usually start their day by first attempting to log into Salesforce Org 2 and then later in the day, they will log into either the Financial System or CPQ system depending upon their job position. Which two systems are acting as Identity Providers?
- A. Pingfederate
- B. Salesforce Org 2
- C. Financial System
- D. Salesforce Org 1
Answer: A,D
Explanation:
Explanation
These are the systems that are acting as identity providers (IdPs) in the SSO scenario. An IdP is a trusted provider that enables a customer to use single sign-on (SSO) to access other websites5. In this case, Pingfederate and Salesforce Org 1 are the IdPs that authenticate the users and issue SAML assertions or OAuth tokens to the service providers (SPs). The SPs are the websites that host apps and rely on the IdPs for authentication5. In this case, Salesforce Org 2, Financial System, and CPQ System are the SPs that receive the SAML assertions or OAuth tokens from the IdPs and grant access to the users.
Option A is incorrect because Financial System is not an IdP, but an SP. It does not authenticate the users, but receives SAML assertions from Pingfederate. Option C is incorrect because Salesforce Org 2 is not an IdP, but an SP. It does not authenticate the users, but receives OAuth tokens from Salesforce Org 1.
References: 5: Identity Providers and Service Providers - Salesforce 6: Salesforce as Service Provider and Identity Provider for SSO
NEW QUESTION # 58
Universal Containers wants to secure its Salesforce APIs by using an existing Security Assertion Markup Language (SAML) configuration supports the company's single sign-on process to Salesforce, Which Salesforce OAuth authorization flow should be used?
- A. A SAML Assertion Row
- B. OAuth 2.0 SAML Bearer Assertion Flow
- C. OAuth 2.0 JWT Bearer Flow
- D. OAuth 2.0 User-Agent Flow
Answer: B
Explanation:
Explanation
OAuth 2.0 SAML Bearer Assertion Flow allows a client application to use a SAML assertion to request an access token from Salesforce. This flow can leverage the existing SAML configuration for single sign-on and secure the Salesforce APIs. References: OAuth 2.0 SAML Bearer Assertion Flow
NEW QUESTION # 59
Universal Containers (UC) has implemented a multi-org architecture in their company. Many users have licences across multiple orgs, and they are complaining about remembering which org and credentials are tied to which business process. Which two recommendations should the Architect make to address the Complaints?
Choose 2 answers
- A. Implement SP-Initiated Single Sign-on flows to allow deep linking.
- B. Implement IdP-Initiated Single Sign-on flows to allow deep linking.
- C. Activate My Domain to Brand each org to the specific business use case.
- D. Implement Delegated Authentication from each org to the LDAP provider.
Answer: A,C
NEW QUESTION # 60
Northern Trail Outfitters (NTO) is planning to build a new customer service portal and wants to use passwordless login, allowing customers to login with a one-time passcode sent to them via email or SMS.
How should the quantity of required Identity Verification Credits be estimated?
- A. Identity Verification Credits are a direct add-on license based on the number of existing member-based or login-based Community licenses.
- B. Identity Verification Credits are consumed with each SMS (text message) sent and should be estimated based on the number of login verification challenges for SMS verification users.
- C. Identity Verification Credits are consumed with each verification sent and should be estimated based on the number of logins that will incur a verification challenge.
- D. Each community comes with 10,000 Identity Verification Credits per month and only customers with more than 10,000 logins a month should estimate additional SMS verifications needed.
Answer: B
NEW QUESTION # 61
IT security at Unversal Containers (UC) us concerned about recent phishing scams targeting its users and wants to add additional layers of login protection. What should an Architect recommend to address the issue?
- A. Lock sessions to the IP address from which they originated.
- B. Use the Salesforce Authenticator mobile app with two-step verification
- C. Implement Single Sign-on using a corporate Identity store.
- D. Increase Password complexity requirements in Salesforce.
Answer: B
Explanation:
Explanation
The Salesforce Authenticator mobile app adds an extra layer of security for online accounts with two-factor authentication. It allows users to respond to push notifications or use location services to verify their logins and other account activity1. This can help prevent phishing scams and unauthorized access.
References: Salesforce Authenticator, Salesforce Authenticator: Mobile App Security Features, Salesforce Authenticator
NEW QUESTION # 62
Universal Containers (UC) would like its community users to be able to register and log in with Linkedin or Facebook Credentials. UC wants users to clearly see Facebook &Linkedin Icons when they register and login.
What are the two recommended actions UC can take to achieve this Functionality? Choose 2 answers
- A. Create custom buttons for Facebook and inkedin using JAVAscript/CSS on a custom Visualforce page.
- B. Create custom Registration Handlers to link Linkedin and facebook accounts to user records.
- C. Store the Linkedin or Facebook user IDs in the Federation ID field on the Salesforce User record.
- D. Enable Facebook and Linkedin as Login options in the login section of the Community configuration.
Answer: B,D
NEW QUESTION # 63
Universal containers (UC) has implemented a multi-org strategy and would like to centralize the management of their salesforce user profiles. What should the architect recommend to allow salesforce profiles to be managed from a central system of record?
- A. Implement Delegated Authentication that will update the user profiles as necessary.
- B. Implement jit provisioning on the SAML IDP that will pass the profile id in each assertion.
- C. Create an apex scheduled job in one org that will synchronize the other orgs profile.
- D. Implement an Oauthjwt flow to pass the profile credentials between systems.
Answer: B
Explanation:
Explanation
To allow Salesforce profiles to be managed from a central system of record, the architect should recommend to implement JIT provisioning on the SAML IDP that will pass the profile ID in each assertion. JIT provisioning is a process that creates or updates user accounts on Salesforce based on information sent by an external identity provider (IDP) during SAML authentication. By passing the profile ID in each assertion, the IDP can control which profile is assigned to each user. Option B is not a good choice because creating an Apex scheduled job in one org that will synchronize the other orgs profile may not be scalable, reliable, or secure. Option C is not a good choice because implementing Delegated Authentication that will update the user profiles as necessary may not be feasible, as Delegated Authentication only verifies the user's credentials against an external service, but does not pass any other information to Salesforce. Option D is not a good choice because implementing an OAuth JWT flow to pass the profile credentials between systems may not be suitable, as OAuth JWT flow is used for server-to-server integration, not for user authentication.
References: Authorize Apps with OAuth, [Identity Management Concepts], [User Authentication]
NEW QUESTION # 64
......
Pass Your Next Identity-and-Access-Management-Architect Certification Exam Easily & Hassle Free: https://examcollection.guidetorrent.com/Identity-and-Access-Management-Architect-dumps-questions.html