Universal Containers (UC) wants its closed Won opportunities to be synced to a Data Warehouse in near real time. UC has implemented Outbound Message to enable near real-time data sync. UC wants to ensure that communication between Salesforce and Target System is Secure. What Certificate is sent along with the Outbound Message?

The default Client Certificate from the Develop--> API Menu.

The CA-Signed Certificate from the Certificate and Key Management menu.

The default Client Certificate from the Develop--> API Menu.

The default Client Certificate or a Certificate from Certificate and Key Management menu.

The Self-Signed Certificates from the Certificate & Key Management menu.

Which three are features of federated Single sign-on solutions? Choose 3 Answers

It establishes trust between Identity Store and Service Provider.

It improves affiliated applications adoption rates.

It enables quick and easy provisioning and deactivating of users.

It establishes trust between Identity Store and Service Provider.

It federates credentials control to authorized applications.

It solves all identity and access management problems.

It improves affiliated applications adoption rates.

It enables quick and easy provisioning and deactivating of users.

Universal Containers (UC) has an existing e-commerce platform and is implementing a new customer community. They do not want to force customers to register on both applications due to concern over the customers experience. It is expected that 25% of the e-commerce customers will utilize the customer community . The e-commerce platform is capable of generating SAML responses and has an existing REST-ful API capable of managing users. How should UC create the identities of its ecommerce users with the customer community?

Use SAML JIT in the Customer Community to create users when a user tries to login to the community from the e-commerce site.

Use the e-commerce REST API to create users when a user self-register on the customer community and use SAML to allow SSO.

Use a nightly batch ETL job to sync users between the Customer Community and the e-commerce platform and use SAML to allow SSO.

Use the standard Salesforce API to create users in the Community When a User is Created in the e- Commerce platform and use SAML to allow SSO.

Containers (UC) has an existing Customer Community. UC wants to expand the self-registration capabilities such that customers receive a different community experience based on the data they provide during the registration process. What is the recommended approach an Architect Should recommend to UC?

Modify the Community pages to utilize specific fields on the User and Contact records.

Create an After Insert Apex trigger on the user object to assign specific custom permissions.

Create separate login flows corresponding to the different community user personas.

Modify the Community pages to utilize specific fields on the User and Contact records.

Modify the existing Communities registration controller to assign different profiles.

Universal Containers (UC) has a Customer Community that uses Facebook for Authentication. UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user: How can this requirement be met?

Use the updateUser method on the registration Handler Class.

Develop a scheduled job that calls out to Facebook on a nightly basis.

Use information in the signed Request that is received from facebook.

Use SAML Just-In-Time Provisioning between Facebook and Salesforce.

What are three capabilities of Delegated Authentication? Choose 3 answers

It can connect to SOAP services.

It can be assigned by Permission Sets.

It can connect to REST services.

It can be assigned by Custom Permissions.

It can connect to SOAP services.

It can be assigned by Permission Sets.

It can be assigned by Profiles.

It can connect to REST services.

Universal Containers (UC) is building a customer community and will allow customers to authenticate using Facebook credentials. The First time the user authenticating using facebook, UC would like a customer account created automatically in their Accounting system. The accounting system has a web service accessible to Salesforce for the creation of accounts. How can the Architect meet these requirements?

Add an Apex callout in the registration handler of the authorization provider.

Create a custom application on Heroku that manages the sign-on process from Facebook.

Use JIT Provisioning to automatically create the account in the accounting system.

Add an Apex callout in the registration handler of the authorization provider.

Use OAuth JWT flow to pass the data from Salesforce to the Accounting System.

Universal containers (UC) has multiple salesforce orgs and would like to use a single identity provider to access all of their orgs. How should UC'S architect enable this behavior?

Ensure that users have the same Federation ID value in their user records in all of UC's salesforce orgs.

Ensure that users have the same email value in their user records in all of UC's salesforce orgs.

Ensure the same username is allowed in multiple orgs by contacting salesforce support.

Ensure that users have the same Federation ID value in their user records in all of UC's salesforce orgs.

Ensure that users have the same alias value in their user records in all of UC's salesforce orgs.

Universal Containers (UC) would like its community users to be able to register and log in with Linkedin or Facebook Credentials. UC wants users to clearly see Facebook &Linkedin Icons when they register and login. What are the two recommended actions UC can take to achieve this Functionality?Choose 2 answers

Enable Facebook and Linkedin as Login options in the login section of the Community configuration.

Create custom Registration Handlers to link Linkedin and facebook accounts to user records.

Enable Facebook and Linkedin as Login options in the login section of the Community configuration.

Create custom Registration Handlers to link Linkedin and facebook accounts to user records.

Store the Linkedin or Facebook user IDs in the Federation ID field on the Salesforce User record.

Create custom buttons for Facebook and inkedin using JAVAscript/CSS on a custom Visualforce page.

Universal Containers (UC) has built a custom token-based Two-factor authentication (2FA) system for their existing on-premise applications. They are now implementing Salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution as Architect should consider?

Replace the custom 2FA system with Salesforce 2FA for on-premise applications and Salesforce.

Use the custom 2FA system for on-premise applications and native 2FA for Salesforce.

Replace the custom 2FA system with an AppExchange App that supports on premise application and salesforce.

Use Custom Login Flows to connect to the existing custom 2FA system for use in Salesforce.

Replace the custom 2FA system with Salesforce 2FA for on-premise applications and Salesforce.

Which two statements are capable of Identity Connect? Choose 2 answers

Supports both Identity-Provider-Initiated and Service-Provider-Initiated SSO.

Automated user synchronization and de-activation.

Synchronization of Salesforce Permission Set Licence Assignments.

Supports both Identity-Provider-Initiated and Service-Provider-Initiated SSO.

Support multiple orgs connecting to multiple Active Directory servers.

Automated user synchronization and de-activation.

Universal Containers (UC) employees have Salesforce access from restricted IP ranges only, to protect against unauthorised access. UC wants to roll out the Salesforce1 mobile app and make it accessible from any location. Which two options should an Architect recommend? Choose 2 answers

Relax the IP restriction with a second factor in the Connect App settings for Salesforce1 mobile app.

Relax the IP restrictions in the Connect App settings for the Salesforce1 mobile app.

Relax the IP restriction with a second factor in the Connect App settings for Salesforce1 mobile app.

Remove existing restrictions on IP ranges for all types of user access.

Relax the IP restrictions in the Connect App settings for the Salesforce1 mobile app.

Use Login Flow to bypass IP range restriction for the mobile app.

Universal Containers (UC) uses Global Shipping (GS) as one of their shipping vendors. Regional leads of GS need access to UC's Salesforce instance for reporting damage of goods using Cases. The regional leads also need access to dashboards to keep track of regional shipping KPIs. UC internally uses a third-party cloud analytics tool for capacity planning and UC decided to provide access to this tool to a subset of GS employees. In addition to regional leads, the GS capacity planning team would benefit from access to this tool. To access the analytics tool, UC IT has set up Salesforce as the Identity provider for Internal users and would like to follow the same approach for the GS users as well. What are the most appropriate license types for GS Tregional Leads and the GS Capacity Planners? Choose 2 Answers

Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.

Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.

Customer Community Plus license for GS Regional Leads and External Identity for GS Capacity Planners.

Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.

Identity Licence for GS Regional Leads and External Identity license for GS capacity Planners.

Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.

Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers

UC will be required to develop and support a custom SOAP web service.

Salesforce users will be locked out of Salesforce if the web service goes down.

Delegated Authentication is enabled or disabled for the entire Salesforce org.

UC will be required to develop and support a custom SOAP web service.

Salesforce users will be locked out of Salesforce if the web service goes down.

The web service must reside on a public cloud service, such as Heroku.

Containers (UC) has implemented SAML-based single Sign-on for their Salesforce application and is planning to provide access to Salesforce on mobile devices using the Salesforce1 mobile app. UC wants to ensure that Single Sign-on is used for accessing the Salesforce1 mobile App. Which two recommendations should the Architect make? Choose 2 Answers

Configure the Salesforce1 App to use the MY Domain URL.

Use the existing SAML-SSO flow along with User Agent Flow.

Configure the Embedded Web Browser to use My Domain URL.

Configure the Salesforce1 App to use the MY Domain URL.

Use the existing SAML-SSO flow along with User Agent Flow.

Use the existing SAML SSO flow along with Web Server Flow.

Universal Containers (UC) has implemented SAML-based SSO solution for use with their multi-org Salesforce implementation, utilizing one of the the orgs as the Identity Provider. One user is reporting that they can log in to the Identity Provider org but get a generic SAML error message when accessing the other orgs. Which two considerations should the architect review to troubleshoot the issue? Choose 2 answers

The Federation ID must is case sensitive

The Federation ID must be populated on the user record.

The Federation ID must be a valid Salesforce Username

The Federation ID must is case sensitive

The Federation ID must be in the form of an email address.

The Federation ID must be populated on the user record.

Universal Containers (UC) wants to integrate a third-party Reward Calculation system with Salesforce to calculate Rewards. Rewards will be calculated on a schedule basis and update back into Salesforce.The integration between Salesforce and the Reward Calculation System needs to be secure. Which are two recommended practices for using OAuth flow in this scenario. choose 2 answers

OAuth SAML Bearer Assertion FLow

Which two are valid choices for digital certificates when setting up two-way SSL between Salesforce and an external system. Choose 2 answers

Use a self-signed certificate for salesforce and a self-signed cert for the external system

Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system

Use a trusted CA-signed certificate for salesforce and a trusted CA-signed cert for the external system

Use a trusted CA-signed certificate for salesforce and a self-signed cert for the external system

Use a self-signed certificate for salesforce and a self-signed cert for the external system

Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system

Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose. Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication? Choose 2 answers

Salesforce license for sales users and Identity license for Marketing users

Salesforce license for sales users and platform license for Marketing users.

Salesforce license for sales users and Identity license for Marketing users

Salesforce license for sales users and External Identity license for Marketing users

Identity license for sales users and Identity connect license for Marketing users

Salesforce license for sales users and platform license for Marketing users.

universal container plans to develop a custom mobile app for the sales team that will use salesforce for authentication and access management. The mobile app access needs to be restricted to only the sales team. What would be the recommended solution to grant mobile app access to sales users?

Use connected apps Oauth policies to restrict mobile app access to authorized users.

Use a custom attribute on the user object to control access to the mobile app

Use connected apps Oauth policies to restrict mobile app access to authorized users.

Use the permission set license to assign the mobile app permission to sales users

Add a new identity provider to authenticate and authorize mobile users.

Universal containers (UC) has a mobile application that it wants to deploy to all of its salesforce users, including customer Community users. UC would like to minimize the administration overhead, which two items should an architect recommend? Choose 2 answers

Enable the "Refresh Tokens is valid until revoked " setting in the Connected App.

Enable the "All users may self-authorize" setting in the Connected App.

Enable the "Refresh Tokens is valid until revoked " setting in the Connected App.

Enable the "Enforce Ip restrictions" settings in the connected App.

Enable the "All users may self-authorize" setting in the Connected App.

Enable the "High Assurance session required" setting in the Connected App.

The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?

Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.

Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.

Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.

Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.

Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.

IT security at Unversal Containers (UC) us concerned about recent phishing scams targeting its users and wants to add additional layers of login protection. What should an Architect recommend to address the issue?

Use the Salesforce Authenticator mobile app with two-step verification

Lock sessions to the IP address from which they originated.

Increase Password complexity requirements in Salesforce.

Implement Single Sign-on using a corporate Identity store.

Universal Containers (UC) has an existing web application that it would like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?

Create a Canvas app and use Signed Requests to authenticate the users.

Rewrite the web application as a set of Visualforce pages and Apex code.

Configure the web application as an item in the Salesforce App Launcher.

Add the web application as a ConnectedApp using OAuth User-Agent flow.

Universal containers wants to implement SAML SSO for their internal salesforce users using a thirdparty IDP. After some evaluation, UC decides not to set up my domain for their salesforce.org. How does that decision impact their SSO implementation?

Neithersp - nor IDP - initiated SSO will work

Either sp - or IDP - initiated SSO will work

IDP - initiated SSO will not work

Universal containers (UC) would like to enable SSO between their existing Active Directory infrastructure and salesforce. The it team prefers to manage all users in Active Directory and would like to avoid doing any initial setup of users in salesforce directly, including the correct assignment of profiles, roles and groups. Which two optimal solutions should UC use to provision users in salesforce? Choose 2 answers

Use an app exchange product to sync users from Active Directory to salesforce.

Use Identity connect to sync users from Active Directory to salesforce

Use the salesforce REST API to sync users from active directory to salesforce

Use an app exchange product to sync users from Active Directory to salesforce.

Use Active Directory Federation Services to sync users from active directory to salesforce.

Use Identity connect to sync users from Active Directory to salesforce

Which two roles of the systems are involved in an environment where salesforce users are enabled to access Google Apps from within salesforce through App launcher and connected App set up?Choose 2 answers

Salesforce is the service provider

Google is the identity provider

Salesforce is the identity provider

Salesforce is the service provider

Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?

Require the use of Salesforce security Tokens on password.

Include client ID and client secret in the login header callout.

Set up a proxy server for the login service in the DMZ.

Require the use of Salesforce security Tokens on password.

Enforce mutual Authentication between systems using SSL.

Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?

The refresh token expiration policy is set incorrectly in salesforce

The Oauth authorizations are being revoked by a nightly batch job.

The refresh token expiration policy is set incorrectly in salesforce

The app is requesting too many access Tokens in a 24-hour period

The users forget to check the box to remember their credentials.

Universal containers (UC) wants users to authenticate into their salesforce org using credentials stored in a custom identity store. UC does not want to purchase or use a third-party Identity provider.Additionally, UC is extremely wary of social media and does not consider it to be trust worthy. Which two options should an architect recommend to UC? Choose 2 answers

Build a custom Web service that is supported by Delegated Authentication.

Implement the Openid protocol and configure an Authentication provider

Use a professional social media such as LinkedIn as an Authentication provider

Build a custom web page that uses the identity store and calls frontdoor.jsp

Build a custom Web service that is supported by Delegated Authentication.

Implement the Openid protocol and configure an Authentication provider

Universal containers (UC) wants to implement a partner community. As part of their implementation, UC would like to modify both the Forgot password and change password experience with custom branding for their partner community users. Which 2 actions should an architect recommend to UC? Choose 2 answers

Build a custom visualforce page for both the change password and Forgot password experiences.

Build a custom visualforce page for the change password experience and a community builder page for the Forgot password experience.

Build a community builder page for the change password experience and Custom Visualforce page for the Forgot password experience.

Build a custom visualforce page for both the change password and Forgot password experiences.

Build a custom visualforce page for the change password experience and a community builder page for the Forgot password experience.

Build a community builder page for both the change password and Forgot password experiences.

Salesforce Certified Identity and Access Management Architect Practice Test 2

An Architect needs to advise the team that manages the Identity Provider how to differentiate Salesforce from other Service Providers. What SAML SSO setting in Salesforce provides this capability?

Salesforce Certified Identity and Access Management Architect Practice Test 2

Question

Salesforce Certified Identity and Access Management Architect Practice Tests

Practice Tests