Universal Containers (UC) is both a Salesforce and Google Apps customer. The UC IT team would like to manage the users for both systems in a single place to reduce administrative burden. Which two optimal ways can the IT team provision users and allow Single Sign-on between Salesforce and Google Apps ? Choose 2 answers

Use a third-party product as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.

Use Salesforce as the Identity Provider and Google Apps as a Service Provider and configure User Provisioning for Connected Apps.

Build a custom app running on Heroku as the Identity Provider that can sync user information between Salesforce and Google Apps.

Use a third-party product as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.

Use Identity Connect as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.

Use Salesforce as the Identity Provider and Google Apps as a Service Provider and configure User Provisioning for Connected Apps.

Which three are capabilities of SAML-based Federated authentication? Choose 3 answers

Trust relationships between Identity Provider and Service Provider are required.

Access tokens are used to access resources on the server once the user is authenticated.

Centralized federation provides single point of access, control and auditing.

Trust relationships between Identity Provider and Service Provider are required.

SAML tokens can be in XML or JSON format and can be used interchangeably.

Web applications with no passwords are more secure and stronger against attacks.

Access tokens are used to access resources on the server once the user is authenticated.

Centralized federation provides single point of access, control and auditing.

Universal Containers (UC) uses Salesforce to allow customers to keep track of the order status. The customers can log in to Salesforce using external authentication providers, such as Facebook and Google. UC is also leveraging the App Launcher to let customers access an of platform application for generating shipping labels. The label generator application uses OAuth to provide users access. What license type should an Architect recommend for the customers?

Customer Community Plus license

Containers (UC) uses a legacy Employee portal for their employees to collaborate. Employees access the portal from their company’s internal website via SSO. It is set up to work with SiteMinder and Active Directory. The Employee portal has features to support posing ideas. UC decides to use Salesforce Ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to integrate Employee portal ideas with Salesforce idea through the API. What is the role of Salesforce in the context of SSO, based on this scenario?

An independent system, because Salesforce is not part of the SSO setup.

Service Provider, because Salesforce is the application for managing ideas.

Connected App, because Salesforce is connected with Employee portal via API.

Identity Provider, because the API calls are authenticated by Salesforce.

An independent system, because Salesforce is not part of the SSO setup.

Universal Containers (UC) uses middleware to integrate multiple systems with Salesforce. UC has a strict, new requirement that usernames and passwords cannot be stored in any UC system. How can UC’s middleware authenticate to Salesforce while adhering to this requirement?

Create a Connected App that supports the JWT Bearer Token OAuth Flow.

Create a Connected App that supports the Refresh Token OAuth Flow

Create a Connected App that supports the Web Server OAuth Flow.

Create a Connected App that supports the User-Agent OAuth Flow.

In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?

Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.

Use of self-signed certificate leads to lower maintenance for trusted party because multiple selfsigned certs need to be maintained.

Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA

Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.

Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.

After a recent audit, universal containers was advised to implement Two-factor Authentication for all of their critical systems, including salesforce. Which two actions should UC consider to meet this requirement? Choose 2 answers

Require users to provide their RSA token along with their credentials.

Require users to use a biometric reader as well as their password

Require users to provide their RSA token along with their credentials.

Require users to supply their email and phone number, which gets validated.

Require users to enter a second password after the first Authentication

Require users to use a biometric reader as well as their password

Universal containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use salesforce ideas and provide the ability for employees to post ideas from the company portal. They use SAML-BASED SSO to get into the company portal and would like to leverage it to access salesforce. Most of the users don't exist in salesforce and they would like the user records created in salesforce communities the first time they try to access salesforce. What recommendation should an architect make to meet this requirement?

Use salesforce APIs to create users on the fly

Use Identity connect to sync users

Universal containers (UC) has an e-commerce website while customers can buy products, make payments, and manage their accounts. UC decides to build a customer Community on Salesforce and wants to allow the customers to access the community for their accounts without logging in again.UC decides to implement ansp-Initiated SSO using a SAML-BASED complaint IDP. In this scenario where salesforce is the service provider, which two activities must be performed in salesforce to make sp-Initiated SSO work? Choose 2 answers

Configure Delegated Authentication

Universal containers (UC) wants to implement Delegated Authentication for a certain subset of Salesforce users. Which three items should UC take into consideration while building the Web service to handle the Delegated Authentication request? Choose 3 answers

The web service needs to include Source IP as a method parameter.

UC should whitelist all salesforce ip ranges on their corporate firewall.

The return type of the Web service method should be a Boolean value

The web service needs to include Source IP as a method parameter.

UC should whitelist all salesforce ip ranges on their corporate firewall.

The web service can be written using either the soap or rest protocol.

Delegated Authentication is enabled for the system administrator profile.

The return type of the Web service method should be a Boolean value

Universal containers wants to implement single Sign-on for a salesforce org using an external identity provider and corporate identity store. What type of Authentication flow is required to support deep linking?

Identity-provider-initiated SSO

An architect has successfully configured SAML-BASED SSO for universal containers. SSO has been working for 3 months when Universal containers manually adds a batch of new users to salesforce.The new users receive an error from salesforce when trying to use SSO. Existing users are still able to successfully use SSO to access salesforce. What is the probable cause of this behaviour?

The Federation ID field on the new user records is not correctly set

The administrator forgot to reset the new user's salesforce password.

The Federation ID field on the new user records is not correctly set

The my domain capability is not enabled on the new user's profile.

The new users do not have the SSO permission enabled on their profiles.

Universal containers (UC) has a classified information system that it's call centre team uses only when they are working on a case with a record type of "classified". They are only allowed to access the system when they own an open "classified" case, and their access to the system is removed at all other times. They would like to implement SAML SSO with salesforce as the IDP, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying access to the classified information system based on the open "classified" case record criteria?

Use a custom connected App handler using apex to dynamically allow access to the system based on whether the staff owns any open "classified" cases.

Use apex trigger on case to dynamically assign permission sets that grant access when a user is assigned with an open "classified" case, and remove it when the case is closed.

Use custom SAML jit provisioning to dynamically query the user's open "classified" cases when attempting to access the classified information system

Use salesforce reports to identify users that currently owns open "classified" cases and should be granted access to the classified information system.

A group of users try to access one of universal containers connected apps and receive the following error message : "Failed : Not approved for access". what is most likely to cause of the issue?

The users do not have the correct permission set assigned to them.

The use of high assurance sections are required for the connected App.

The users do not have the correct permission set assigned to them.

The connected App setting "All users may self-authorize" is enabled.

The salesforce administrators gave revoked the Oauth authorization.

Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process. Which two considerations should an architect point out to UC? Choose 2 answers

The web application should be hosted on a secure server.

The web server must be able to protect consumer privacy

The web application should be hosted on a secure server.

The web server must be able to protect consumer privacy

The flow involves passing the user credentials back and forth.

The flow will not provide an Oauth refresh token back to the server.

Universal containers wants to set up SSO for a selected group of users to access external applications from salesforce through App launcher. Which three steps must be completed in salesforce to accomplish the goal?

Associate user profiles with the connected Apps.

Complete my domain and Identity provider setup.

Create connected apps for the external applications.

Associate user profiles with the connected Apps.

Complete my domain and Identity provider setup.

Create connected apps for the external applications.

Complete single Sign-on settings in security controls.

Create named credentials for each external system.

Universal containers (UC) is concerned that having a self-registration page will provide a means for "bots" or unintended audiences to create user records, thereby consuming licences and adding dirty dat a. Which two actions should UC take to prevent unauthorised form submissions during the selfregistration process? Choose 2 answers

Require a captcha at the end of the self-registration process.

Use hidden fields populated via java script events in the self-registration page.

Use open-ended security questions and complex password requirements

Primarily use lookup and picklist fields on the self registration page.

Require a captcha at the end of the self-registration process.

Use hidden fields populated via java script events in the self-registration page.

Universal containers (UC) has implemented a multi-org strategy and would like to centralize the management of their salesforce user profiles. What should the architect recommend to allow salesforce profiles to be managed from a central system of record?

Implement jit provisioning on the SAML IDP that will pass the profile id in each assertion.

Create an apex scheduled job in one org that will synchronize the other orgs profile.

Implement Delegated Authentication that will update the user profiles as necessary.

Implement an Oauthjwt flow to pass the profile credentials between systems.

Universal containers (UC) is setting up their customer Community self-registration process. They are uncomfortable with the idea of assigning new users to a default account record. What will happen when customers self-register in the community?

The self-registration process will produce an error to the user.

The self-registration page will ask user to select an account.

The self-registration process will create a person Account record.

The self-registration page will create a new account record.

Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post their ideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decides to use an API user using Oauth Username - password flow for the connection. How can the connection to salesforce be restricted only to the employee portal server?

Add the Employee portals IP address to the Trusted IP range for the connected App

Use a digital certificate signed by the employee portal Server.

Add the employee portals IP address to the login IP range on the user profile.

Use a dedicated profile for the user the Employee portal uses.

Universal Containers (UC) is using a custom application that will act as the Identity Provider and will generate SAML assertions used to log in to Salesforce. UC is considering including custom parameters in the SAML assertion. These attributes contain sensitive data and are needed to authenticate the users. The assertions are submitted to salesforce via a browser form post. The majority of the users will only be able to access Salesforce via UC's corporate network, but a subset of admins and executives would be allowed access from outside the corporate network on their mobile devices. Which two methods should an Architect consider to ensure that the sensitive data cannot be tampered with, nor accessible to anyone while in transit?

Use the Identity Provider's certificate to digitally sign and Salesforce's Certificate to encrypt the payload.

Use the Identity provider's certificate to digitally Sign and the Identity provider's certificate to encrypt the payload.

Use the Identity Provider's certificate to digitally sign and Salesforce's Certificate to encrypt the payload.

Use Salesforce's Certificate to digitally sign the SAML Assertion and a Mobile Device Management client on the users' mobile devices.

Use the Identity provider's certificate to digitally Sign and the Identity provider's certificate to encrypt the payload.

Use a custom login flow to retrieve sensitive data using an Apex callout without including the attributes in the assertion.

Universal Containers (UC) has Active Directory (AD) as their enterprise identity store and would like to use it for Salesforce user authentication. UC expects to synchronize user data between Salesforce and AD and Assign the appropriate Profile and Permission Sets based on AD group membership.What would be the optimal way to implement SSO?

Use Salesforce Identity Connect as the Identity Provider.

Use Active Directory with Reverse Proxy as the Identity Provider.

Use Microsoft Access control Service as the Authentication provider.

Use Active Directory Federation Service (ADFS) as the Identity Provider.

Use Salesforce Identity Connect as the Identity Provider.

Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to reauthenticate.UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?

Check the Refresh Token policy defined in the Salesforce Connected App.

Validate that the users are checking the box to remember their passwords.

Verify that the Callback URL is correctly pointing to the new URI Scheme.

Confirm that the access Token's Time-To-Live policy has been set appropriately.

Universal Containers (UC) is looking to purchase a third-party application as an Identity Provider. UC is looking to develop a business case for the purchase in general and has enlisted an Architect for advice. Which two capabilities of an Identity Provider should the Architect detail to help strengthen the business case? Choose 2 answers

The Identity Provider can authenticate multiple applications.

The Identity Provider can centralize enterprise password policy.

The Identity Provider can authenticate multiple applications.

The Identity Provider can authenticate multiple social media accounts.

The Identity provider can store credentials for multiple applications.

The Identity Provider can centralize enterprise password policy.

Universal Containers (UC) has implemented a multi-org architecture in their company. Many users have licences across multiple orgs, and they are complaining about remembering which org and credentials are tied to which business process. Which two recommendations should the Architect make to address the Complaints? Choose 2 answers

Activate My Domain to Brand each org to the specific business use case.

Implement SP-Initiated Single Sign-on flows to allow deep linking.

Activate My Domain to Brand each org to the specific business use case.

Implement SP-Initiated Single Sign-on flows to allow deep linking.

Implement IdP-Initiated Single Sign-on flows to allow deep linking.

Implement Delegated Authentication from each org to the LDAP provider.

Universal Containers (UC) is building an authenticated Customer Community for its customers. UC does not want customer credentials stored in Salesforce and is confident its customers would be willing to use their social media credentials to authenticate to the community. Which two actions should an Architect recommend UC to take?

Configure an Authentication Provider for LinkedIn Social Media Accounts.

Create a Custom Apex Registration Handler to handle new and existing users.

Use Delegated Authentication to call the Twitter login API to authenticate users.

Configure an Authentication Provider for LinkedIn Social Media Accounts.

Create a Custom Apex Registration Handler to handle new and existing users.

Configure SSO Settings For Facebook to serve as a SAML Identity Provider.

How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.

Add the list of company's network IP addresses to the Login Range list under 2FA Setup.

Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.

Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.

Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce?Choose 2 answers

Users accessing Salesforce from a public Wi-Fi access point.

Users choosing passwords that are the same as their Facebook password.

Users leaving laptops unattended and not logging out of Salesforce.

Users accessing Salesforce from a public Wi-Fi access point.

Users choosing passwords that are the same as their Facebook password.

Users creating simple-to-guess password reset questions.

Universal Containers (UC) implemented SSO to a third-party system for their Salesforce users to access the App Launcher. UC enabled “User Provisioning” on the Connected App so that changes to user accounts can be synched between Salesforce and the third party system. However, UC quickly notices that changes to user roles in Salesforce are not getting synched to the third-party system.What is the most likely reason for this behaviour?

User Provisioning for Connected Apps does not support role sync.

Required operation(s) was not mapped in User Provisioning Settings.

The Approval queue for User Provisioning Requests is unmonitored.

Salesforce roles have more than three levels in the role hierarchy.

customer service representatives at Universal containers (UC) are complaining that whenever they click on links to case records and are asked to login with SAML SSO, they are being redirected to the salesforce home tab and not the specific case record. What item should an architect advise the identity team at UC to investigate first?

The identity provider is correctly preserving the Relay state

My domain is configured and active within salesforce.

The salesforce SSO settings are using http post

The identity provider is correctly preserving the Relay state

The users have the correct Federation ID within salesforce.

Universal containers (UC) is successfully using Delegated Authentication for their salesforce users.The service supporting Delegated Authentication is written in Jav a. UC has a new CIO that is requiring all company Web services be RESR-ful and written in . NET.Which two considerations should the UC Architect provide to the new CIO? Choose 2 answers

Delegated Authentication will continue to work with a.net service.

Delegated Authentication will not work with rest services.

Delegated Authentication will not work with a.net service.

Delegated Authentication will continue to work with rest services.

Delegated Authentication will continue to work with a.net service.

Delegated Authentication will not work with rest services.

Universal containers(UC) has implemented SAML-BASED single Sign-on for their salesforce application and is planning to provide access to salesforce on mobile devices using the salesforce1 mobile app. UC wants to ensure that single Sign-on is used for accessing the salesforce1 mobile app.Which two recommendations should the architect make? Choose 2 answers

Use the existing SAML SSO flow along with user agent flow.

Configure the salesforce1 app to use the my domain URL

Use the existing SAML SSO flow along with user agent flow.

Configure the embedded Web browser to use my domain URL.

Use the existing SAML SSO flow along with Web server flow

Configure the salesforce1 app to use the my domain URL

Salesforce Certified Identity and Access Management Architect Practice Test 3

Universal containers (UC) has implemented SAML SSO to enable seamless access across multiple applications. UC has regional salesforce orgs and wants it's users to be able to access them from their main Salesforce org seamless. Which action should an architect recommend?

Become a Premium Member for full access

Unlock Premium Member

Salesforce Certified Identity and Access Management Architect Practice Test 3

Question

Salesforce Certified Identity and Access Management Architect Practice Tests

Practice Tests