Universal containers (UC) would like to enable self - registration for their salesforce partner community users. UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate profile and account values. Which two actions should the architect recommend to UC? Choose 2 answers

Modify the communitiesselfregcontroller to assign the profile and account.

Configure registration for communities to use a custom visualforce page.

Modify the communitiesselfregcontroller to assign the profile and account.

Modify the selfregistration trigger to assign profile and account.

Configure registration for communities to use a custom visualforce page.

Configure registration for communities to use a custom apex controller.

Universal containers (UC) has implemented SAML -based single Sign-on for their salesforce application. UC is using pingfederate as the Identity provider. To access salesforce, Users usually navigate to a bookmarked link to my domain URL. What type of single Sign-on is this?

IDP-initiated with deep linking

Universal containers (UC) built a customer Community for customers to buy products, review orders, and manage their accounts. UC has provided three different options for customers to log in to the customer Community: salesforce, Google, and Facebook. Which two role combinations are represented by the systems in the scenario? Choose 2 answers

Salesforce is the service provider and Google is the identity provider

Salesforce is the service provider and Facebook is the identity provider

Google is the service provider and Facebook is the identity provider

Salesforce is the service provider and Google is the identity provider

Facebook is the service provider and salesforce is the identity provider

Salesforce is the service provider and Facebook is the identity provider

Universal containers (UC) has implemented ansp-Initiated SAML flow between an external IDP and salesforce. A user at UC is attempting to login to salesforce1 for the first time and is being prompted for salesforce credentials instead of being shown the IDP login page. What is the likely cause of the issue?

The user has not configured the salesforce1 mobile app to use my domain for login

The "Redirect to Identity Provider" option has been selected in the my domain configuration.

The user has not configured the salesforce1 mobile app to use my domain for login

The "Redirect to identity provider" option has not been selected the SAML configuration.

The user has not been granted the "Enable single Sign-on" permission

Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?

Use custom login flows with callouts to a third-party fingerprint scanning application.

Use salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.

Use Delegated Authentication with callouts to a third-party fingerprint scanning application.

Use an appexchange product that does fingerprint scanning with native salesforce identity confirmation.

Use custom login flows with callouts to a third-party fingerprint scanning application.

An architect needs to set up a Facebook Authentication provider as login option for a salesforce customer Community. What portion of the authentication provider setup associates a Facebook user with a salesforce user?

Consumer key and consumer secret

Universal Containers (UC) has a strict requirement to authenticate users to Salesforce using their mainframe credentials. The mainframe user store cannot be accessed from a SAML provider. UC would also like to have users in Salesforce created on the fly if they provide accurate mainframe credentials.How can the Architect meet these requirements?

Implement Just-In-Time Provisioning on the mainframe to create the user on the fly.

Use a Salesforce Login Flow to call out to a web service and create the user on the fly.

Use the SOAP API to create the user when created on the mainframe; implement Delegated Authentication.

Implement Just-In-Time Provisioning on the mainframe to create the user on the fly.

Implement OAuth User-Agent Flow on the mainframe; use a Registration Handler to create the user on the fly.

Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HAN A. UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs.Which two Salesforce license types does UC need for its employees'Choose 2 answers

Identity and Identity Connect licenses

Salesforce and Identity Connect licenses

Company Community and Identity licenses

Identity and Identity Connect licenses

Chatter Only and Identity licenses

Salesforce and Identity Connect licenses

Universal Containers built a custom mobile app for their field reps to create orders in Salesforce.OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained automatically without forcing the user to log in again. While that improved the field reps' productivity, UC realized that they need a "logout" feature.What should the logout function perform in this scenario, where user sessions are refreshed automatically?

Invoke the revocation URL and pass the refresh token.

Clear out the client Id to stop auto session refresh.

Invoke the revocation URL and pass the access token.

Clear out all the tokens to stop auto session refresh.

Universal Containers (UC) would like to enable self-registration for their Salesforce Partner Community Users. UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate Profile and Account values.Which two actions should the Architect recommend to UC1Choose 2 answers

Configure Registration for Communities to use a custom Visualforce Page.

Modify the CommunitiesSelfRegController to assign the Profile and Account.

Configure Registration for Communities to use a custom Visualforce Page.

Modify the SelfRegistration trigger to assign Profile and Account.

Modify the CommunitiesSelfRegController to assign the Profile and Account.

Configure Registration for Communities to use a custom Apex Controller.

Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financial system, and CPQ system. Below is the SSO implementation landscape. What role combination is represented by the systems in this scenario''

Salesforce Org1 and PingFederate are acting as Identity Providers.

Financial System and CPQ System are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are acting as Identity Providers.

Salesforce Org1 and PingFederate are acting as Identity Providers.

Which two considerations should be made when implementing Delegated Authentication?Choose 2 answers

It can be used to authenticate API clients and mobile apps.

Just-in-time Provisioning can be configured for new users.

The authentication web service can include custom attributes.

It can be used to authenticate API clients and mobile apps.

It requires trusted IP ranges at the User Profile level.

Salesforce servers receive but do not validate a user’s credentials.

Just-in-time Provisioning can be configured for new users.

Universal Containers wants to implement Single Sign-on for a Salesforce org using an external Identity Provider and corporate identity store.What type of authentication flow is required to support deep linking'

Identity-Provider-initiated SSO

Universal Containers (UC) is setting up delegated authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risks of exposing the corporate login service on the internet and has asked that a reliable trust mechanism be put in place between the login service and Salesforce.What mechanism should an Architect put in place to enable a trusted connection between the login service and Salesforce?

Require the use of Salesforce security tokens on passwords.

Enforce mutual authentication between systems using SSL.

Include Client Id and Client Secret in the login header callout.

Set up a proxy service for the login service in the DMZ.

Universal Containers (UC) is considering a Customer 360 initiative to gain a single source of the truth for its customer data across disparate systems and services. UC wants to understand the primary benefits of Customer 360 Identity and how it contributes ato successful Customer 360 Truth project.What are two are key benefits of Customer 360 Identity as it relates to Customer 360?Choose 2 answers

Customer 360 Identity enables an organization to build a single login for each of its customers, giving the organization an understanding of the user's login activity across all its digital properties and applications.

Customer 360 Identity supports multiple brands so you can deliver centralized identity services and correlation of user activity, even if it spans multiple corporate brands and user experiences.

Customer 360 Identity automatically integrates with Customer 360 Data Manager and Customer 360 Audiences to seamlessly populate all user data.

Customer 360 Identity enables an organization to build a single login for each of its customers, giving the organization an understanding of the user's login activity across all its digital properties and applications.

Customer 360 Identity supports multiple brands so you can deliver centralized identity services and correlation of user activity, even if it spans multiple corporate brands and user experiences.

Customer 360 Identity not only provides a unified sign up and sign in experience, but also tracks anonymous user activity prior to signing up so organizations can understand user activity before and after the users identify themselves.

A client is planning to rollout multi-factor authentication (MFA) to its internal employees and wants to understand which authentication and verification methods meet the Salesforce criteria for secure authentication.Which three functions meet the Salesforce criteria for secure mfa?Choose 3 answers

Username and password + secunty key

Third-party single sign-on with Mobile Authenticator app

username and password + SMS passcode

Username and password + secunty key

Third-party single sign-on with Mobile Authenticator app

Certificate-based Authentication

Universal Containers uses Salesforce as an identity provider and Concur as the Employee Expense management system. The HR director wants to ensure Concur accounts for employees are created only after the appropnate approval in the Salesforce org.Which three steps should the identity architect use to implement this requirement?Choose 3 answers

Create a connected app for Concur in Salesforce.

Enable User Provisioning for the connected app.

Create an approval process for UserProvisionlngRequest object associated with the provisioning flow.

Create an approval process for a custom object associated with the provisioning flow.

Create a connected app for Concur in Salesforce.

Enable User Provisioning for the connected app.

Create an approval process for user object associated with the provisioning flow.

Create an approval process for UserProvisionlngRequest object associated with the provisioning flow.

Refer to the exhibit. Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization. what should an identity architect do to fulfill the above requirements?

Authorize third-party service by sending authorization requests to the communityurl/ services/oauth2/authonze/expid_value.

For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.

Authorize third-party service by sending authorization requests to the communityurl/ services/oauth2/authorize/cookie_value.

Authorize third-party service by sending authorization requests to the communityurl/ services/oauth2/authonze/expid_value.

Universal Containers (UC) uses Salesforce for its customer service agents. UC has a proprietary system for order tracking which supports Security Assertion Markup Language (SAML) based single sign-on. The VP of customer service wants to ensure only active Salesforce users should be able to access the order tracking system which is only visible within Salesforce.What should be done to fulfill the requirement?Choose 2 answers

Setup Salesforce as an identity provider (IdP) for order Tracking.

Set up the Corporate Identity store as an identity provider (IdP) for Order Tracking,

Setup Salesforce as an identity provider (IdP) for order Tracking.

Set up the Corporate Identity store as an identity provider (IdP) for Order Tracking,

Customize Order Tracking to initiate a REST call to validate users in Salesforce after login.

Setup Order Tracking as a Canvas app in Salesforce to POST IdP initiated SAML assertion.

A division of a Northern Trail Outfitters (NTO) purchased Salesforce. NTO uses a third party identity provider (IdP) to validate user credentials against Its corporate Lightweight Directory Access Protocol (LDAP) directory. NTO wants to help employees remember as passwords as possible.What should an identity architect recommend?

Setup Salesforce as a Service Provider to the existing IdP.

Setup Salesforce as an IdP to authenticate against the LDAP directory.

Use Salesforce connect to synchronize LDAP passwords to Salesforce.

Setup Salesforce as an Authentication Provider to the existing IdP.

Universal Containers is using OpenID Connect to enable a connection from their new mobile app to its production Salesforce org.What should be done to enable the retrieval of the access token status for the OpenID Connect connection?

A Leverage OpenID Connect Token Introspection.

Query using OpenID Connect discovery endpoint.

A Leverage OpenID Connect Token Introspection.

Enable cross-origin resource sharing (CORS) for the /services/oauth2/token endpoint.

An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.What should the IAM do to fulfill this requirement?

Confirm performance considerations with Salesforce Customer Support due to high peaks.

Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.

Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.

Create a default account for capturing all ecommerce contacts registered on the community because personAccount is not supported for this case.

Confirm performance considerations with Salesforce Customer Support due to high peaks.

Northern Trail Outfitters (NTO) uses the Customer 360 Platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information.What is the potential impact to the architecture if NTO decides to implement this feature?

Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.

Custom registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.

If contactless user is upgraded to Community license, the contact record is automatically created and linked to the user record, but not associated with an Account.

Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.

Passwordless authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record.

Universal Containers (UC) has decided to replace the homegrown customer portal with Salesforce Experience Cloud. UC will continue to use its third-party single sign-on (SSO) solution that stores all of its customer and partner credentials.The first time a customer logs in to the Experience Cloud site through SSO, a user record needs to be created automatically.Which solution should an identity architect recommend in order to automatically provision users in Salesforce upon login?

Just-in-Time (JIT) provisioning

Custom middleware and web services

Custom login flow and Apex handler

Third-party AppExchange solution

A web service is developed that allows secure access to customer order status on the Salesforce Platform, The service connects to Salesforce through a connected app with the web server flow. The following are the required actions for the authorization flow:

User Authenticates and Authorizes Access

Salesforce Grants an Access Token

Salesforce Grants Authorization CodeWhat is the correct sequence for the authorization flow?

Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Amazon credentials.What should an identity architect recommend to meet these requirements?

Configure an OpenID Connect Authentication Provider for Amazon.

Configure a predefined authentication provider for Amazon.

Create a custom external authentication provider for Amazon.

Configure an OpenID Connect Authentication Provider for Amazon.

Configure Amazon as a connected app.

A global company's Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) 'Replay Detected and Assertion Invalid' login errors.Which two issues would cause these errors?Choose 2 answers

The subject element is missing from the assertion sent to salesforce.

The assertion sent to 5alesforce contains an assertion ID previously used.

The subject element is missing from the assertion sent to salesforce.

The certificate loaded into SSO configuration does not match the certificate used by the IdP.

The current time setting of the company's identity provider (IdP) and Salesforce platform is out of sync by more than eight minutes.

The assertion sent to 5alesforce contains an assertion ID previously used.

A global company has built an external application that uses data from its Salesforce org via an OAuth 2.0 authorization flow. Upon logout, the existing Salesforce OAuth token must be invalidated.Which action will accomplish this?

Use a HTTP POST to make a call to the revoke token endpoint.

Use a HTTP POST to request the refresh token for the current user.

Use a HTTP POST to the System for Cross-domain Identity Management (SCIM) endpoint, includingthe current OAuth token.

Use a HTTP POST to make a call to the revoke token endpoint.

Enable Single Logout with a secure logout URL.

The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.What should be used and considered before recommending it as a solution on the Salesforce Platform?

Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.

OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.

Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.

Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.

Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.

Universal Container's (UC) is using Salesforce Experience Cloud site for its container wholesale business. The identity architect wants to an authentication provider for the new site.Which two options should be utilized in creating an authentication provider?Choose 2 answers

A custom registration handier can be set.

The default login user can be set.

The default authentication provider certificate can be set.

Northern Trail Outfitters (NTO) is setting up Salesforce to authenticate users with an external identity provider. The NTO Salesforce Administrator is having trouble getting things setup.What should an identity architect use to show which part of the login assertion is fading?

Security Assertion Markup Language Validator

Identity Provider Metadata download

Security Assertion Markup Language Validator

Salesforce Certified Identity and Access Management Architect Practice Test 4

Universal containers (UC) does my domain enable in the context of a SAML SSO configuration?

Choose 2 answers

Resource deep linking

App launcher

SSO from salesforce1 mobile app.

Comment (0)

Salesforce Certified Identity and Access Management Architect Practice Test 4

Question

Salesforce Certified Identity and Access Management Architect Practice Tests

Practice Tests