Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.What should an identity architect do to fulfill this requirement?

Create a custom external authentication provider.

Contact Salesforce Support and enable delegate single sign-on.

Create a custom external authentication provider.

Use certificate-based authentication.

Configure OpenID Connect authentication provider.

A large consumer company is planning to create a community and will requ.re login through the customers social identity. The following requirements must be met:

Once the customer has been identified with a social identity, they should not be required to authonze Salesforce.

If the customer modifies their personal details in the social site, the changes should be updated in Salesforce .Which two options allow the Identity Architect to fulfill the requirements?Choose 2 answers

The customer should be able to login with any of their social identities, however salesforce should only have one user per customer.

Once the customer has been identified with a social identity, they should not be required to authonze Salesforce.

The customers personal details from the social sign on need to be captured when the customer logs into Salesforce using their social Identity.

If the customer modifies their personal details in the social site, the changes should be updated in Salesforce .Which two options allow the Identity Architect to fulfill the requirements?Choose 2 answers

Use Login Flows to call an authentication registration handler to provision the user before logging the user into the community.

Use authentication providers for social sign-on and use the custom registration handler to insert or update personal details.

Redirect the user to a custom page that allows the user to select an existing social identity for login.

Use the custom registration handler to link social identities to Salesforce identities.

Universal Containers is budding a web application that will connect with the Salesforce API using JWT OAuth Flow.Which two settings need to be configured in the connect app to support this requirement?Choose 2 answers

The Use Digital Signature option in the connected app.

The "api" OAuth scope in the connected app.

The Use Digital Signature option in the connected app.

The "web" OAuth scope in the connected app,

The "api" OAuth scope in the connected app.

The "edair_api" OAuth scope m the connected app.

A company's external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.What should be done to improve security?

Create custom scopes and assign to the connected app.

Select "Admin approved users are pre-authonzed" and assign specific profiles.

Create custom scopes and assign to the connected app.

Define a permission set that grants access to the app and assign to authorized users.

Leverage external objects and data classification policies.

An identity architect wants to secure Salesforce APIs using Security Assertion Markup Language (SAML). For secunty purposes, administrators will need to authorize the applications that will be consuming the APIs.Which Salesforce OAuth authorization flow should be used?

OAuth 2-0 SAML Bearer Assertion Flow

Universal Containers (UC) rolling out a new Customer Identity and Access Management Solution will be built on top of their existing Salesforce instance.Several service providers have been setup and integrated with Salesforce using OpenlD Connect to allow for a seamless single sign-on experience. UC has a requirement to limit user access to only a subset of service providers per customer type.Which two steps should be done on the platform to satisfy the requirement?Choose 2 answers

Use Profiles and Permission Sets to assign user access to Admin Pre-Approved Connected Apps.

Set each of the Connected App access settings to Admin Pre-Approved.

Manage which connected apps a user has access to by assigning authentication providers to the users profile.

Assign the connected app to the customer community, and enable the users profile in the Community settings.

Use Profiles and Permission Sets to assign user access to Admin Pre-Approved Connected Apps.

Set each of the Connected App access settings to Admin Pre-Approved.

Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.

Build an integration that queries LDAP periodically and creates new active users in Salesforce.

Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at first login.

An identity architect has been asked to recommend a solution that allows administrators to configure personalized alert messages to users before they land on the Experience Cloud site (formerly known as Community) homepage.What is recommended to fulfill this requirement with the least amount of customization?

Use Login Flows to add a screen that shows personalized alerts.

Customize the registration handler Apex class to create a routing logic navigating to different home pages based on the user profile.

Use Login Flows to add a screen that shows personalized alerts.

Build a Lightning web Component (LWC) for a homepage that shows custom alerts.

Create custom metadata that stores user alerts and use a LWC to display alerts.

Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce?Choose 2 answers

Enable My Domain and select "Prevent login from https://login.salesforce.com".

Assign user "is Single Sign-on Enabled" permission via profile or permission set.

Enable My Domain and select "Prevent login from https://login.salesforce.com".

Request Salesforce Support to enable delegated authentication.

Once SSO is enabled, users are only able to login using Salesforce credentials.

Assign user "is Single Sign-on Enabled" permission via profile or permission set.

Northern Trail Outfitters (NTO) is planning to build a new customer service portal and wants to use passwordless login, allowing customers to login with a one-time passcode sent to them via email or SMS.How should the quantity of required Identity Verification Credits be estimated?

Identity Verification Credits are consumed with each SMS (text message) sent and should be estimated based on the number of login verification challenges for SMS verification users.

Each community comes with 10,000 Identity Verification Credits per month and only customers with more than 10,000 logins a month should estimate additional SMS verifications needed.

Identity Verification Credits are consumed with each SMS (text message) sent and should be estimated based on the number of login verification challenges for SMS verification users.

Identity Verification Credits are consumed with each verification sent and should be estimated based on the number of logins that will incur a verification challenge.

Identity Verification Credits are a direct add-on license based on the number of existing memberbased or login-based Community licenses.

Northern Trail Outfitters (NTO) has a number of employees who do NOT need access Salesforce objects. Trie employees should sign in to a custom Benefits web app using their Salesforce credentials.Which license should the identity architect recommend to fulfill this requirement?

Identity Verification Credits Add-on License

Northern Trail Outfitters is implementing a busmess-to-business (B2B) collaboration site using Salesforce Experience Cloud. The partners will authenticate with an existing identity provider and the solution will utilize Security Assertion Markup Language (SAML) to provide single sign-on to Salesforce. Delegated administration will be used in the Expenence Cloud site to allow the partners to administer their users' access.How should a partner identity be provisioned in Salesforce for this solution?

Create a user and a related contact.

Northern Trail Outfitters would like to automatically create new employee users in Salesforce with an appropriate profile that maps to its Active Directory Department.How should an identity architect implement this requirement?

Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Use the createUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Use a login flow to collect Security Assertion Markup Language attributes and assign the appropriate profile during Just-In-Time(JIT) provisioning.

Make a callout during the login flow to query department from Active Directory to assign the appropriate profile.

A technology enterprise is planning to implement single sign-on login for users. When users log in to the Salesforce User object custom field, data should be populated for new and existing users.Which two steps should an identity architect recommend?Choose 2 answers

Implement Auth.SamlJitHandler Interface.

Implement RegistrationHandler Interface.

Implement SesslonManagement Class.

A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors.They have engaged a salesforce Architect to propose an appropriate way to generate sensor Information In Salesforce.Which OAuth flow should the architect recommend?

OAuth 2.0 Device Authentication Row

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 SAML Bearer Assertion Flow

An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer's sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150 sub-brands?

Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.

Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuth and Security Assertion Markup Language (SAML) flows.

Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.

Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the user experience.

Uwversal Containers (UC) is building a custom employee hut) application on Amazon Web Services(AWS) and would like to store their users' credentials there. Users will also need access to Salesforce for internal operations. UC has tasked an identity architect with evaluating Afferent solutions for authentication and authorization between AWS and Salesforce.How should an identity architect configure AWS to authenticate and authorize Salesforce users?

Configure AWS as an OpenID Connect Provider.

Configure the custom employee app as a connected app.

Configure AWS as an OpenID Connect Provider.

Create a custom external authentication provider.

Develop a custom Auth server in AWS.

Refer to the exhibit. A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS . The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.What is recommended to ensure these requirements are met ?

Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.

Use connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.

Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.

Add a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.

Configure Each ADFS system under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-

Northern Trail Outfitters (NTO) wants its customers to use phone numbers to log in to their new digital portal, which was designed and built using Salesforce Experience Cloud. In order to access the portal, the user will need to do the following:

Enter a phone number and/or email address

Enter a verification code that is to be sent via email or text.What is the recommended approach to fulfill this requirement?

Create a Login Discovery page and provide a Login Discovery Handler Apex class.

Create a custom login page with an Apex controller. The controller has logic to send and verify the identity.

Create an Authentication provider and implement a self-registration handler class.

Create a custom login flow that uses an Apex controller to verify the phone numbers with the company's verification service.

A financial services company uses Salesforce and has a compliance requirement to track information about devices from which users log in. Also, a Salesforce Security Administrator needs to have the ability to revoke the device from which users log in.What should be used to fulfill this requirement?

Use the Activations feature to meet the compliance requirement to track device information.

Use multi-factor authentication (MFA) to meet the compliance requirement to track device information.

Use the Activations feature to meet the compliance requirement to track device information.

Use the Login History object to track information about devices from which users log in.

Use Login Flows to capture device from which users log in and store device and user information in a custom object.

Users logging into Salesforce are frequently prompted to verify their identity.The identity architect is required to provide recommendations so that frequency of prompt verification can be reduced.What should the identity architect recommend to meet the requirement?

Set trusted IP ranges for the organization.

Implement 2FA authentication for the Salesforce org.

Set trusted IP ranges for the organization.

Implement an single sign-on for Salesforce using an external identity provider.

Implement multi-factor authentication for the Salesforce org.

An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single signon (SSO).Which feature of Identity Connect is applicable for this scenano?

When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.

If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.

Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.

When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.

Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an external identity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.What should a identity architect recommend to create partners?

Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.

On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.

Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.

Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.

Allow partners to register through the IdP and create partner users in Salesforce through an API.

A third-party app provider would like to have users provisioned via a service endpoint before users access their app from Salesforce.What should an identity architect recommend to configure the requirement with limited changes to the third-party app?

Use a connected app with user provisioning flow.

Create Canvas app in Salesforce for third-party app to provision users.

Redirect users to the third-party app for registration.

Use Salesforce identity with Security Assertion Markup Language (SAML) for provisioning users.

Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for to give its customers the ability to login with their Facebook and Twitter credentials.Which two actions should an identity architect recommend to meet these requirements?Choose 2 answers

Configure a predefined authentication provider for Facebook.

Configure a predefined authentication provider for Twitter.

Create a custom external authentication provider for Facebook.

Configure a predefined authentication provider for Facebook.

Create a custom external authentication provider for Twitter.

Configure a predefined authentication provider for Twitter.

How should an identity architect automate provisioning and deprovisioning of users into Salesforce from an external system?

Run registration handler on incoming OAuth responses.

Call SOAP API upsertQ on user object.

Use Security Assertion Markup Language Just-in-Time (SAML JIT) on incoming SAML assertions.

Run registration handler on incoming OAuth responses.

Call OpenID Connect (OIDC)-userinfo endpoint with a valid access token.

Universal Containers (UC) is rolling out its new Customer Identity and Access Management Solution built on top of its existing Salesforce instance. UC wants to allow customers to login using Facebook, Google, and other social sign-on providers.How should this functionality be enabled for UC, assuming ail social sign-on providers support OpenID Connect?

Configure an authentication provider and a registration handler for each social sign-on provider.

Configure a single sign-on setting and a registration handler for each social sign-on provider.

Configure an authentication provider and a Just-In-Time (JIT) handler for each social sign-on provider.

Configure a single sign-on setting and a JIT handler for each social sign-on provider.

Refer to the exhibit. A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.What should an Identity architect do to meet this requirement?

Configure the company firewall to allow traffic from Salesforce IP ranges.

Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

Configure the company firewall to allow traffic from Salesforce IP ranges.

Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

Upload a third-party certificate from Salesforce into the on-premise server.

A Salesforce customer is implementing Sales Cloud and a custom pricing application for its call center agents. An Enterprise single sign-on solution is used to authenticate and sign-in users to all applications. The customer has the following requirements:

Select "Enable as a Canvas Personal App" in the connected app settings.

Enable OAuth settings in the connected app with required OAuth scopes for the pricing application.

The development team has decided to use a Canvas app to expose the pricing application to agents.

Agents should be able to access the Canvas app without needing to log in to the pricing application.Which two options should the identity architect consider to provide support for the Canvas app to initiate login for users?Choose 2 answers

Select "Enable as a Canvas Personal App" in the connected app settings.

Enable OAuth settings in the connected app with required OAuth scopes for the pricing application.

Configure the Canvas app as a connected app and set Admin-approved users as pre-authorized.

Enable SAML in the connected app and Security Assertion Markup Language (SAML) Initiation Method as Service Provider Initiated.

Northern Trail Outfitters (NTO) uses Salesforce Experience Cloud sites (previously known as Customer Community) to provide a digital portal where customers can login using their Google account.NTO would like to automatically create a case record for first time users logging into Salesforce Experience Cloud.What should an Identity architect do to fulfill the requirement?

Implement a login flow with a record create component for Case.

Configure an authentication provider for Social Login using Google and a custom registration handler.

Implement a Just-in-Time handler class that has logic to create cases upon first login.

Create an authentication provider for Social Login using Google and leverage standard registration handler.

Implement a login flow with a record create component for Case.

Universal Containers would like its customers to register and log in to a portal built on Salesforce Experience Cloud. Customers should be able to use their Facebook or Linkedln credentials for ease of use.Which three steps should an identity architect take to implement social sign-on?Choose 3 answers

Create authentication providers for both Facebook and Linkedln.

Check "Facebook" and "Linkedln" under Login Page Setup.

Update the default registration handlers to create and update users.

Register both Facebook and Linkedln as connected apps.

Create authentication providers for both Facebook and Linkedln.

Check "Facebook" and "Linkedln" under Login Page Setup.

Enable "Federated Single Sign-On Using SAML".

Update the default registration handlers to create and update users.

Universal Containers (UC) operates in Asia, Europe and North America regions. There is one Salesforce org for each region. UC is implementing Customer 360 in Salesforce and has procured External Identity and Customer Community licenses in all orgs.Customers of UC use Community to track orders and create inquiries. Customers also tend to move across regions frequently.What should an identity architect recommend to optimize license usage and reduce maintenance overhead?

Contacts are required since Community access needs to be enabled. Maintenance is a necessary overhead that must be handled via data integration.

Merge three orgs into one instance of Salesforce. This will no longer require maintaining three separate copies of the same customer.

Delete contact/ account records and deactivate user if user moves from a specific region; Sync will no longer be required.

Contacts are required since Community access needs to be enabled. Maintenance is a necessary overhead that must be handled via data integration.

Enable Contactless User in all orgs and downgrade users from Experience Cloud license to External Identity license once users have moved out of that region.

Northern Trail Outfitters recently acquired a company. Each company will retain its Identity Provider (IdP). Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.How should the combined companys' employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?

Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.

Configure unique MyDomains for each company and have generated links use the appropriate MyDomam in the URL.

Have generated links append a querystnng parameter indicating the IdP. The login service will redirect to the appropriate IdP.

Have generated links be prefixed with the appropriate IdP URL to invoke an IdP-initiated Security Assertion Markup Language flow when clicked.

Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.

A consumer products company uses Salesforce to maintain consumer information, including orders.The company implemented a portal solution using Salesforce Experience Cloud for its consumers where the consumers can log in using their credentials. The company is considering allowing users to login with their Facebook or Linkedln credentials.Once enabled, what role will Salesforce play?

Salesforce will be the service provider (SP).

Facebook and Linkedln will be the SPs.

Salesforce will be the service provider (SP).

Salesforce will be the identity provider (IdP).

Facebook and Linkedln will act as the IdPs and SPs.

Salesforce Certified Identity and Access Management Architect Practice Test 5

Universal Containers is implementing a new Experience Cloud site and the identity architect wants to use dynamic branding features as of the login process.

Which two options should the identity architect recommend to support dynamic branding for the site?

Choose 2 answers

Become a Premium Member for full access

Unlock Premium Member

Salesforce Certified Identity and Access Management Architect Practice Test 5

Question

Salesforce Certified Identity and Access Management Architect Practice Tests

Practice Tests