Northern Trail Outfitters (NTO) is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable NTO-branded page.The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.Which approach should the identity architect recommend?

Implement Experience ID in the code and extend the URLs and endpomts, as required.

Create a full sandbox to replicate the portal site and update the branding accordingly.

Implement Experience ID in the code and extend the URLs and endpomts, as required.

Use Heroku to build the new brand site and embedded login to reuse identities.

Configure an additional community site on the same org that is dedicated for the new brand.

Refer to the exhibit. An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioining in the integrated cloud applications.2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-Domain Identity Management) for provisioning and deprovisioning of users.

Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning and deprovisioning of users.

Configure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.

Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.

Northern Trail Outfitters want to allow its consumer to self-register on it business-to-consumer (B2C) portal that is built on Experience Cloud. The identity architect has recommended to use Person Accounts.Which three steps need to be configured to enable self-registration using person accounts?Choose 3 answers

Enable access to person and business account record types under Public Access Settings.

Under Login and Registration settings, ensure that the default account field is empty.

Contact Salesforce Support to enable person accounts.

Enable access to person and business account record types under Public Access Settings.

Contact Salesforce Support to enable business accounts.

Under Login and Registration settings, ensure that the default account field is empty.

Contact Salesforce Support to enable person accounts.

Set organization-wide default sharing for Contact to Public Read Only.

Universal Containers (UC) is using Active Directory as its corporate identity provider and Salesforce as its CRM for customer care agents, who use SAML based sign sign-on to login to Salesforce. The default agent profile does not include the Manage User permission. UC wants to dynamically update the agent role and permission sets.Which two mechanisms are used to provision agents with the appropriate permissions?Choose 2 answers

Use Login Flow in System Context to update role and permission sets.

Use SAML Just-in-Time (JIT) handler class run as an admin user to update role and permission sets.

Use Login Flow in User Context to update role and permission sets.

Use Login Flow in System Context to update role and permission sets.

Use SAML Just-m-Time (JIT) Handler class run as current user to update role and permission sets.

Use SAML Just-in-Time (JIT) handler class run as an admin user to update role and permission sets.

Northern Trail Outfitters wants to implement a partner community. Active community users will need to review and accept the community rules, and update key contact information for each community member before their annual partner event.Which approach will meet this requirement?

Create a login flow that conditionally prompts users who have not accepted the new community rules and who have missing or outdated information.

Create tasks for users who need to update their data or accept the new community rules.

Create a custom landing page and email campaign asking all community members to login and verify their data.

Create a login flow that conditionally prompts users who have not accepted the new community rules and who have missing or outdated information.

Add a banner to the community Home page asking users to update their profile and accept the new community rules.

Universal Containers is creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow. Application users will authenticate using username and password.They should not be forced to approve API access in the mobile app or reauthenticate for 3 months.Which two connected app options need to be configured to fulfill this use case?Choose 2 answers

Set Permitted Users to "All users may self-authorize".

Set the Refresh Token Policy to expire refresh token after 3 months.

Set Permitted Users to "Admin approved users are pre-authorized".

Set Permitted Users to "All users may self-authorize".

Set the Session Timeout value to 3 months.

Set the Refresh Token Policy to expire refresh token after 3 months.

The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discuss Salesforce out-of-box capabilities for configuring the company*s login and registration experience on Salesforce Experience Cloud.The CMO is looking to brand the login page with the company's logo, background color, login button color, and dynamic right-frame from an external URL.Which two solutions should the IAM specialist recommend?Choose 2 answers

Use Experience Builder to build branded Reset and Forgot Password pages.

Login & Registration pages can be branded in the Community Administration settings.

Use Experience Builder to build branded Reset and Forgot Password pages.

Build custom pages for branding requirements in Experience Cloud.

Build custom site pages for reset and forgot password features.

Login & Registration pages can be branded in the Community Administration settings.

A global fitness equipment manufacturer is planning to sell fitness tracking devices and has the following requirements:1) Customer purchases the device.2) Customer registers the device using their mobile app.3) A case should automatically be created in Salesforce and associated with the customers account in cases where the device registers issues with tracking.Which OAuth flow should be used to meet these requirements?

OAuth 2.0 Username-Password Flow

OAuth 2.0 SAML Bearer Assertion Flow

A security architect is rolling out a new multi-factor authentication (MFA) mandate, where all employees must go through a secure authentication process before accessing Salesforce. There are multiple Identity Providers (IdP) in place and the architect is considering how the "Authentication Method Reference" field (AMR) in the Login History can help.Which two considerations should the architect keep in mind?Choose 2 answers

AMR field shows the authentication methods used at IdP.

Both OIDC and Security Assertion Markup Language (SAML) are supported but AMR must be implemented at IdP.

AMR field shows the authentication methods used at IdP.

Both OIDC and Security Assertion Markup Language (SAML) are supported but AMR must be implemented at IdP.

High-assurance sessions must be configured under Session Security Level Policies.

Dependency on what is supported by OpenID Connect (OIDC) implementation at IdP.

Universal Container's (UC) identity architect needs to recommend a license type for their new Experience Cloud site that will be used by external partners (delivery providers) for reviewing and updating their accounts, downloading files provided by UC and obtaining scheduled pickup dates from their calendar.UC is using their Salesforce production org as the identity provider for these users and the expected number of individual users is 2.5 million with 13.5 million unique logins per month.Which of the following license types should be used to meet the requirement?

Customer Community plus Login License

Partner Community Login License

Customer Community plus Login License

Northern Trail Outfitters (NTO) wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, NTO establishes a single customer view including their buying behaviors, channel preferences and purchasing history. All of this information exists but is spread across different systems and formats.NTO has decided to use Salesforce as the platform to build a 360 degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets.What should an Identity Architect do to provision, deprovision and authenticate users?

A Salesforce Identity can be included but NTO will require Identity Connect.

Salesforce Identity is not needed since NTO uses Microsoft AD.

Salesforce Identity can be included but NTO will be required to build a custom integration with Microsoft AD.

Salesforce Identity is included in the Salesforce licenses so it does not need to be considered separately.

A Salesforce Identity can be included but NTO will require Identity Connect.

An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:

Users should not have to login every time they use the app.

The app should be able to make calls to the Salesforce REST API.

End users should NOT see the OAuth approval page.How should the identity architect configure the Salesforce connected app to meet the requirements?

Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to "Admin Pre-Approved".

Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to 'Admin Pre-Approved".

Enable the Full Access Scope and then set the connected app access settings to "Admin Pre- Approved".

Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to "User may self authorize".

Northern Trail Outfitters (NTO) has a requirement to ensure all user logins include a single multifactor authentication (MFA) prompt. Currently, users are allowed the choice to login with a username and password or via single sign-on against NTO's corporate Identity Provider, which includes built-in MFA.Which configuration will meet this requirement?

Enable "MFA for User Interface Logins" for your organization from Setup -> Identity Verification.

Create and assign a permission set to all employees that includes "MFA for User Interface Logins."

Create a custom login flow that enforces MFA and assign it to a permission set. Then assign the permission set to all employees.

Enable "MFA for User Interface Logins" for your organization from Setup -> Identity Verification.

For all employee profiles, set the Session Level Required at Login to High Assurance and add the corporate identity provider to the High Assurance list for the org's Session Security Levels.

Universal Containers (UC) is planning to add Wi-Fi enabled GPS tracking devices to its shipping containers so that the GPS coordinates data can be sent from the tracking device to its Salesforce production org via a custom API. The GPS devices have no direct user input or output capabilities.Which OAuth flow should the identity architect recommend to meet the requirement?

OAuth 2.0 Asset Token Flow for Securing Connected Devices

OAuth 2.0 Username-Password Flow for Special Scenarios

OAuth 2.0 Web Server Flow for Web App Integration

OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration

An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).Mow can end users change their password?

Users can request the Salesforce Admin to reset their password.

Users once logged In, can go to the Change Password screen in Salesforce.

Users can click on the "Forgot your Password" link on the Salesforce.com login page.

Users can request the Salesforce Admin to reset their password.

Users can change it on the enterprise LDAP authentication portal.

Northern Trail Outfitters (NTO) is planning to implement a community for its customers using Salesforce Experience Cloud . Customers are not able to self-register. NTO would like to have customers set their own passwords when provided access to the community.Which two recommendations should an identity architect make to fulfill this requirement?Choose 2 answers

Allow Password reset using the API to update Experience Cloud site membership.

Use Login Flows to allow users to reset password in Experience Cloud site.

Add customers as contacts and add them to Experience Cloud site.

Enable Welcome emails while configuring the Experience Cloud site.

Allow Password reset using the API to update Experience Cloud site membership.

Use Login Flows to allow users to reset password in Experience Cloud site.

Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless expenence. The third-party employee portal only supports OAuth.What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

Configure SSO to use the third party portal as an identity provider.

Create a custom external authentication provider.

Add the third-party portal as a connected app.

Configure Salesforce for Delegated Authentication.

A real estate company wants to provide its customers a digital space to design their interior decoration options. To simplify the registration to gain access to the community site (built in Experience Cloud), the CTO has requested that the IT/Development team provide the option for customers to use their existing social-media credentials to register and access.The IT lead has approached the Salesforce Identity and Access Management (IAM) architect for technical direction on implementing the social sign-on (for Facebook, Twitter, and a new provider that supports standard OpenID Connect (OIDC)).Which two recommendations should the Salesforce IAM architect make to the IT Lead?Choose 2 answers

Authentication provider configuration is required each social sign-on providers; and enable Authentication providers in community.

Apex coding skills are needed for registration handler to create and update users.

Use declarative registration handler process builder/flow to create, update users and contacts.

Authentication provider configuration is required each social sign-on providers; and enable Authentication providers in community.

For supporting OIDC it is necessary to enable Security Assertion Markup Language (SAML) with Just-in-Time provisioning (JIT) and OAuth 2.0.

Apex coding skills are needed for registration handler to create and update users.

Northern Trail Outfitters manages application functional permissions centrally as Active Directory groups. The CRM_Superllser and CRM_Reportmg_SuperUser groups should respectively give the user the SuperUser and Reportmg_SuperUser permission set in Salesforce. Salesforce is the service provider to a Security Assertion Markup Language (SAML) identity provider.Mow should an identity architect ensure the Active Directory groups are reflected correctly when a user accesses Salesforce?

Use the Apex Just-in-Time handler to query custom SAML attributes and set permission sets.

Use the Apex Just-in-Time handler to query standard SAML attributes and set permission sets.

Use the Apex Just-in-Time handler to query custom SAML attributes and set permission sets.

Use a login flow to query custom SAML attributes and set permission sets.

Use a login flow to query standard SAML attributes and set permission sets.

A global company is using the Salesforce Platform as an Identity Provider and needs to integrate a third-party application with its Experience Cloud customer portal.Which two features should be utilized to provide users with login and identity services for the thirdparty application?Choose 2 answers

Use the App Launcher with single sign-on (SSO).

External a Data source with Named Principal identity type.

A company wants to provide its employees with a custom mobile app that accesses Salesforce. Users are required to download the internal native IOS mobile app from corporate intranet on their mobile device. The app allows flexibility to access other Non Salesforce internal applications once users authenticate with Salesforce. The apps self-authorize, and users are permitted to use the apps once they have logged into Salesforce.How should an identity architect meet the above requirements with the privately distributed mobile app?

Configure Mobile App settings in connected app and Salesforce as identity provider for non- Salesforce internal apps.

Use connected app with OAuth and Security Assertion Markup Language (SAML) to access other Non Salesforce internal apps.

Configure Mobile App settings in connected app and Salesforce as identity provider for non- Salesforce internal apps.

Use Salesforce as an identity provider (IdP) to access the mobile app and use the external IdP for other non-Salesforce internal apps.

Create a new hybrid mobile app and use the connected app with OAuth to authenticate users for Salesforce and non-Salesforce internal apps.

Universal Containers allows employees to use a mobile device to access Salesforce for daily operations using a hybrid mobile app. This app uses Mobile software development kits (SDK), leverages refresh token to regenerate access token when required and is distributed as a private app.The chief security officer is rolling out an org wide compliance policy to enforce re-venfication of devices if an employee has not logged in from that device in the last week.Which connected app setting should be leveraged to comply with this policy change?

Refresh Token Policy - Expire the refresh token if it has not been used for 7 days.

Scope - Deny refresh_token scope for this connected app.

Refresh Token Policy - Expire the refresh token if it has not been used for 7 days.

Session Policy - Set timeout value of the connected app to 7 days.

Permitted User - Ask admins to maintain a list of users who are permitted based on last login date.

Northern Trail Outfitters (NTO) employees use a custom on-premise helpdesk application to request, approve, notify, and track access granted to various on-premises and cloud applications, including Salesforce. Salesforce is currently used to authenticate users.How should NTO provision Salesforce users as soon as they are approved in the helpdesk application with the approved profiles and permission sets?

Use a login flow to query the helpdesk to validate user status.

Build an integration that performs a remote call-in to the Salesforce SOAP or REST API.

Use a login flow to query the helpdesk to validate user status.

Have the helpdesk initiate an IdP-initiated Just-m-Time provisioning Security Assertion Markup Language flow.

Use Salesforce Connect to integrate with the helpdesk application.

Universal Containers (UC) has an Experience Cloud site (Customer Community) where customers can authenticate and place orders, view the status of orders, etc. UC allows guest checkout.Mow can a guest register using data previously collected during order placement?

Enable self-registration and customize a self-registration page to collect only order details to retrieve customer data.

Enable Security Assertion Markup Language Sign-On and use a login flow to collect only order details to retrieve customer data.

Enable Facebook as an authentication provider and use a registration handler to collect only order details to retrieve customer data.

Use a Connected App Handler Apex Plugin class to collect only order details to retrieve customer data.

Enable self-registration and customize a self-registration page to collect only order details to retrieve customer data.

Universal Containers want users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN.Which two options should an identity architect recommend to meet the requirement?Choose 2 answers

Active Directory Password Sync Plugin

Configure Cloud Provider Load Balancer

Salesforce Trigger & Field on Contact Object

A multinational industrial products manufacturer is planning to implement Salesforce CRM to manage their business. They have the following requirements:

They plan to implement Partner communities to provide access to their partner network .

They have operations in multiple countries and are planning to implement multiple Salesforce orgs.

Some of their partners do business in multiple countries and will need information from multiple Salesforce communities.

They would like to provide a single login for their partners.How should an Identity Architect solution this requirement with limited custom development?

Create a partner login for the country of their operation and use SAML federation to provide access to other orgs.

Consolidate Partner related information in a single org and provide access through Salesforce community.

Allow partners to choose the Salesforce org they need information from and use login flows to authenticate access.

Register partners in one org and access information from other orgs using APIs.

An administrator created a connected app for a custom wet) application in Salesforce which needs to be visible as a tile in App Launcher The tile for the custom web application is missing in the app launcher for all users in Salesforce. The administrator requested assistance from an identity architect to resolve the issue.Which two reasons are the source of the issue?Choose 2 answers

StartURL for the connected app is not set in Connected App settings.

Session Policy is set as 'High Assurance Session required' for this connected app.

StartURL for the connected app is not set in Connected App settings.

OAuth scope does not include "openid*.

Session Policy is set as 'High Assurance Session required' for this connected app.

The connected app is not set in the App menu as 'Visible in App Launcher".

An insurance company has a connected app in its Salesforce environment that is used to integrate with a Google Workspace (formerly knot as G Suite).An identity and access management (IAM) architect has been asked to implement automation to enable users, freeze/suspend users, disable users, and reactivate existing users in Google Workspace upon similar actions in Salesforce.Which solution is recommended to meet this requirement?

Configure user Provisioning for Connected Apps.

Update the Security Assertion Markup Language Just-in-Time (SAML JIt; handler in Salesforce for user provisioning and de-provisioning.

Build a custom REST endpoint in Salesforce that Google Workspace can poll against.

Build an Apex trigger on the useriogin object to make asynchronous callouts to Google APIs.

Salesforce Certified Identity and Access Management Architect Practice Test 6

A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect (OIDC).

When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC or SAML?

Become a Premium Member for full access

Unlock Premium Member

Salesforce Certified Identity and Access Management Architect Practice Test 6

Question

Salesforce Certified Identity and Access Management Architect Practice Tests

Practice Tests