When designing a multi-branded Customer Identity and Access Management solution on the Salesforce Platform, how should an identity architect ensure a specific brand experience in Salesforce is presented?

The Experience ID, which can be included in OAuth/Open ID flows and Security Assertion Markup Language (SAML) flows as a URL parameter.

Provide a brand picker that the end user can use to select its sub-brand when they arrive on salesforce.

Add a custom parameter to the service provider's OAuth/SAML call and implement logic on its login page to apply branding based on the parameters value.

The Audience ID, which can be set in a shared cookie.

Northern Trail Outfitters (NTO) believes a specific user account may have been compromised. NTO inactivated the user account and needs U perform a forensic analysis and identify signals that could Indicate a breach has occurred.What should NTO's first step be in gathering signals that could indicate account compromise?

Download the Login History and evaluate the details of logins performed by the user.

Review the User record and evaluate the login and transaction history.

Download the Setup Audit Trail and review all recent activities performed by the user.

Download the Identity Provider Event Log and evaluate the details of activities performed by the user.

Download the Login History and evaluate the details of logins performed by the user.

Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.Which three steps should an identity architect follow to implement the outlined requirements?Choose 3 answers

Enable "Allow customers and partners to self-register".

Select the "Configurable Self-Reg Page" option under Login & Registration.

Customize me self-registration Apex handler to create only the user record.

Enable "Allow customers and partners to self-register".

Select the "Configurable Self-Reg Page" option under Login & Registration.

Set jp an external login page and call Salesforce APIs for user creation.

Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.

Customize me self-registration Apex handler to create only the user record.

A public sector agency is setting up an identity solution for its citizens using a Community built on Experience Cloud and requires the new user registration functionality to capture first name, last name, and phone number. The phone number will be used for identity verification.Which feature should an identity architect recommend to meet the requirements?

Integrate with social websites (Facebook, Linkedin. Twitter)

Use an external Identity Provider

Create a custom Lightning Web Component

An identity architect's client has a homegrown identity provider (IdP). Salesforce is used as the service provider (SP). The head of IT is worried that during a SP initiated single sign-on (SSO), the Security Assertion Markup Language (SAML) request content will be altered.What should the identity architect recommend to make sure that there is additional trust between the SP and the IdP?

Encrypt the SAML Request using certification authority (CA) signed certificate and decrypt on IdP.

Ensure that there is an HTTPS connection between IDP and SP.

Ensure that on the SSO settings page, the "Request Signing Certificate" field has a self-signed certificate.

Ensure that the Issuer and Assertion Consumer service (ACS) URL is property configured between SP and IDP.

Encrypt the SAML Request using certification authority (CA) signed certificate and decrypt on IdP.

Universal Containers wants to secure its Salesforce APIs by using an existing Security Assertion Markup Language (SAML) configuration supports the company's single sign-on process to Salesforce, Which Salesforce OAuth authorization flow should be used?

OAuth 2.0 SAML Bearer Assertion Flow

Northern Trail Outfitters mar ages functional group permissions in a custom security application supported by a relational database and a REST service layer. Group permissions are mapped as permission sets in Salesforce. Which action should an identity architect use to ensure functional group permissions are reflected as permission set assignments?

Use a Login Flow with invocable Apex to callout to the security application and set permission sets.

Use a Login Flow to query SAML attributes and set permission sets.

Use a Login Flow with invocable Apex to callout to the security application and set permission sets.

Use the Apex Just-in-Time (JIT) handler to query the Security Assertion markup Language (SAML) attributes and set permission sets.

Use the Apex JIT handler to callout to the security application and set permission sets

Salesforce Certified Identity and Access Management Architect Practice Test 7

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.

What should an identity architect recommend to prevent this from happening in the future?

Become a Premium Member for full access

Unlock Premium Member

Salesforce Certified Identity and Access Management Architect Practice Test 7

Question

Salesforce Certified Identity and Access Management Architect Practice Tests

Practice Tests