Achieve the Identity-and-Access-Management-Architect Exam Best Results with Help from Salesforce Certified Experts
Provide Identity-and-Access-Management-Architect Practice Test Engine for Preparation
NEW QUESTION # 22
Which two roles of the systems are involved in an environment where salesforce users are enabled to access Google Apps from within salesforce through App launcher and connected App set up? Choose 2 answers
- A. Google is the service provider
- B. Salesforce is the identity provider
- C. Salesforce is the service provider
- D. Google is the identity provider
Answer: C
NEW QUESTION # 23
Universal containers (UC) would like to enable self - registration for their salesforce partner community users.
UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate profile and account values. Which two actions should the architect recommend to UC? Choose 2 answers
- A. Configure registration for communities to use a custom apex controller.
- B. Modify the communitiesselfregcontroller to assign the profile and account.
- C. Configure registration for communities to use a custom visualforce page.
- D. Modify the selfregistration trigger to assign profile and account.
Answer: B,C
NEW QUESTION # 24
Universal containers wants salesforce inbound Oauth-enabled integration clients to use SAML-BASED single Sign-on for authentication. What Oauth flow would be recommended in this scenario?
- A. SAML assertion Oauth flow
- B. User-Agent Oauth flow
- C. User-Token Oauth flow
- D. Web server Oauth flow
Answer: A
NEW QUESTION # 25
An identity architect's client has a homegrown identity provider (IdP). Salesforce is used as the service provider (SP). The head of IT is worried that during a SP initiated single sign-on (SSO), the Security Assertion Markup Language (SAML) request content will be altered.
What should the identity architect recommend to make sure that there is additional trust between the SP and the IdP?
- A. Ensure that there is an HTTPS connection between IDP and SP.
- B. Ensure that the Issuer and Assertion Consumer service (ACS) URL is property configured between SP and IDP.
- C. Encrypt the SAML Request using certification authority (CA) signed certificate and decrypt on IdP.
- D. Ensure that on the SSO settings page, the "Request Signing Certificate" field has a self-signed certificate.
Answer: C
NEW QUESTION # 26
Universal Containers is using OpenID Connect to enable a connection from their new mobile app to its production Salesforce org.
What should be done to enable the retrieval of the access token status for the OpenID Connect connection?
- A. Query using OpenID Connect discovery endpoint.
- B. A Leverage OpenID Connect Token Introspection.
- C. Create a custom OAuth scope.
- D. Enable cross-origin resource sharing (CORS) for the /services/oauth2/token endpoint.
Answer: B
NEW QUESTION # 27
Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process. Which two considerations should an architect point out to UC? Choose 2 answers
- A. The web server must be able to protect consumer privacy
- B. The flow involves passing the user credentials back and forth.
- C. The web application should be hosted on a secure server.
- D. The flow will not provide an Oauth refresh token back to the server.
Answer: A,C
NEW QUESTION # 28
Universal Containers (UC) is building an integration between Salesforce and a legacy web applications using the canvas framework. The security for UC has determined that a signed request from Salesforce is not an adequate authentication solution for the Third-Party app. Which two options should the Architect consider for authenticating the third-party app using the canvas framework? Choose 2 Answers
- A. Utilize Canvas OAuth flow to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
- B. Utilize Authorization Providers to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
- C. Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC's IdP.
- D. Create a registration handler Apex class to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
Answer: A,C
NEW QUESTION # 29
Universal Containers (UC) has decided to use Salesforce as an Identity Provider for multiple external applications. UC wants to use the salesforce App Launcher to control the Apps that are available to individual users. Which three steps are required to make this happen?
- A. Set up Salesforce as a SAML Idp with My Domain.
- B. Set up Identity Connect to Synchronize user data.
- C. Create a Connected App for each external application.
- D. Add each connected App to the App Launcher with a Start URL.
- E. Set up an Auth Provider for each External Application.
Answer: A,C,D
NEW QUESTION # 30
A multinational industrial products manufacturer is planning to implement Salesforce CRM to manage their business. They have the following requirements:
1. They plan to implement Partner communities to provide access to their partner network .
2. They have operations in multiple countries and are planning to implement multiple Salesforce orgs.
3. Some of their partners do business in multiple countries and will need information from multiple Salesforce communities.
4. They would like to provide a single login for their partners.
How should an Identity Architect solution this requirement with limited custom development?
- A. Allow partners to choose the Salesforce org they need information from and use login flows to authenticate access.
- B. Create a partner login for the country of their operation and use SAML federation to provide access to other orgs.
- C. Register partners in one org and access information from other orgs using APIs.
- D. Consolidate Partner related information in a single org and provide access through Salesforce community.
Answer: B
NEW QUESTION # 31
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?
- A. Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.
- B. Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.
- C. Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.
- D. Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.
Answer: B
NEW QUESTION # 32
An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?
- A. Users can click on the "Forgot your Password" link on the Salesforce.com login page.
- B. Users can request the Salesforce Admin to reset their password.
- C. Users can change it on the enterprise LDAP authentication portal.
- D. Users once logged In, can go to the Change Password screen in Salesforce.
Answer: B
NEW QUESTION # 33
Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an external identity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.
What should a identity architect recommend to create partners?
- A. Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.
- B. Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.
- C. Allow partners to register through the IdP and create partner users in Salesforce through an API.
- D. On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.
Answer: B
NEW QUESTION # 34
Which two statements are capable of Identity Connect? Choose 2 answers
- A. Support multiple orgs connecting to multiple Active Directory servers.
- B. Synchronization of Salesforce Permission Set Licence Assignments.
- C. Automated user synchronization and de-activation.
- D. Supports both Identity-Provider-Initiated and Service-Provider-Initiated SSO.
Answer: C,D
NEW QUESTION # 35 
A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS . The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.
What is recommended to ensure these requirements are met ?
- A. Use connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.
- B. Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.
- C. Configure Each ADFS system under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-
- D. Add a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.
Answer: B
NEW QUESTION # 36
Northern Trail Outfitters (NTO) is setting up Salesforce to authenticate users with an external identity provider. The NTO Salesforce Administrator is having trouble getting things setup.
What should an identity architect use to show which part of the login assertion is fading?
- A. Connected App Manager
- B. SAML Metadata file importer
- C. Identity Provider Metadata download
- D. Security Assertion Markup Language Validator
Answer: D
NEW QUESTION # 37
Universal Containers wants to secure its Salesforce APIs by using an existing Security Assertion Markup Language (SAML) configuration supports the company's single sign-on process to Salesforce, Which Salesforce OAuth authorization flow should be used?
- A. OAuth 2.0 User-Agent Flow
- B. OAuth 2.0 SAML Bearer Assertion Flow
- C. A SAML Assertion Row
- D. OAuth 2.0 JWT Bearer Flow
Answer: C
NEW QUESTION # 38
An identity architect is implementing a mobile-first Consumer Identity Access Management (CIAM) for external users. User authentication is the only requirement. The users email or mobile phone number should be supported as a username.
Which two licenses are needed to meet this requirement?
Choose 2 answers
- A. External Identity Licenses
- B. Email Verification Credits
- C. SMS verification Credits
- D. Identity Connect Licenses
Answer: A,C
NEW QUESTION # 39
Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers
- A. Salesforce users will be locked out of Salesforce if the web service goes down.
- B. UC will be required to develop and support a custom SOAP web service.
- C. The web service must reside on a public cloud service, such as Heroku.
- D. Delegated Authentication is enabled or disabled for the entire Salesforce org.
Answer: A,B
NEW QUESTION # 40
What are three capabilities of Delegated Authentication? Choose 3 answers
- A. It can be assigned by Permission Sets.
- B. It can connect to REST services.
- C. It can be assigned by Profiles.
- D. It can be assigned by Custom Permissions.
- E. It can connect to SOAP services.
Answer: A,B,E
NEW QUESTION # 41
An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenano?
- A. Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.
- B. If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.
- C. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.
- D. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
Answer: C
NEW QUESTION # 42
Universal containers (UC) is setting up their customer Community self-registration process. They are uncomfortable with the idea of assigning new users to a default account record. What will happen when customers self-register in the community?
- A. The self-registration page will ask user to select an account.
- B. The self-registration process will produce an error to the user.
- C. The self-registration page will create a new account record.
- D. The self-registration process will create a person Account record.
Answer: B
NEW QUESTION # 43
Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?
- A. The app is requesting too many access Tokens in a 24-hour period
- B. The users forget to check the box to remember their credentials.
- C. The refresh token expiration policy is set incorrectly in salesforce
- D. The Oauth authorizations are being revoked by a nightly batch job.
Answer: C
NEW QUESTION # 44
IT security at Unversal Containers (UC) us concerned about recent phishing scams targeting its users and wants to add additional layers of login protection. What should an Architect recommend to address the issue?
- A. Implement Single Sign-on using a corporate Identity store.
- B. Lock sessions to the IP address from which they originated.
- C. Use the Salesforce Authenticator mobile app with two-step verification
- D. Increase Password complexity requirements in Salesforce.
Answer: C
NEW QUESTION # 45
A real estate company wants to provide its customers a digital space to design their interior decoration options.
To simplify the registration to gain access to the community site (built in Experience Cloud), the CTO has requested that the IT/Development team provide the option for customers to use their existing social-media credentials to register and access.
The IT lead has approached the Salesforce Identity and Access Management (IAM) architect for technical direction on implementing the social sign-on (for Facebook, Twitter, and a new provider that supports standard OpenID Connect (OIDC)).
Which two recommendations should the Salesforce IAM architect make to the IT Lead?
Choose 2 answers
- A. Use declarative registration handler process builder/flow to create, update users and contacts.
- B. Authentication provider configuration is required each social sign-on providers; and enable Authentication providers in community.
- C. Apex coding skills are needed for registration handler to create and update users.
- D. For supporting OIDC it is necessary to enable Security Assertion Markup Language (SAML) with Just-in-Time provisioning (JIT) and OAuth 2.0.
Answer: B,C
NEW QUESTION # 46
Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would like to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to achieve the goal?
- A. Refresh Tokens
- B. Scopes
- C. Access Tokens
- D. Mobile pins
Answer: B
NEW QUESTION # 47
......
Salesforce IAM certification exam covers a wide range of topics, including identity management, access management, authentication protocols, authorization models, security standards, and regulatory compliance. Identity-and-Access-Management-Architect exam format comprises 60 multiple-choice questions, and individuals have 120 minutes to complete the exam. Salesforce Certified Identity and Access Management Architect certification exam is administered by Salesforce and can be taken in-person or remotely.
Detailed New Identity-and-Access-Management-Architect Exam Questions for Concept Clearance: https://www.braindumpspass.com/Salesforce/Identity-and-Access-Management-Architect-practice-exam-dumps.html
Identity-and-Access-Management-Architect Exam Preparation Material with New Identity-and-Access-Management-Architect Dumps Questions.: https://drive.google.com/open?id=1mN5NpE6oosvh5JpRj7lYFZl2HpzL9lOZ
