Provide Salesforce Identity-and-Access-Management-Architect Practice Test Engine for Preparation [Q33-Q56]

Rate this post

Provide Salesforce Identity-and-Access-Management-Architect Practice Test Engine for Preparation

Detailed New Identity-and-Access-Management-Architect Exam Questions for Concept Clearance

Salesforce Certified Identity and Access Management Architect certification exam is a valuable credential that can help professionals stand out in the competitive job market. Salesforce Certified Identity and Access Management Architect certification demonstrates that a professional has the knowledge, skills, and expertise to design, implement, and manage identity and access management solutions. Employers value this certification because it shows that a professional is committed to continuous learning and development, and has the ability to deliver high-quality solutions that meet business needs.

NEW QUESTION 33
In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?

Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.

Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA

Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.

Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.

NEW QUESTION 34
Which three different attributes can be used to identify the user in a SAML 65> assertion when Salesforce is acting as a Service Provider? Choose 3 answers

Federation ID

Salesforce User ID

User Full Name

User Email Address

Salesforce Username

NEW QUESTION 35
An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?

Users once logged In, can go to the Change Password screen in Salesforce.

Users can click on the “Forgot your Password” link on the Salesforce.com login page.

Users can request the Salesforce Admin to reset their password.

Users can change it on the enterprise LDAP authentication portal.

NEW QUESTION 36
Universal Containers (UC) has built a custom token-based Two-factor authentication (2FA) system for their existing on-premise applications. They are now implementing Salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution as Architect should consider?

Use the custom 2FA system for on-premise applications and native 2FA for Salesforce.

Replace the custom 2FA system with an AppExchange App that supports on premise application and salesforce.

Use Custom Login Flows to connect to the existing custom 2FA system for use in Salesforce.

Replace the custom 2FA system with Salesforce 2FA for on-premise applications and Salesforce.

NEW QUESTION 37
which three are features of federated Single Sign-on solutions? Choose 3 answers

It federates credentials control to authorized applications.

It establishes trust between Identity store and service provider.

It solves all identity and access management problems.

It improves affiliated applications adoption rates.

It enables quick and easy provisioning and deactivating of users.

Explanation
It federates credentials control to authorized applications. This means that users can access multiple applications across different domains or organizations using one set of credentials, without having to share their passwords with each application1. The applications rely on a trusted identity provider (IdP) to authenticate the users and grant them access.
It establishes trust between Identity store and service provider. This means that the IdP and the service provider (SP) have a mutual agreement to exchange identity information using standard protocols, such as SAML, OpenID Connect, or OAuth2. The IdP and the SP also share metadata and certificates to ensure secure communication and verification.
It improves affiliated applications adoption rates. This means that users are more likely to use applications that are connected to their existing identity provider, as they do not have to create or remember multiple passwords3. This also reduces the friction and frustration of logging in to different applications, and enhances the user experience.
The other options are not features of federated single sign-on solutions because:
It solves all identity and access management problems. This is false, as federated single sign-on solutions only address the authentication aspect of identity and access management, not the authorization, provisioning, governance, or auditing aspects. Federated single sign-on solutions also have some challenges, such as complexity, interoperability, and security risks.
It enables quick and easy provisioning and deactivating of users. This is not necessarily true, as federated single sign-on solutions do not automatically create or delete user accounts in the service provider applications. Users still need to be provisioned and deprovisioned manually or through other mechanisms, such as just-in-time provisioning or SCIM.
References: Federated Identity Management vs. Single Sign-On: What’s the Difference?, What is single sign-on?, Single Sign-On (SSO) Solution, [Identity Management vs. Access Management: What’s the Difference?], [Federated Identity Management Challenges], [Just-in-Time Provisioning for SAML], [SCIM User Provisioning]

NEW QUESTION 38

A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS . The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.
What is recommended to ensure these requirements are met ?

Use connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.

Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.

Add a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.

Configure Each ADFS system under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-

NEW QUESTION 39
Universal Containers (UC) has an e-commerce website where customers can buy products, make payments, and manage their accounts. UC decides to build a Customer Community on Salesforce and wants to allow the customers to access the community from their accounts without logging in again. UC decides to implement an SP-initiated SSO using a SAML-compliant Idp. In this scenario where Salesforce is the Service Provider, which two activities must be performed in Salesforce to make SP-initiated SSO work? Choose 2 answers

Configure SAML SSO settings.

Create a Connected App.

Configure Delegated Authentication.

Set up My Domain.

NEW QUESTION 40
Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.
What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.

Build an integration that queries LDAP periodically and creates new active users in Salesforce.

Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at first login.

NEW QUESTION 41
Universal Containers (UC) has implemented SAML-based SSO solution for use with their multi-org Salesforce implementation, utilizing one of the the orgs as the Identity Provider. One user is reporting that they can log in to the Identity Provider org but get a generic SAML error message when accessing the other orgs. Which two considerations should the architect review to troubleshoot the issue? Choose 2 answers

The Federation ID must be a valid Salesforce Username

The Federation ID must is case sensitive

The Federation ID must be in the form of an email address.

The Federation ID must be populated on the user record.

NEW QUESTION 42
Universal containers want to build a custom mobile app connecting to salesforce using Oauth, and would like to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to achieve the goal?

Access Tokens

Mobile pins

Refresh Tokens

Scopes

NEW QUESTION 43
An identity architect has been asked to recommend a solution that allows administrators to configure personalized alert messages to users before they land on the Experience Cloud site (formerly known as Community) homepage.
What is recommended to fulfill this requirement with the least amount of customization?

Customize the registration handler Apex class to create a routing logic navigating to different home pages based on the user profile.

Use Login Flows to add a screen that shows personalized alerts.

Build a Lightning web Component (LWC) for a homepage that shows custom alerts.

Create custom metadata that stores user alerts and use a LWC to display alerts.

NEW QUESTION 44
A technology enterprise is setting up an identity solution with an external vendors wellness application for its employees. The user attributes need to be returned to the wellness application in an ID token.
Which authentication mechanism should an identity architect recommend to meet the requirements?

OpenID Connect

User Agent Flow

JWT Bearer Token Flow

Web Server Flow

NEW QUESTION 45
A global fitness equipment manufacturer is planning to sell fitness tracking devices and has the following requirements:
1) Customer purchases the device.
2) Customer registers the device using their mobile app.
3) A case should automatically be created in Salesforce and associated with the customer’s account in cases where the device registers issues with tracking.
Which OAuth flow should be used to meet these requirements?

OAuth 2.0 Asset Token Flow

OAuth 2.0 Username-Password Flow

OAuth 2.0 User-Agent Flow

OAuth 2.0 SAML Bearer Assertion Flow

NEW QUESTION 46
Universal containers(UC) wants to integrate a third-party reward calculation system with salesforce to calculate rewards. Rewards will be calculated on a schedule basis and update back into salesforce. The integration between Salesforce and the reward calculation system needs to be secure. Which are the recommended best practices for using Oauth flows in this scenario? Choose 2 answers

Oauth refresh token flow

Oauth SAML bearer assertion flow

Oauthjwt bearer token flow

Oauth Username-password flow

NEW QUESTION 47
Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow employees to post Ideas from the Employee portal. When users click on some of the links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with the relevant pages. What OAuth flow is best suited for this scenario?

Web Application flow

SAML Bearer Assertion flow

User-Agent flow

Web Server flow

Explanation
The best OAuth flow for this scenario is the web server flow. The web server flow is an OAuth authorization flow that allows a web application, such as UC’s employee portal, to obtain an access token and a refresh token from Salesforce after the user grants permission. The web application can then use the access token to access Salesforce data and features, such as posting ideas, and use the refresh token to obtain a new access token when the previous one expires or becomes invalid. This flow is suitable for UC’s scenario because it allows users to be redirected to Salesforce, authenticated, and presented with the relevant pages when they click on some of the links in the employee portal. This flow also provides a secure and seamless user experience by using a confidential client secret that is stored on the web server and not exposed to the browser.
The other options are not valid OAuth flows for this scenario. The web application flow is not a standard term for OAuth, but it could refer to the user-agent flow, which is an OAuth authorization flow that allows a browser or web-view, such as a mobile app or a desktop app, to obtain an access token from Salesforce by using a script or a pop-up window. This flow is not suitable for UC’s scenario, as it does not use a web server or a client secret, and it does not provide a refresh token. The SAML bearer assertion flow is an OAuth authorization flow that allows an external application to obtain an access token from Salesforce by using a SAML assertion from an identity provider (IdP) that verifies the user’s identity. This flow is not suitable for UC’s scenario, as it does not involve user interaction or redirection to Salesforce. The user-agent flow is an OAuth authorization flow that allows a browser or web-view, such as a mobile app or a desktop app, to obtain an access token from Salesforce by using a script or a pop-up window. This flow is not suitable for UC’s scenario, as it does not use a web server or a client secret, and it does not provide a refresh token. References:
[OAuth Authorization Flows], [OAuth 2.0 Web Server Flow for Web App Integration], [OAuth 2.0 User-Agent Flow for Desktop Apps], [OAuth 2.0 SAML Bearer Assertion Flow for Server-to-Server Integration]

NEW QUESTION 48
architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct. Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers

The Identity Provider is also used to SSO into five other applications.

The clock on the Identity Provider server is twenty minutes behind Salesforce.

The Issuer Certificate from the Identity Provider expired two weeks ago.

The default language for the Identity Provider and Salesforce are Different.

NEW QUESTION 49
Universal Containers (UC) would like to enable self-registration for their Salesforce Partner Community Users. UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate Profile and Account values.
Which two actions should the Architect recommend to UC1
Choose 2 answers

Configure Registration for Communities to use a custom Visualforce Page.

Modify the SelfRegistration trigger to assign Profile and Account.

Modify the CommunitiesSelfRegController to assign the Profile and Account.

Configure Registration for Communities to use a custom Apex Controller.

NEW QUESTION 50
Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce?
Choose 2 answers

Users leaving laptops unattended and not logging out of Salesforce.

Users accessing Salesforce from a public Wi-Fi access point.

Users choosing passwords that are the same as their Facebook password.

Users creating simple-to-guess password reset questions.

NEW QUESTION 51
An Architect has configured a SAML-based SSO integration between Salesforce and an external Identity provider and is ready to test it. When the Architect attempts to log in to Salesforce using SSO, the Architect receives a SAML error. Which two optimal actions should the Architect take to troubleshoot the issue?

Ensure the Callback URL is correctly set in the Connected Apps settings.

Use a browser that has an add-on/extension that can inspect SAML.

Paste the SAML Assertion Validator in Salesforce.

Use the browser’s Development tools to view the Salesforce page’s markup.

NEW QUESTION 52
universal container plans to develop a custom mobile app for the sales team that will use salesforce for authentication and access management. The mobile app access needs to be restricted to only the sales team.
What would be the recommended solution to grant mobile app access to sales users?

Use a custom attribute on the user object to control access to the mobile app

Use connected apps Oauth policies to restrict mobile app access to authorized users.

Use the permission set license to assign the mobile app permission to sales users

Add a new identity provider to authenticate and authorize mobile users.

NEW QUESTION 53
Universal Containers (UC) is rolling out its new Customer Identity and Access Management Solution built on top of its existing Salesforce instance. UC wants to allow customers to login using Facebook, Google, and other social sign-on providers.
How should this functionality be enabled for UC, assuming ail social sign-on providers support OpenID Connect?

Configure an authentication provider and a registration handler for each social sign-on provider.

Configure a single sign-on setting and a registration handler for each social sign-on provider.

Configure an authentication provider and a Just-In-Time (JIT) handler for each social sign-on provider.

Configure a single sign-on setting and a JIT handler for each social sign-on provider.

NEW QUESTION 54
Universal Containers want users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN.
Which two options should an identity architect recommend to meet the requirement?
Choose 2 answers

Active Directory Password Sync Plugin

Configure Cloud Provider Load Balancer

Salesforce Trigger & Field on Contact Object

Salesforce Identity Connect

NEW QUESTION 55
A real estate company wants to provide its customers a digital space to design their interior decoration options.
To simplify the registration to gain access to the community site (built in Experience Cloud), the CTO has requested that the IT/Development team provide the option for customers to use their existing social-media credentials to register and access.
The IT lead has approached the Salesforce Identity and Access Management (IAM) architect for technical direction on implementing the social sign-on (for Facebook, Twitter, and a new provider that supports standard OpenID Connect (OIDC)).
Which two recommendations should the Salesforce IAM architect make to the IT Lead?
Choose 2 answers

Use declarative registration handler process builder/flow to create, update users and contacts.

Authentication provider configuration is required each social sign-on providers; and enable Authentication providers in community.

For supporting OIDC it is necessary to enable Security Assertion Markup Language (SAML) with Just-in-Time provisioning (JIT) and OAuth 2.0.

Apex coding skills are needed for registration handler to create and update users.

NEW QUESTION 56
An administrator created a connected app for a custom wet) application in Salesforce which needs to be visible as a tile in App Launcher The tile for the custom web application is missing in the app launcher for all users in Salesforce. The administrator requested assistance from an identity architect to resolve the issue.
Which two reasons are the source of the issue?
Choose 2 answers

StartURL for the connected app is not set in Connected App settings.

OAuth scope does not include “openid”.

Session Policy is set as ‘High Assurance Session required’ for this connected app.

The connected app is not set in the App menu as ‘Visible in App Launcher”.

Salesforce Certified Identity and Access Management Architect exam is a challenging certification that requires a comprehensive understanding of the Salesforce platform and its security features. Identity-and-Access-Management-Architect exam is designed to test not only the candidate’s technical knowledge but also their ability to design and implement effective solutions that meet their clients’ needs. Those who pass the exam will earn the title of Salesforce Certified Identity and Access Management Architect, which is recognized throughout the industry as a mark of expertise and professionalism.

Identity-and-Access-Management-Architect 2024 Training With 245 QA’s: https://www.test4cram.com/Identity-and-Access-Management-Architect_real-exam-dumps.html

Leave a Reply Cancel reply