[2022] Identity-and-Access-Management-Designer All-in-One Exam Guide Practice To your Identity-and-Access-Management-Designer Exam! [Q42-Q63]

Rate this post

[2022] Identity-and-Access-Management-Designer All-in-One Exam Guide Practice To your Identity-and-Access-Management-Designer Exam!

Preparations of Identity-and-Access-Management-Designer Exam 2022 Salesforce Identity and Access Management Designer Unlimited 245 Questions

The benefit in Obtaining the Identity-and-Access-Management-Designer Exam Certification

After completing the Salesforce Certified Identity and Access Management Designer certification Candidate becomes a solid, well-rounded Salesforce Certified Identity and Access Management Designer.
When an organization hiring or promotion an employee, then the decision is made by human resources. Now while Candidate may have an IT background, they do their decisions in a way that takes into record many different factors. One thing is candidates have formal credentials, such as the Salesforce Certified Identity and Access Management Designer.
If the Candidate has the desire to move up to a higher-paying position in an organization. This certification will help as always.
A candidate might have incredible IT skills. Employers that do the hiring need to make decisions based on limited information and as it always. When they view the official Salesforce Certified Identity and Access Management Designer certification, they can be guaranteed that a candidate has achieved a certain level of competence.

QUESTION 42
Universal Containers (UC) has implemented a multi-org architecture in their company. Many users have licenses across multiple orgs, and they are complaining about remembering which org and credentials are tied to which business process.
Which two recommendations should the Architect make to address the complaints? (Choose two.)

Activate My Domain to brand each org to the specific business use case.

Implement IdP-Initiated Single Sign-on flows to allow deep linking.

Implement Delegated Authentication from each org to the LDAP provider.

Implement SP-Initiated Single Sign-on flows to allow deep linking.

QUESTION 43
Universal Containers is creating a web application that will be secured by Salesforce Identity using the OAuth 2.0 Web Server Flow uses the OAuth 2.0 authorization code grant type).
Which three OAuth concepts apply to this flow?
Choose 3 answers

Verification URL

Client Secret

Access Token

Scopes

QUESTION 44
Universal Containers (UC) is planning to deploy a custom mobile app that will allow users to get e-signatures from its customers on their mobile devices. The mobile app connects to Salesforce to upload the e-signature as a file attachment and uses OAuth protocol for both authentication and authorization. What is the most recommended and secure OAuth scope setting that an Architect should recommend?

Web

Api

Custom_permissions

QUESTION 45
Universal Containers (UC) wants its closed Won opportunities to be synced to a Data warehouse in near real time. UC has implemented Outbound Message to enable near real-time data sync. UC wants to ensure that communication between Salesforce and Target System is secure. What certificate is sent along with the Outbound Message?

The Self-signed Certificates from the Certificate & Key Management menu.

The default client Certificate from the Develop–> API menu.

The default client Certificate or the Certificate and Key Management menu.

The CA-signed Certificate from the Certificate and Key Management Menu.

QUESTION 46
Which two considerations should be made when implementing Delegated Authentication?
Choose 2 answers

The authentication web service can include custom attributes.

It can be used to authenticate API clients and mobile apps.

It requires trusted IP ranges at the User Profile level.

Salesforce servers receive but do not validate a user’s credentials.

Just-in-time Provisioning can be configured for new users.

QUESTION 47
Universal containers (UC) is concerned that having a self-registration page will provide a means for “bots” or unintended audiences to create user records, thereby consuming licences and adding dirty dat a. Which two actions should UC take to prevent unauthorised form submissions during the self-registration process? Choose 2 answers

Use open-ended security questions and complex password requirements

Primarily use lookup and picklist fields on the self registration page.

Require a captcha at the end of the self-registration process.

Use hidden fields populated via java script events in the self-registration page.

QUESTION 48
Universal Containers (UC) has decided to replace the homegrown customer portal with Salesforce Experience Cloud. UC will continue to use its third-party single sign-on (SSO) solution that stores all of its customer and partner credentials.
The first time a customer logs in to the Experience Cloud site through SSO, a user record needs to be created automatically.
Which solution should an identity architect recommend in order to automatically provision users in Salesforce upon login?

Just-in-Time (JIT) provisioning

Custom middleware and web services

Custom login flow and Apex handler

Third-party AppExchange solution

QUESTION 49
In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?

Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.

Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA

Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.

Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.

QUESTION 50
Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an external identity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.
What should a identity architect recommend to create partners?

On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.

Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.

Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.

Allow partners to register through the IdP and create partner users in Salesforce through an API.

QUESTION 51
Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financialsystem, and CPQ system. Below is the SSO implementation landscape.

What role combination is represented by the systems in this scenario”

Financial System and CPQ System are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are acting as Identity Providers.

Salesforce Org1 and PingFederate are acting as Identity Providers.

QUESTION 52
Universal Containers (UC) has a desktop application to collect leads for marketing campaigns. UC wants to extend this application to integrate with Salesforce to create leads. Integration between the desktop application and Salesforce should be seamless. What Authorization flow should the Architect recommend?

JWT Bearer Token Flow

Web Server Authentication Flow

User Agent Flow

Username and Password Flow

QUESTION 53
Which three capabilities does SAML-based Federated authentication provide? (Choose three.)

Centralized federation provides single point of access, control and auditing.

Access tokens are used to access resources on the server once the user is authenticated.

Web applications with no passwords are more secure and stronger against hacks.

Trust relationships between Identity Provider and Service Provider are required.

SAML tokens can be in XML or JSON format and can be used interchangeably.

QUESTION 54
Universal containers (UC) uses a home-grown employee portal for their employees to collaborate. UC decides to use salesforce ideas to allow the employees to post ideas from the employee portal. When clicking some links in the employee portal, the users should be redirected to salesforce, authenticated, and presented with relevant pages. What scope should be requested when using the Oauth token to meet this requirement?

Web

Full

API

Visualforce

QUESTION 55
Universal Containers (UC) is building an integration between Salesforce and a legacy web applications using the canvas framework. The security for UC has determined that a signed request from Salesforce is not an adequate authentication solution for the Third-Party app. Which two options should the Architect consider for authenticating the third-party app using the canvas framework? Choose 2 Answers

Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC’s IdP.

UtilizeAuthorization Providers to allow the third-party appliction to authenticate itself against Salesforce as the Idp.

Utilize Canvas OAuth flow to allow the third-party appliction to authenticate itself against Salesforce as the Idp.

Create a registration handler Apex class to allow the third-party appliction to authenticate itself against Salesforce as the Idp.

QUESTION 56
Which two are valid choices for digital certificates when setting up two-way SSL between Salesforce and an external system. Choose 2 answers

Use a trusted CA-signed certificate for salesforce and a trusted CA-signed cert for the external system

Use a trusted CA-signed certificate for salesforce and a self-signed cert for the external system

Use a self-signed certificate for salesforce and a self-signed cert for the external system

Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system

QUESTION 57
Universal Containers is using OpenID Connect to enable a connection from their new mobile app to its production Salesforce org.
What should be done to enable the retrieval of the access token status for the OpenID Connect connection?

Query using OpenID Connect discovery endpoint.

A Leverage OpenID Connect Token Introspection.

Create a custom OAuth scope.

Enable cross-origin resource sharing (CORS) for the /services/oauth2/token endpoint.

QUESTION 58
Universal Containers (UC) wants to implement SAML SSO for their internal of Salesforce users using a third-party IdP. After some evaluation, UC decides NOT to 65« set up My Domain for their Salesforce org. How does that decision impact their SSO implementation?

IdP-initiated SSO will NOT work.

Neither SP- nor IdP-initiated SSO will work.

Either SP- or IdP-initiated SSO will work.

SP-initiated SSO will NOT work

QUESTION 59
What item should an Architect consider when designing a Delegated Authentication implementation?

The Web service should be secured with TLS using Salesforce trusted certificates.

The Web service should be able to accept one to four input method parameters.

The web service should use the Salesforce Federation ID to identify the user.

The Web service should implement a custom password decryption method.

QUESTION 60
Universal Containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use Salesforce Ideas and provide the ability for employees to post ideas from the company portal. They use SAML-based SSO to get into the Company portal and would like to leverage it to access Salesforce. Most of the users don’t exist in Salesforce and they would like the user records created in Salesforce Communities the first time they try to access Salesforce.
What recommendation should an Architect make to meet this requirement?

Use Salesforce APIs to create users on the fly.

Use Just-in-Time provisioning.

Use On-the-Fly provisioning.

Use Identity Connect to sync users.

QUESTION 61
Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?

Check the Refresh Token policy defined in the Salesforce Connected App.

Validate that the users are checking the box to remember their passwords.

Verify that the Callback URL is correctly pointing to the new URI Scheme.

Confirm that the access Token’s Time-To-Live policy has been set appropriately.

QUESTION 62
Universal Container’s (UC) is using Salesforce Experience Cloud site for its container wholesale business. The identity architect wants to an authentication provider for the new site.
Which two options should be utilized in creating an authentication provider?
Choose 2 answers

A custom registration handier can be set.

A custom error URL can be set.

The default login user can be set.

The default authentication provider certificate can be set.

QUESTION 63
Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers

Delegated Authentication is enabled or disabled for the entire Salesforce org.

UC will be required to develop and support a custom SOAP web service.

Salesforce users will be locked out of Salesforce if the web service goes down.

The web service must reside on a public cloud service, such as Heroku.