[May 18, 2023] Identity-and-Access-Management-Architect Exam Dumps, Identity-and-Access-Management-Architect Practice Test Questions [Q23-Q45]

5/5 - (1 vote)

[May 18, 2023] Identity-and-Access-Management-Architect Exam Dumps, Identity-and-Access-Management-Architect Practice Test Questions

Free Identity-and-Access-Management-Architect Study Guides Exam Questions and Answer

The Salesforce Certified Identity and Access Management Architect certification is an excellent choice for professionals who want to build their expertise in identity and access management, and help organizations build secure and scalable systems. With the right preparation and dedication, candidates can pass this exam and earn this valuable certification.

The Salesforce Identity-and-Access-Management-Architect Exam is a certification test for individuals who wish to demonstrate their expertise in the field of identity and access management within the Salesforce ecosystem. This certification is designed for professionals who have experience in designing, implementing, and managing identity and access management solutions using the Salesforce platform.

QUESTION 23
Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Amazon credentials.
What should an identity architect recommend to meet these requirements?

Configure a predefined authentication provider for Amazon.

Create a custom external authentication provider for Amazon.

Configure an OpenID Connect Authentication Provider for Amazon.

Configure Amazon as a connected app.

QUESTION 24
Universal Containers (UC) operates in Asia, Europe and North America regions. There is one Salesforce org for each region. UC is implementing Customer 360 in Salesforce and has procured External Identity and Customer Community licenses in all orgs.
Customers of UC use Community to track orders and create inquiries. Customers also tend to move across regions frequently.
What should an identity architect recommend to optimize license usage and reduce maintenance overhead?

Merge three orgs into one instance of Salesforce. This will no longer require maintaining three separate copies of the same customer.

Delete contact/ account records and deactivate user if user moves from a specific region; Sync will no longer be required.

Contacts are required since Community access needs to be enabled. Maintenance is a necessary overhead that must be handled via data integration.

Enable Contactless User in all orgs and downgrade users from Experience Cloud license to External Identity license once users have moved out of that region.

QUESTION 25
Universal Containers (UC) is building a custom Innovation platform on their Salesforce instance. The Innovation platform will be written completely in Apex and Visualforce and will use custom objects to store the Data. UC would like all users to be able to access the system without having to log in with Salesforce credentials. UC will utilize a third-party idp using SAML SSO. What is the optimal Salesforce licence type for all of the UC employees?

Identity Licence.

Salesforce Licence.

External Identity Licence.

Salesforce Platform Licence.

QUESTION 26
Universal Containers (UC) wants to integrate a third-party Reward Calculation system with Salesforce to calculate Rewards. Rewards will be calculated on a schedule basis and update back into Salesforce. The integration between Salesforce and the Reward Calculation System needs to be secure. Which are two recommended practices for using OAuth flow in this scenario. choose 2 answers

OAuth Refresh Token FLow

OAuth Username-Password Flow

OAuth SAML Bearer Assertion FLow

OAuth JWT Bearer Token FLow

QUESTION 27
Universal containers(UC) has a customer Community that uses Facebook for authentication. UC would like to ensure that changes in the Facebook profile are reflected on the appropriate customer Community user. How can this requirement be met?

Use the updateuser() method on the registration handler class.

Use SAML just-in-time provisioning between Facebook and Salesforce

Use information in the signed request that is received from Facebook.

Develop a schedule job that calls out to Facebook on a nightly basis.

QUESTION 28
How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

Use Custom Login Flows with Apex to detect the user’s IP address and prompt for 2FA if needed.

Add the list of company’s network IP addresses to the Login Range list under 2FA Setup.

Use an Apex Trigger on the UserLogin object to detect the user’s IP address and prompt for 2FA if needed.

Apply the “Two-factor Authentication for User Interface Logins” permission and Login IP Ranges for all Profiles.

QUESTION 29
Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce?
Choose 2 answers

Enable My Domain and select “Prevent login from https://login.salesforce.com”.

Request Salesforce Support to enable delegated authentication.

Once SSO is enabled, users are only able to login using Salesforce credentials.

Assign user “is Single Sign-on Enabled” permission via profile or permission set.

QUESTION 30
Universal Containers (UC) is using Active Directory as its corporate identity provider and Salesforce as its CRM for customer care agents, who use SAML based sign sign-on to login to Salesforce. The default agent profile does not include the Manage User permission. UC wants to dynamically update the agent role and permission sets.
Which two mechanisms are used to provision agents with the appropriate permissions?
Choose 2 answers

Use Login Flow in User Context to update role and permission sets.

Use Login Flow in System Context to update role and permission sets.

Use SAML Just-m-Time (JIT) Handler class run as current user to update role and permission sets.

Use SAML Just-in-Time (JIT) handler class run as an admin user to update role and permission sets.

QUESTION 31

A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.
The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company’s on-premise application endpoint.
What should an Identity architect do to meet this requirement?

Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

Configure the company firewall to allow traffic from Salesforce IP ranges.

Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

Upload a third-party certificate from Salesforce into the on-premise server.

QUESTION 32
Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC’s security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?

Include client ID and client secret in the login header callout.

Set up a proxy server for the login service in the DMZ.

Require the use of Salesforce security Tokens on password.

Enforce mutual Authentication between systems using SSL.

QUESTION 33
Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would like to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to achieve the goal?

Access Tokens

Mobile pins

Refresh Tokens

Scopes

QUESTION 34
Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow employees to post Ideas from the Employee portal. When users click on some of the links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with the relevant pages. What OAuth flow is best suited for this scenario?

Web Application flow

SAML Bearer Assertion flow

User-Agent flow

Web Server flow

QUESTION 35
An architect has successfully configured SAML-BASED SSO for universal containers. SSO has been working for 3 months when Universal containers manually adds a batch of new users to salesforce. The new users receive an error from salesforce when trying to use SSO. Existing users are still able to successfully use SSO to access salesforce. What is the probable cause of this behaviour?

The administrator forgot to reset the new user’s salesforce password.

The Federation ID field on the new user records is not correctly set

The my domain capability is not enabled on the new user’s profile.

The new users do not have the SSO permission enabled on their profiles.

QUESTION 36
Universal containers (UC) has built a custom based Two-factor Authentication (2fa) system for their existing on-premise applications. Thru are now implementing salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution an architect should consider?

Replace the custom 2fa system with salesforce 2fa for on-premise application and salesforce.

Use the custom 2fa system for on-premise applications and native 2fa for salesforce.

Replace the custom 2fa system with an app exchange app that supports on-premise applications and salesforce.

Use custom login flows to connect to the existing custom 2fa system for use in salesforce.

QUESTION 37
architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct. Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers

The Identity Provider is also used to SSO into five other applications.

The clock on the Identity Provider server is twenty minutes behind Salesforce.

The Issuer Certificate from the Identity Provider expired two weeks ago.

The default language for the Identity Provider and Salesforce are Different.

QUESTION 38
Northern Trail Outfitters (NTO) leverages Microsoft Active Directory (AD) for management of employee usernames, passwords, permissions, and asset access. NTO also owns a third-party single sign-on (SSO) solution. The third-party party SSO solution is used for all corporate applications, including Salesforce.
NTO has asked an architect to explore Salesforce Identity Connect for automatic provisioning and deprovisiorung of users in Salesforce.
What role does identity Connect play in the outlined requirements?

Service Provider

Single Sign-On

Identity Provider

User Management

QUESTION 39
An architect needs to set up a Facebook Authentication provider as login option for a salesforce customer Community. What portion of the authentication provider setup associates a Facebook user with a salesforce user?

Consumer key and consumer secret

Federation ID

User info endpoint URL

Apex registration handler

QUESTION 40
Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?

Check the Refresh Token policy defined in the Salesforce Connected App.

Validate that the users are checking the box to remember their passwords.

Verify that the Callback URL is correctly pointing to the new URI Scheme.

Confirm that the access Token’s Time-To-Live policy has been set appropriately.

QUESTION 41
Universal Containers (UC) has a desktop application to collect leads for marketing campaigns. UC wants to extend this application to integrate with Salesforce to create leads. Integration between the desktop application and Salesforce should be seamless. What Authorization flow should the Architect recommend?

JWT Bearer Token Flow

Web Server Authentication Flow

User Agent Flow

Username and Password Flow

QUESTION 42
After a recent audit, universal containers was advised to implement Two-factor Authentication for all of their critical systems, including salesforce. Which two actions should UC consider to meet this requirement?
Choose 2 answers

Require users to provide their RSA token along with their credentials.

Require users to supply their email and phone number, which gets validated.

Require users to enter a second password after the first Authentication

Require users to use a biometric reader as well as their password

QUESTION 43
Universal containers (UC) is building a mobile application that will make calls to the salesforce REST API.
Additionally UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes should UC configure in the connected App? Choose 2 answers

Refresh token

API

full

Web

QUESTION 44
Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO’s Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

Configure an authentication provider to delegate authentication to the LDAP directory.

use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

QUESTION 45
Universal Containers built a custom mobile app for their field reps to create orders in Salesforce. OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained automatically without forcing the user to log in again. While that improved the field reps’ productivity, UC realized that they need a “logout” feature.
What should the logout function perform in this scenario, where user sessions are refreshed automatically?

Invoke the revocation URL and pass the refresh token.

Clear out the client Id to stop auto session refresh.

Invoke the revocation URL and pass the access token.

Clear out all the tokens to stop auto session refresh.