Salesforce Salesforce Certifications IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT Questions & Answers

• Question 131:

  Universal Containers (UC) wants to use Salesforce for sales orders and a legacy of system for order fulfillment. The legacy system must update the status of orders in 65* Salesforce in real time as they are fulfilled. UC decides to use OAuth for connecting the legacy system to Salesforce. What OAuth flow should be considered that doesn't require storing credentials, client secret or refresh tokens?

  A. Web Server flow

  B. JWT Bearer Token flow

  C. Username-Password flow

  D. User Agent flow

  Correct Answer: B

• Question 132:

  Universal containers (UC) is concerned that having a self-registration page will provide a means for "bots" or unintended audiences to create user records, thereby consuming licences and adding dirty data. Which two actions should UC take to prevent unauthorised form submissions during the self-registration process? Choose 2 answers

  A. Use open-ended security questions and complex password requirements

  B. Primarily use lookup and picklist fields on the self registration page.

  C. Require a captcha at the end of the self-registration process.

  D. Use hidden fields populated via java script events in the self-registration page.

  Correct Answer: CD

• Question 133:

  Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers

  A. Resource deep linking

  B. App launcher

  C. SSO from salesforce1 mobile app.

  D. Login forensics

  Correct Answer: AC

• Question 134:

  Universal Containers (UC) has built a custom time tracking app for its employee. UC wants to leverage Salesforce Identity to control access to the custom app.

  At a minimum, which Salesforce license is required to support this requirement?

  A. Identity Verification

  B. Identity Connect

  C. Identity Only

  D. External Identity

  Correct Answer: C

• Question 135:

  Northern Trail Outfitters (NTO) is setting up Salesforce to authenticate users with an external identity provider. The NTO Salesforce Administrator is having trouble getting things setup.

  What should an identity architect use to show which part of the login assertion is fading?

  A. SAML Metadata file importer

  B. Identity Provider Metadata download

  C. Connected App Manager

  D. Security Assertion Markup Language Validator

  Correct Answer: D

• Question 136:

  Universal Containers (UC) is planning to add Wi-Fi enabled GPS tracking devices to its shipping containers so that the GPS coordinates data can be sent from the tracking device to its Salesforce production org via a custom API. The GPS devices have no direct user input or output capabilities.

  Which OAuth flow should the identity architect recommend to meet the requirement?

  A. OAuth 2.0 Asset Token Flow for Securing Connected Devices

  B. OAuth 2.0 Username-Password Flow for Special Scenarios

  C. OAuth 2.0 Web Server Flow for Web App Integration

  D. OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration

  Correct Answer: A

• Question 137:

  Universal Containers (UC) has decided to use Salesforce as an Identity Provider for multiple external applications. UC wants to use the salesforce App Launcher to control the Apps that are available to individual users. Which three steps are required to make this happen?

  A. Add each connected App to the App Launcher with a Start URL.

  B. Set up an Auth Provider for each External Application.

  C. Set up Salesforce as a SAML Idp with My Domain.

  D. Set up Identity Connect to Synchronize user data.

  E. Create a Connected App for each external application.

  Correct Answer: ACE

• Question 138:

  A technology enterprise is setting up an identity solution with an external vendors wellness application for its employees. The user attributes need to be returned to the wellness application in an ID token.

  Which authentication mechanism should an identity architect recommend to meet the requirements?

  A. OpenID Connect

  B. User Agent Flow

  C. JWT Bearer Token Flow

  D. Web Server Flow

  Correct Answer: D

• Question 139:

  Universal containers (UC) uses a home-grown employee portal for their employees to collaborate. UC decides to use salesforce ideas to allow the employees to post ideas from the employee portal. When clicking some links in the employee portal, the users should be redirected to salesforce, authenticated, and presented with relevant pages. What scope should be requested when using the Oauth token to meet this requirement?

  A. Web

  B. Full

  C. API

  D. Visualforce

  Correct Answer: A

• Question 140:

  Northern Trail Outfitters recently acquired a company. Each company will retain its Identity Provider (IdP). Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.

  How should the combined companys' employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?

  A. Configure unique MyDomains for each company and have generated links use the appropriate MyDomam in the URL.

  B. Have generated links append a querystnng parameter indicating the IdP. The login service will redirect to the appropriate IdP.

  C. Have generated links be prefixed with the appropriate IdP URL to invoke an IdP-initiated Security Assertion Markup Language flow when clicked.

  D. Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.

  Correct Answer: D