Salesforce Salesforce Certifications IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT Questions & Answers

• Question 151:

  customer service representatives at Universal containers (UC) are complaining that whenever they click on links to case records and are asked to login with SAML SSO, they are being redirected to the salesforce home tab and not the specific case record. What item should an architect advise the identity team at UC to investigate first?

  A. My domain is configured and active within salesforce.

  B. The salesforce SSO settings are using http post

  C. The identity provider is correctly preserving the Relay state

  D. The users have the correct Federation ID within salesforce.

  Correct Answer: C

• Question 152:

  Universal containers (UC) has implemented SAML -based single Sign-on for their salesforce application. UC is using pingfederate as the Identity provider. To access salesforce, Users usually navigate to a bookmarked link to my domain URL. What type of single Sign-on is this?

  A. Sp-Initiated

  B. IDP-initiated with deep linking

  C. IDP-initiated

  D. Web server flow.

  Correct Answer: A

• Question 153:

  How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

  A. Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.

  B. Add the list of company's network IP addresses to the Login Range list under 2FA Setup.

  C. Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.

  D. Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.

  Correct Answer: A

• Question 154:

  Northern Trail Outfitters (NTO) has an existing custom business-to-consumer (B2C) website that does NOT support single sign-on standards, such as Security Assertion Markup Language (SAMi) or OAuth. NTO wants to use Salesforce

  Identity to register and authenticate new customers on the website.

  Which two Salesforce features should an identity architect use in order to provide username/password authentication for the website?

  Choose 2 answers

  A. Identity Connect

  B. Delegated Authentication

  C. Connected Apps

  D. Embedded Login

  Correct Answer: BD

• Question 155:

  An architect needs to set up a Facebook Authentication provider as login option for a salesforce customer Community. What portion of the authentication provider setup associates a Facebook user with a salesforce user?

  A. Consumer key and consumer secret

  B. Federation ID

  C. User info endpoint URL

  D. Apex registration handler

  Correct Answer: D

• Question 156:

  Universal Containers built a custom mobile app for their field reps to create orders in Salesforce. OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained automatically without forcing the user to log in again. While that improved the field reps' productivity, UC realized that they need a "logout" feature.

  What should the logout function perform in this scenario, where user sessions are refreshed automatically?

  A. Invoke the revocation URL and pass the refresh token.

  B. Clear out the client Id to stop auto session refresh.

  C. Invoke the revocation URL and pass the access token.

  D. Clear out all the tokens to stop auto session refresh.

  Correct Answer: A

• Question 157:

  Northern Trail Outfitters (NTO) uses Salesforce for Sales Opportunity Management. Okta was recently brought in to Just-in-Time (JIT) provision and authenticate NTO users to applications. Salesforce users also use Okta to authorize a

  Forecasting web application to access Salesforce records on their behalf.

  Which two roles are being performed by Salesforce?

  Choose 2 answers

  A. SAML Identity Provider

  B. OAuth Client

  C. OAuth Resource Server

  D. SAML Service Provider

  Correct Answer: BD

• Question 158:

  Universal Container's (UC) is using Salesforce Experience Cloud site for its container wholesale business. The identity architect wants to an authentication provider for the new site. Which two options should be utilized in creating an authentication provider? Choose 2 answers

  A. A custom registration handier can be set.

  B. A custom error URL can be set.

  C. The default login user can be set.

  D. The default authentication provider certificate can be set.

  Correct Answer: AB

• Question 159:

  Northern Trail Outfitters is implementing a busmess-to-business (B2B) collaboration site using Salesforce Experience Cloud. The partners will authenticate with an existing identity provider and the solution will utilize Security Assertion Markup Language (SAML) to provide single sign-on to Salesforce. Delegated administration will be used in the Expenence Cloud site to allow the partners to administer their users' access.

  How should a partner identity be provisioned in Salesforce for this solution?

  A. Create only a contact.

  B. Create a contactless user.

  C. Create a user and a related contact.

  D. Create a person account.

  Correct Answer: C

• Question 160:

  The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discuss Salesforce out-of-box capabilities for configuring the company*s login and registration experience on Salesforce Experience

  Cloud.

  The CMO is looking to brand the login page with the company's logo, background color, login button color, and dynamic right-frame from an external URL.

  Which two solutions should the IAM specialist recommend?

  Choose 2 answers

  A. Use Experience Builder to build branded Reset and Forgot Password pages.

  B. Build custom pages for branding requirements in Experience Cloud.

  C. Build custom site pages for reset and forgot password features.

  D. Login and Registration pages can be branded in the Community Administration settings.

  Correct Answer: AD