Salesforce Identity and Access Management Designer Certification Identity-and-Access-Management-Designer Sample Questions Reliable [Q117-Q133]

5/5 - (1 vote)

Salesforce Identity and Access Management Designer Certification Identity-and-Access-Management-Designer Sample Questions Reliable

Prepare for the Actual Salesforce Identity and Access Management Designer Identity-and-Access-Management-Designer Exam Practice Materials Collection

Salesforce Identity-and-Access-Management-Designer exam is designed to test your knowledge and skills in managing access and security within the Salesforce platform. Salesforce Certified Identity and Access Management Designer certification is intended for professionals who are responsible for designing, implementing, and maintaining complex identity and access management systems in Salesforce. By passing Identity-and-Access-Management-Designer exam, you can demonstrate your expertise in creating secure and efficient solutions that meet the unique needs of your organization.

NO.117 In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?

Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.

Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA

Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.

Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.

NO.118 Universal Containers (UC) would like to enable SAML-based SSO for a Salesforce Partner Community. UC has an existing LDAP identity store and a third-party portal. They would like to use the existing portal as the primary site these users access, but also want to allow seamless access to the Partner Community.
What SSO flow should an Architect recommend?

IdP-Initiated

SP-Initiated

User-Agent

Web Server

NO.119 architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct. Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers

The Identity Provider is also used to SSO into five other applications.

The clock on the Identity Provider server is twenty minutes behind Salesforce.

The Issuer Certificate from the Identity Provider expired two weeks ago.

The default language for the Identity Provider and Salesforce are Different.

NO.120 After a recent audit, universal containers was advised to implement Two-factor Authentication for all of their critical systems, including salesforce. Which two actions should UC consider to meet this requirement?
Choose 2 answers

Require users to provide their RSA token along with their credentials.

Require users to supply their email and phone number, which gets validated.

Require users to enter a second password after the first Authentication

Require users to use a biometric reader as well as their password

NO.121 Universal Containers (UC) uses Salesforce to allow customers to keep track of the order status. The customers can log in to Salesforce using external authentication providers, such as Facebook and Google.
UC is also leveraging the App Launcher to let customers access an off-platform application for generating shipping labels. The label generator application uses OAuth to provide users access.
What license type should an Architect recommend for the customers?

External Identity license

Identity license

Customer Community license

Customer Community Plus license

NO.122 Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow the employees to post ideas from the Employee portal. When clicking some links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with relevant pages.
What scope should be requested when using the OAuth token to meet this requirement?

web

api

Visualforce

full

NO.123 A real estate company wants to provide its customers a digital space to design their interior decoration options. To simplify the registration to gain access to the community site (built in Experience Cloud), the CTO has requested that the IT/Development team provide the option for customers to use their existing social-media credentials to register and access.
The IT lead has approached the Salesforce Identity and Access Management (IAM) architect for technical direction on implementing the social sign-on (for Facebook, Twitter, and a new provider that supports standard OpenID Connect (OIDC)).
Which two recommendations should the Salesforce IAM architect make to the IT Lead?
Choose 2 answers

Use declarative registration handler process builder/flow to create, update users and contacts.

Authentication provider configuration is required each social sign-on providers; and enable Authentication providers in community.

For supporting OIDC it is necessary to enable Security Assertion Markup Language (SAML) with Just-in-Time provisioning (JIT) and OAuth 2.0.

Apex coding skills are needed for registration handler to create and update users.

NO.124 Universal containers (UC) has decided to use identity connect as it’s identity provider. UC uses active directory(AD) and has a team that is very familiar and comfortable with managing ad groups. UC would like to use AD groups to help configure salesforce users. Which three actions can AD groups control through identity connect? Choose 3 answers

Public Group Assignment

Granting report folder access

Role Assignment

Custom permission assignment

Permission sets assignment

NO.125 Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC’s security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?

Include client ID and client secret in the login header callout.

Set up a proxy server for the login service in the DMZ.

Require the use of Salesforce security Tokens on password.

Enforce mutual Authentication between systems using SSL.

NO.126 Universal Containers (UC) is building an authenticated Customer Community for its customers. UC does not want customer credentials stored in Salesforce and is confident its customers would be willing to use their social media credentials to authenticate to the community. Which two actions should an Architect recommend UC to take?

Use Delegated Authentication to call the Twitter login API to authenticate users.

Configure an Authentication Provider for LinkedIn Social Media Accounts.

Create a Custom Apex Registration Handler to handle new and existing users.

Configure SSO Settings For Facebook to serve as a SAML Identity Provider.

NO.127 Universal Containers (UC) is setting up delegated authentication to allow employees to log in using their corporate credentials. UC’s security team is concerned about the risks of exposing the corporate login service on the internet and has asked that a reliable trust mechanism be put in place between the login service and Salesforce.
What mechanism should an Architect put in place to enable a trusted connection between the login service and Salesforce?

Require the use of Salesforce security tokens on passwords.

Enforce mutual authentication between systems using SSL.

Include Client Id and Client Secret in the login header callout.

Set up a proxy service for the login service in the DMZ.

NO.128 Containers (UC) has an existing Customer Community. UC wants to expand the self-registration capabilities such that customers receive a different community experience based on the data they provide during the registration process. What is the recommended approach an Architect Should recommend to UC?

Create an After Insert Apex trigger on the user object to assign specific custom permissions.

Create separate login flows corresponding to the different community user personas.

Modify the Community pages to utilize specific fields on the User and Contact records.

Modify the existing Communities registration controller to assign different profiles.

NO.129 Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.
What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.

Build an integration that queries LDAP periodically and creates new active users in Salesforce.

Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at

NO.130 Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless expenence. The third-party employee portal only supports OAuth.
What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

Configure SSO to use the third party portal as an identity provider.

Create a custom external authentication provider.

Add the third-party portal as a connected app.

Configure Salesforce for Delegated Authentication.

NO.131 Northern Trail Outfitters manages application functional permissions centrally as Active Directory groups. The CRM_Superllser and CRM_Reportmg_SuperUser groups should respectively give the user the SuperUser and Reportmg_SuperUser permission set in Salesforce. Salesforce is the service provider to a Security Assertion Markup Language (SAML) identity provider.
Mow should an identity architect ensure the Active Directory groups are reflected correctly when a user accesses Salesforce?

Use the Apex Just-in-Time handler to query standard SAML attributes and set permission sets.

Use the Apex Just-in-Time handler to query custom SAML attributes and set permission sets.

Use a login flow to query custom SAML attributes and set permission sets.

Use a login flow to query standard SAML attributes and set permission sets.

NO.132 Containers (UC) has implemented SAML-based single Sign-on for their Salesforce application and is planning to provide access to Salesforce on mobile devices using the Salesforce1 mobile app. UC wants to ensure that Single Sign-on is used for accessing the Salesforce1 mobile App. Which two recommendations should the Architect make? Choose 2 Answers

Configure the Embedded Web Browser to use My Domain URL.

Configure the Salesforce1 App to use the MY Domain URL.

Use the existing SAML-SSO flow along with User Agent Flow.

Use the existing SAML SSO flow along with Web Server Flow.

NO.133 Universal Containers (UC) has implemented SAML-based Single Sign-on for their Salesforce application and is planning to use the Salesforce mobile app. UC wants to ensure that Single Sign-on is used for accessing the Salesforce mobile app.
Which two recommendations should the Architect make? (Choose two.)

Configure the Salesforce App to use the My Domain URL.

Use the existing SAML SSO flow along with Web Server Flow.

Configure the Embedded Web Browser to use My Domain URL.

Use the existing SAML SSO flow along with User Agent Flow.