Identity-and-Access-Management-Architect best practice

(2022) PASS Identity-and-Access-Management-Architect exam with Salesforce Identity-and-Access-Management-Architect Real Exam Questions

Real exam questions are provided for Identity and Access Management Designer tests, which can make sure you 100% pass

Q142. Which three different attributes can be used to identify the user in a SAML 65> assertion when Salesforce is acting as a Service Provider? Choose 3 answers

Federation ID

Salesforce User ID

User Full Name

User Email Address

Salesforce Username

Q143. Universal Containers wants to implement Single Sign-on for a Salesforce org using an external Identity Provider and corporate identity store.
What type of authentication flow is required to support deep linking’

Web Server OAuth SSO flow

Service-Provider-Initiated SSO

Identity-Provider-initiated SSO

StartURL on Identity Provider

Q144. Universal Containers (UC) has an existing web application that it would like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?

Create a Canvas app and use Signed Requests to authenticate the users.

Rewrite the web application as a set of Visualforce pages and Apex code.

Configure the web application as an item in the Salesforce App Launcher.

Add the web application as a ConnectedApp using OAuth User-Agent flow.

Q145. An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM do to fulfill this requirement?

Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.

Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.

Create a default account for capturing all ecommerce contacts registered on the community because personAccount is not supported for this case.

Confirm performance considerations with Salesforce Customer Support due to high peaks.

Q146. Universal containers (UC) has implemented SAML SSO to enable seamless access across multiple applications. UC has regional salesforce orgs and wants it’s users to be able to access them from their main Salesforce org seamless. Which action should an architect recommend?

Configure the main salesforce org as an Authentication provider.

Configure the main salesforce org as the Identity provider.

Configure the regional salesforce orgs as Identity Providers.

Configure the main Salesforce org as a service provider.

Q147. Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers

Resource deep linking

App launcher

SSO from salesforce1 mobile app.

Q148. A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropriate way to generate sensor Information In Salesforce.
Which OAuth flow should the architect recommend?

OAuth 2.0 Asset Token Flow

OAuth 2.0 Device Authentication Row

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 SAML Bearer Assertion Flow

Q149. Universal containers (UC) has a mobile application that it wants to deploy to all of its salesforce users, including customer Community users. UC would like to minimize the administration overhead, which two items should an architect recommend? Choose 2 answers

Enable the “Refresh Tokens is valid until revoked ” setting in the Connected App.

Enable the “Enforce Ip restrictions” settings in the connected App.

Enable the “All users may self-authorize” setting in the Connected App.

Enable the “High Assurance session required” setting in the Connected App.

Q150. architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct. Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers

The Identity Provider is also used to SSO into five other applications.

The clock on the Identity Provider server is twenty minutes behind Salesforce.

The Issuer Certificate from the Identity Provider expired two weeks ago.

The default language for the Identity Provider and Salesforce are Different.

Q151. Universal Containers (UC) has an e-commerce website where customers can buy products, make payments and manage their accounts. UC decides to build a Customer Community on Salesforce and wants to allow the customers to access the community from their accounts without logging in again. UC decides to implement an SP-initiated SSO using a SAML-compliant Idp. In this scenario where Salesforce is the Service Provider, which two activities must be performed in Salesforce to make SP-initiated SSO work? Choose 2 answers

Configure SAML SSO settings.

Create a Connected App.

Configure Delegated Authentication.

Set up My Domain.

Q152. Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce?
Choose 2 answers

Users leaving laptops unattended and not logging out of Salesforce.

Users accessing Salesforce from a public Wi-Fi access point.

Users choosing passwords that are the same as their Facebook password.

Users creating simple-to-guess password reset questions.

Q153. Northern Trail Outfitters recently acquired a company. Each company will retain its Identity Provider (IdP).
Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.
How should the combined companys’ employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?

Configure unique MyDomains for each company and have generated links use the appropriate MyDomam in the URL.

Have generated links append a querystnng parameter indicating the IdP. The login service will redirect to the appropriate IdP.

Have generated links be prefixed with the appropriate IdP URL to invoke an IdP-initiated Security Assertion Markup Language flow when clicked.

Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.

Q154. In an SP-Initiated SAML SSO setup where the user tries to access a resource on the Service Provider, What HTTP param should be used when submitting a SAML Request to the Idp to ensure the user is returned to the intended resourse after authentication?

RedirectURL

RelayState

DisplayState

StartURL

Q155. Northern Trail Outfitters wants to implement a partner community. Active community users will need to review and accept the community rules, and update key contact information for each community member before their annual partner event.
Which approach will meet this requirement?

Create tasks for users who need to update their data or accept the new community rules.

Create a custom landing page and email campaign asking all community members to login and verify their data.

Create a login flow that conditionally prompts users who have not accepted the new community rules and who have missing or outdated information.

Add a banner to the community Home page asking users to update their profile and accept the new community rules.

Q156. A global company’s Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) ‘Replay Detected and Assertion Invalid’ login errors.
Which two issues would cause these errors?
Choose 2 answers

The subject element is missing from the assertion sent to salesforce.

The certificate loaded into SSO configuration does not match the certificate used by the IdP.

The current time setting of the company’s identity provider (IdP) and Salesforce platform is out of sync by more than eight minutes.

The assertion sent to 5alesforce contains an assertion ID previously used.

Q157. Universal Containers is implementing Salesforce Identity to broker authentication from its enterprise single sign-on (SSO) solution through Salesforce to third party applications using SAML.
What rote does Salesforce Identity play in its relationship with the enterprise SSO system?

Identity Provider (IdP)

Resource Server

Service Provider (SP)

Client Application

Q158. Universal containers (UC) has decided to use identity connect as it’s identity provider. UC uses active directory(AD) and has a team that is very familiar and comfortable with managing ad groups. UC would like to use AD groups to help configure salesforce users. Which three actions can AD groups control through identity connect? Choose 3 answers

Public Group Assignment

Granting report folder access

Role Assignment

Custom permission assignment

Permission sets assignment

Q159. Universal containers (UC) is setting up their customer Community self-registration process. They are uncomfortable with the idea of assigning new users to a default account record. What will happen when customers self-register in the community?

The self-registration process will produce an error to the user.

The self-registration page will ask user to select an account.

The self-registration process will create a person Account record.

The self-registration page will create a new account record.

Q160. Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless expenence. The third-party employee portal only supports OAuth.
What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

Configure SSO to use the third party portal as an identity provider.

Create a custom external authentication provider.

Add the third-party portal as a connected app.

Configure Salesforce for Delegated Authentication.

Q161. Universal Containers would like its customers to register and log in to a portal built on Salesforce Experience Cloud. Customers should be able to use their Facebook or Linkedln credentials for ease of use.
Which three steps should an identity architect take to implement social sign-on?
Choose 3 answers

Create authentication providers for both Facebook and Linkedln.

Check “Facebook” and “Linkedln” under Login Page Setup.

Enable “Federated Single Sign-On Using SAML”.

Update the default registration handlers to create and update users.

Q162. Universal Containers (UC) has built a custom time tracking app for its employee. UC wants to leverage Salesforce Identity to control access to the custom app.
At a minimum, which Salesforce license is required to support this requirement?

Identity Verification

Identity Connect

Identity Only

External Identity

Q163. Universal containers (UC) has implemented ansp-Initiated SAML flow between an external IDP and salesforce. A user at UC is attempting to login to salesforce1 for the first time and is being prompted for salesforce credentials instead of being shown the IDP login page. What is the likely cause of the issue?

The “Redirect to Identity Provider” option has been selected in the my domain configuration.

The user has not configured the salesforce1 mobile app to use my domain for login

The “Redirect to identity provider” option has not been selected the SAML configuration.

The user has not been granted the “Enable single Sign-on” permission

Q164. Northern Trail Outfitters (NTO) has an existing custom business-to-consumer (B2C) website that does NOT support single sign-on standards, such as Security Assertion Markup Language (SAMi) or OAuth. NTO wants to use Salesforce Identity to register and authenticate new customers on the website.
Which two Salesforce features should an identity architect use in order to provide username/password authentication for the website?
Choose 2 answers

Identity Connect

Delegated Authentication

Connected Apps

Embedded Login

Q165. How should an identity architect automate provisioning and deprovisioning of users into Salesforce from an external system?

Call SOAP API upsertQ on user object.

Use Security Assertion Markup Language Just-in-Time (SAML JIT) on incoming SAML assertions.

Run registration handler on incoming OAuth responses.

Call OpenID Connect (OIDC)-userinfo endpoint with a valid access token.

Salesforce Identity-and-Access-Management-Architect Exam Syllabus Topics:

Topic	Details
Topic 1	Given a scenario, describe what tools you can apply to audit and verify the activity user during and after login Describe how trust is established between two systems
Topic 2	Describe common authentication patterns and understand the differences between each one Given a scenario, identify the configuration settings for a Connected app
Topic 3	Given a scenario, recommend appropriate Scope and Configuration of the connected App for Authorization Given a scenario, determine when to use embedded login
Topic 4	Identify the ways that users can be provisioned in Salesforce to enable SSO and apply access rights Identify the auditing and monitoring approaches available on the platform
Topic 5	Given a scenario identify if Salesforce Customer 360 Identity fits into a fully developed Customer 360 solution Given a use case, describe when Salesforce is used as a Service Provider
Topic 6	Troubleshoot common points of failure that may be encountered in a single sign-on solution Describe the tools that are available to diagnose IdP issues
Topic 7	Given a scenario, recommend the most appropriate way to provision users from identity stores in B2E and B2C scenarios Recommend the appropriate method for provisioning users in Salesforce

Latest Identity-and-Access-Management-Architect Pass Guaranteed Exam Dumps Certification Sample Questions: https://www.prepawayexam.com/Salesforce/braindumps.Identity-and-Access-Management-Architect.ete.file.html

Prepaway Exam Dumps

Tag: Identity-and-Access-Management-Architect best practice

(2022) PASS Identity-and-Access-Management-Architect exam with Salesforce Identity-and-Access-Management-Architect Real Exam Questions [Q142-Q165]

Salesforce Identity-and-Access-Management-Architect Exam Syllabus Topics:

Tag Archives: Identity-and-Access-Management-Architect best practice

Salesforce Identity-and-Access-Management-Architect Exam Syllabus Topics: