[2023] Identity-and-Access-Management-Architect Exam Dumps, Test Engine Practice Test Questions
Pass Identity-and-Access-Management-Architect exam [Feb 12, 2023] Updated 245 Questions
NEW QUESTION 41
Universal containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers
- A. Disallow the use of single Sign-on for any users of the mobile app.
- B. Use Google Authenticator as an additional part of the logical processes.
- C. Require high assurance sessions in order to use the connected App
- D. Set login IP ranges to the internal network for all of the app users profiles.
Answer: B,C
NEW QUESTION 42
Universal Containers (UC) has a Customer Community that uses Facebook for Authentication. UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user:
How can this requirement be met?
- A. Use the updateUser method on the registration Handler Class.
- B. Use information in the signed Request that is received from facebook.
- C. Develop a scheduled job that calls out to Facebook on a nightly basis.
- D. Use SAML Just-In-Time Provisioning between Facebook and Salesforce.
Answer: A
NEW QUESTION 43
Northern Trail Outfitters (NTO) uses the Customer 360 Platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information.
What is the potential impact to the architecture if NTO decides to implement this feature?
- A. Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.
- B. Passwordless authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record.
- C. If contactless user is upgraded to Community license, the contact record is automatically created and linked to the user record, but not associated with an Account.
- D. Custom registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.
Answer: A
NEW QUESTION 44
Uwversal Containers (UC) is building a custom employee hut) application on Amazon Web Services (AWS) and would like to store their users' credentials there. Users will also need access to Salesforce for internal operations. UC has tasked an identity architect with evaluating Afferent solutions for authentication and authorization between AWS and Salesforce.
How should an identity architect configure AWS to authenticate and authorize Salesforce users?
- A. Create a custom external authentication provider.
- B. Develop a custom Auth server in AWS.
- C. Configure AWS as an OpenID Connect Provider.
- D. Configure the custom employee app as a connected app.
Answer: C
NEW QUESTION 45
A Salesforce customer is implementing Sales Cloud and a custom pricing application for its call center agents.
An Enterprise single sign-on solution is used to authenticate and sign-in users to all applications. The customer has the following requirements:
1. The development team has decided to use a Canvas app to expose the pricing application to agents.
2. Agents should be able to access the Canvas app without needing to log in to the pricing application.
Which two options should the identity architect consider to provide support for the Canvas app to initiate login for users?
Choose 2 answers
- A. Configure the Canvas app as a connected app and set Admin-approved users as pre-authorized.
- B. Select "Enable as a Canvas Personal App" in the connected app settings.
- C. Enable OAuth settings in the connected app with required OAuth scopes for the pricing application.
- D. Enable SAML in the connected app and Security Assertion Markup Language (SAML) Initiation Method as Service Provider Initiated.
Answer: A,D
NEW QUESTION 46
A financial services company uses Salesforce and has a compliance requirement to track information about devices from which users log in. Also, a Salesforce Security Administrator needs to have the ability to revoke the device from which users log in.
What should be used to fulfill this requirement?
- A. Use the Activations feature to meet the compliance requirement to track device information.
- B. Use the Login History object to track information about devices from which users log in.
- C. Use multi-factor authentication (MFA) to meet the compliance requirement to track device information.
- D. Use Login Flows to capture device from which users log in and store device and user information in a custom object.
Answer: A
NEW QUESTION 47
Northern Trail Outfitters (NTO) uses Salesforce for Sales Opportunity Management. Okta was recently brought in to Just-in-Time (JIT) provision and authenticate NTO users to applications. Salesforce users also use Okta to authorize a Forecasting web application to access Salesforce records on their behalf.
Which two roles are being performed by Salesforce?
Choose 2 answers
- A. SAML Identity Provider
- B. OAuth Client
- C. SAML Service Provider
- D. OAuth Resource Server
Answer: B,C
NEW QUESTION 48
Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.
What should an identity architect do to fulfill this requirement?
- A. Contact Salesforce Support and enable delegate single sign-on.
- B. Create a custom external authentication provider.
- C. Configure OpenID Connect authentication provider.
- D. Use certificate-based authentication.
Answer: B
NEW QUESTION 49
Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process. Which two considerations should an architect point out to UC? Choose 2 answers
- A. The flow will not provide an Oauth refresh token back to the server.
- B. The flow involves passing the user credentials back and forth.
- C. The web application should be hosted on a secure server.
- D. The web server must be able to protect consumer privacy
Answer: C,D
NEW QUESTION 50
A financial enterprise is planning to set up a user authentication mechanism to login to the Salesforce system.
Due to regulatory requirements, the CIO of the company wants user administration, including passwords and authentication requests, to be managed by an external system that is only accessible via a SOAP webservice.
Which authentication mechanism should an identity architect recommend to meet the requirements?
- A. OAuth Web-Server Flow
- B. Just-in-Time Provisioning
- C. Delegated Authentication
- D. Identity Connect
Answer: C
NEW QUESTION 51
Universal containers uses an Employee portal for their employees to collaborate. employees access the portal from their company's internal website via SSO. It is set up to work with Active Directory. What is the role of Active Directory in this scenario?
- A. Service provider
- B. Identity store
- C. Identity provider
- D. Authentication store
Answer: C
NEW QUESTION 52
Universal Containers (UC) wants to build a custom mobile app for their field reps to create orders in salesforce. After the first time the users log in, they must be able to access salesforce upon opening the mobile app without being prompted to log in again. What Oauth flows should be considered to support this requirement?
- A. Mobile Agent flow with a Bearer Token.
- B. User Agent flow with a Refresh Token.
- C. Web Server flow with a Refresh Token.
- D. SAML Assertion flow with a Bearer Token.
Answer: B
NEW QUESTION 53
Universal Containers (UC) wants to build a few applications that leverage the Salesforce REST API. UC has asked its Architect to describe how the API calls will be authenticated to a specific user. Which two mechanisms can the Architect provide? Choose 2 Answers
- A. Session ID
- B. Refresh Token
- C. Authentication Token
- D. Access Token
Answer: B,D
NEW QUESTION 54
Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post their ideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decides to use an API user using Oauth Username - password flow for the connection. How can the connection to salesforce be restricted only to the employee portal server?
- A. Add the Employee portals IP address to the Trusted IP range for the connected App
- B. Use a dedicated profile for the user the Employee portal uses.
- C. Add the employee portals IP address to the login IP range on the user profile.
- D. Use a digital certificate signed by the employee portal Server.
Answer: A
NEW QUESTION 55
Northern Trail Outfitters (NTO) is planning to implement a community for its customers using Salesforce Experience Cloud . Customers are not able to self-register. NTO would like to have customers set their own passwords when provided access to the community.
Which two recommendations should an identity architect make to fulfill this requirement?
Choose 2 answers
- A. Enable Welcome emails while configuring the Experience Cloud site.
- B. Allow Password reset using the API to update Experience Cloud site membership.
- C. Use Login Flows to allow users to reset password in Experience Cloud site.
- D. Add customers as contacts and add them to Experience Cloud site.
Answer: B,C
NEW QUESTION 56
Northern Trail Outfitters would like to automatically create new employee users in Salesforce with an appropriate profile that maps to its Active Directory Department.
How should an identity architect implement this requirement?
- A. Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.
- B. Make a callout during the login flow to query department from Active Directory to assign the appropriate profile.
- C. Use a login flow to collect Security Assertion Markup Language attributes and assign the appropriate profile during Just-In-Time (JIT) provisioning.
- D. Use the createUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.
Answer: A
NEW QUESTION 57
An identity architect wants to secure Salesforce APIs using Security Assertion Markup Language (SAML).
For secunty purposes, administrators will need to authorize the applications that will be consuming the APIs.
Which Salesforce OAuth authorization flow should be used?
- A. OAuth 2.0 User-Agent Flow
- B. SAML Assertion Flow
- C. OAuth 2-0 SAML Bearer Assertion Flow
- D. OAuth 2.0 JWT Bearer Flow
Answer: B
NEW QUESTION 58
Universal Containers (UC) is setting up delegated authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risks of exposing the corporate login service on the internet and has asked that a reliable trust mechanism be put in place between the login service and Salesforce.
What mechanism should an Architect put in place to enable a trusted connection between the login service and Salesforce?
- A. Include Client Id and Client Secret in the login header callout.
- B. Require the use of Salesforce security tokens on passwords.
- C. Set up a proxy service for the login service in the DMZ.
- D. Enforce mutual authentication between systems using SSL.
Answer: B
NEW QUESTION 59
Universal Containers (UC) wants its users to access Salesforce and other SSO-enabled applications from a custom web page that UC magnets. UC wants its users to use the same set of credentials to access each of the applications. what SAML SSO flow should an Architect recommend for UC?
- A. SP-Initiated
- B. User-Agent
- C. IdP-Initiated
- D. SP-Initiated with Deep Linking
Answer: C
NEW QUESTION 60
Universal containers wants to implement single Sign-on for a salesforce org using an external identity provider and corporate identity store. What type of Authentication flow is required to support deep linking?
- A. Identity-provider-initiated SSO
- B. Web server Oauth SSO flow.
- C. Service-provider-initiated SSO
- D. Start URL on identity provider
Answer: C
NEW QUESTION 61
Universal Containers is implementing Salesforce Identity to broker authentication from its enterprise single sign-on (SSO) solution through Salesforce to third party applications using SAML.
What rote does Salesforce Identity play in its relationship with the enterprise SSO system?
- A. Client Application
- B. Service Provider (SP)
- C. Identity Provider (IdP)
- D. Resource Server
Answer: B
NEW QUESTION 62
......
Salesforce Identity-and-Access-Management-Architect Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
Salesforce Identity-and-Access-Management-Architect Real 2023 Braindumps Mock Exam Dumps: https://www.dumpexam.com/Identity-and-Access-Management-Architect-valid-torrent.html
Salesforce Identity-and-Access-Management-Architect Actual Questions and 100% Cover Real Exam Questions: https://drive.google.com/open?id=12J9Z2IhK3t_U8KNycjKhDJiAd9Hqtu0o
