[Mar-2024] Updated Salesforce Identity-and-Access-Management-Architect Dumps – PDF & Online Engine
Identity-and-Access-Management-Architect.pdf - Questions Answers PDF Sample Questions Reliable
Salesforce Identity-and-Access-Management-Architect exam is designed to test the knowledge and skills of professionals in various areas of identity and access management, including authentication, authorization, and user management. Identity-and-Access-Management-Architect exam also covers topics such as data security, compliance, and governance. Candidates will be required to demonstrate their ability to design, implement, and manage secure and scalable IAM solutions on the Salesforce platform.
NEW QUESTION # 64
Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for to give its customers the ability to login with their Facebook and Twitter credentials.
Which two actions should an identity architect recommend to meet these requirements?
Choose 2 answers
- A. Create a custom external authentication provider for Twitter.
- B. Configure a predefined authentication provider for Twitter.
- C. Create a custom external authentication provider for Facebook.
- D. Configure a predefined authentication provider for Facebook.
Answer: B,D
NEW QUESTION # 65
Universal Containers (UC) wants to use Salesforce for sales orders and a legacy of system for order fulfillment. The legacy system must update the status of orders in 65* Salesforce in real time as they are fulfilled. UC decides to use OAuth for connecting the legacy system to Salesforce. What OAuth flow should be considered that doesn't require storing credentials, client secret or refresh tokens?
- A. Username-Password flow
- B. User Agent flow
- C. JWT Bearer Token flow
- D. Web Server flow
Answer: C
NEW QUESTION # 66
A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropriate way to generate sensor Information In Salesforce.
Which OAuth flow should the architect recommend?
- A. OAuth 2.0 Device Authentication Row
- B. OAuth 2.0 SAML Bearer Assertion Flow
- C. OAuth 2.0 Asset Token Flow
- D. OAuth 2.0 JWT Bearer Token Flow
Answer: C
NEW QUESTION # 67
An Architect has configured a SAML-based SSO integration between Salesforce and an external Identity provider and is ready to test it. When the Architect attempts to log in to Salesforce using SSO, the Architect receives a SAML error. Which two optimal actions should the Architect take to troubleshoot the issue?
- A. Use the browser's Development tools to view the Salesforce page's markup.
- B. Paste the SAML Assertion Validator in Salesforce.
- C. Ensure the Callback URL is correctly set in the Connected Apps settings.
- D. Use a browser that has an add-on/extension that can inspect SAML.
Answer: B,D
NEW QUESTION # 68
Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?
- A. The app is requesting too many access Tokens in a 24-hour period
- B. The Oauth authorizations are being revoked by a nightly batch job.
- C. The users forget to check the box to remember their credentials.
- D. The refresh token expiration policy is set incorrectly in salesforce
Answer: D
NEW QUESTION # 69
Universal Containers (UC) has Active Directory (AD) as their enterprise identity store and would like to use it for Salesforce user authentication. UC expects to synchronize user data between Salesforce and AD and Assign the appropriate Profile and Permission Sets based on AD group membership. What would be the optimal way to implement SSO?
- A. Use Active Directory Federation Service (ADFS) as the Identity Provider.
- B. Use Microsoft Access control Service as the Authentication provider.
- C. Use Salesforce Identity Connect as the Identity Provider.
- D. Use Active Directory with Reverse Proxy as the Identity Provider.
Answer: C
Explanation:
Explanation
The optimal way to implement SSO with Active Directory as the enterprise identity store is to use Salesforce Identity Connect as the identity provider. Salesforce Identity Connect is a software that integrates Microsoft Active Directory with Salesforce and enables single sign-on (SSO) using SAML. It also allows user data synchronization between Active Directory and Salesforce and profile and permission set assignment based on Active Directory group membership. Option A is not a good choice because using Active Directory with reverse proxy as the identity provider may not be supported by Salesforce or may require additional configuration and customization. Option B is not a good choice because using Microsoft Access Control Service as the authentication provider may not be available, as Microsoft has retired this service in 2018.
Option C is not a good choice because using Active Directory Federation Service (ADFS) as the identity provider may not allow user data synchronization or profile and permission set assignment based on Active Directory group membership, unless it is combined with another tool such as Salesforce Identity Connect.
References: Salesforce Identity Connect Implementation Guide, Single Sign-On Implementation Guide
NEW QUESTION # 70
What are three capabilities of Delegated Authentication? Choose 3 answers
- A. It can be assigned by Permission Sets.
- B. It can be assigned by Custom Permissions.
- C. It can connect to REST services.
- D. It can be assigned by Profiles.
- E. It can connect to SOAP services.
Answer: A,C,E
NEW QUESTION # 71
Universal containers wants salesforce inbound Oauth-enabled integration clients to use SAML-BASED single Sign-on for authentication. What Oauth flow would be recommended in this scenario?
- A. Web server Oauth flow
- B. SAML assertion Oauth flow
- C. User-Token Oauth flow
- D. User-Agent Oauth flow
Answer: B
Explanation:
Explanation
The SAML assertion OAuth flow allows a connected app to use a SAML assertion to request an OAuth access token to call Salesforce APIs. This flow provides an alternative for orgs that are currently using SAML to access Salesforce and want to access the web services API in the same way3. This flow can be used for inbound OAuth-enabled integration clients that want to use SAML-based single sign-on for authentication.
References: OAuth 2.0 SAML Bearer Assertion Flow for Previously Authorized Apps, Access Data with API Integration, Error 'Invalid assertion' in OAuth 2.0 SAML Bearer Flow
NEW QUESTION # 72
Northern Trail Outfitters (NTO) is planning to implement a community for its customers using Salesforce Experience Cloud. Customers are not able to self-register. NTO would like to have customers set their own passwords when provided access to the community.
Which two recommendations should an identity architect make to fulfill this requirement?
Choose 2 answers
- A. Allow Password reset using the API to update Experience Cloud site membership.
- B. Use Login Flows to allow users to reset password in Experience Cloud site.
- C. Add customers as contacts and add them to Experience Cloud site.
- D. Enable Welcome emails while configuring the Experience Cloud site.
Answer: A,B
Explanation:
Explanation
Allowing password reset using the API and using login flows are two possible ways to enable customers to set their own passwords in Experience Cloud. The other options are not relevant for this requirement, as they do not address the password issue. References: Allow Password Reset Using the API, Use Login Flows to Allow Users to Reset Passwords in Experience Cloud Sites
NEW QUESTION # 73
Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an external identity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.
What should a identity architect recommend to create partners?
- A. Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.
- B. On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.
- C. Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.
- D. Allow partners to register through the IdP and create partner users in Salesforce through an API.
Answer: A
NEW QUESTION # 74
A financial services company uses Salesforce and has a compliance requirement to track information about devices from which users log in. Also, a Salesforce Security Administrator needs to have the ability to revoke the device from which users log in.
What should be used to fulfill this requirement?
- A. Use multi-factor authentication (MFA) to meet the compliance requirement to track device information.
- B. Use the Login History object to track information about devices from which users log in.
- C. Use Login Flows to capture device from which users log in and store device and user information in a custom object.
- D. Use the Activations feature to meet the compliance requirement to track device information.
Answer: D
NEW QUESTION # 75
Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow employees to post Ideas from the Employee portal. When users click on some of the links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with the relevant pages. What OAuth flow is best suited for this scenario?
- A. Web Application flow
- B. Web Server flow
- C. User-Agent flow
- D. SAML Bearer Assertion flow
Answer: B
NEW QUESTION # 76
Universal Containers (UC) uses middleware to integrate multiple systems with Salesforce. UC has a strict, new requirement that usernames and passwords cannot be stored in any UC system. How can UC's middleware authenticate to Salesforce while adhering to this requirement?
- A. Create a Connected App that supports the User-Agent OAuth Flow.
- B. Create a Connected App that supports the Refresh Token OAuth Flow
- C. Create a Connected App that supports the JWT Bearer Token OAuth Flow.
- D. Create a Connected App that supports the Web Server OAuth Flow.
Answer: C
NEW QUESTION # 77
Universal containers (UC) has built a custom based Two-factor Authentication (2fa) system for their existing on-premise applications. Thru are now implementing salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution an architect should consider?
- A. Replace the custom 2fa system with an app exchange app that supports on-premise applications and salesforce.
- B. Use the custom 2fa system for on-premise applications and native 2fa for salesforce.
- C. Replace the custom 2fa system with salesforce 2fa for on-premise application and salesforce.
- D. Use custom login flows to connect to the existing custom 2fa system for use in salesforce.
Answer: D
Explanation:
Explanation
Using custom login flows to connect to the existing custom 2fa system for use in salesforce is the recommended solution because it allows you to leverage your existing 2fa infrastructure and provide a consistent user experience across your applications. Custom login flows let you customize the authentication process by adding extra screens or logic before or after the standard login1. You can use Apex code to call your custom 2fa system and verify the user's identity2. This option also gives you more flexibility and control over the 2fa process than using native 2fa or an app exchange app3. References: 1: Customize User Authentication with Login Flows 2: Custom Login Flow Examples 3: Salesforce Multi-Factor Authentication
NEW QUESTION # 78
Northern Trail Outfitters recently acquired a company. Each company will retain its Identity Provider (IdP).
Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.
How should the combined companys' employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?
- A. Have generated links be prefixed with the appropriate IdP URL to invoke an IdP-initiated Security Assertion Markup Language flow when clicked.
- B. Have generated links append a querystnng parameter indicating the IdP. The login service will redirect to the appropriate IdP.
- C. Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.
- D. Configure unique MyDomains for each company and have generated links use the appropriate MyDomam in the URL.
Answer: C
Explanation:
Explanation
To allow employees to collaborate in a single Salesforce org, yet authenticate to the appropriate IdP, the identity architect should enable each IdP as a login option in the MyDomain Authentication Service settings.
Users will then click on the appropriate IdP button. MyDomain is a feature that allows administrators to customize the Salesforce login URL with a unique domain name. Authentication Service is a setting that allows administrators to enable different authentication options for users, such as social sign-on or single sign-on with an external IdP. By enabling each IdP as a login option in the MyDomain Authentication Service settings, the identity architect can provide a user-friendly and secure way for employees to log in to Salesforce using their preferred IdP. References: MyDomain, Authentication Service
NEW QUESTION # 79
What are three capabilities of Delegated Authentication? Choose 3 answers
- A. It can be assigned by Permission Sets.
- B. It can be assigned by Custom Permissions.
- C. It can connect to REST services.
- D. It can be assigned by Profiles.
- E. It can connect to SOAP services.
Answer: A,C,E
Explanation:
Explanation
The three capabilities of delegated authentication are:
It can connect to SOAP services. Delegated authentication is a feature that allows Salesforce to delegate the authentication process to an external service by making a SOAP callout to a web service that verifies the user's credentials. This feature enables Salesforce to integrate with existing identity stores or authentication methods that support SOAP services.
It can be assigned by permission sets. Permission sets are collections of settings and permissions that give users access to various tools and functions in Salesforce. Permission sets can be used to assign delegated authentication to users by enabling the "Is Single Sign-on Enabled" permission. This permission allows users to log in with delegated authentication instead of their Salesforce username and password.
It can connect to REST services. REST services are web services that use HTTP methods to access or manipulate resources on a server. REST services can be used for delegated authentication by creating a custom login page that makes a REST callout to an external service that verifies the user's credentials.
This approach requires custom code and configuration, but it provides more flexibility and control over the authentication process.
The other options are not capabilities of delegated authentication. Delegated authentication cannot be assigned by custom permissions or profiles. Custom permissions are settings that can be used in Apex code or validation rules to check whether a user has access to a custom feature or functionality. Custom permissions cannot be used to enable delegated authentication for users. Profiles are collections of settings and permissions that determine what users can do in Salesforce. Profiles cannot be used to enable delegated authentication for users, as this feature is controlled by permission sets. References: [Delegated Authentication], [Permission Sets], [Enable 'Delegated Authentication'], [REST Services], [Custom Login Page for Delegated Authentication], [Custom Permissions], [Profiles]
NEW QUESTION # 80
Which three are features of federated Single sign-on solutions? Choose 3 Answers
- A. It enables quick and easy provisioning and deactivating of users.
- B. It federates credentials control to authorized applications.
- C. It improves affiliated applications adoption rates.
- D. It establishes trust between Identity Store and Service Provider.
- E. It solves all identity and access management problems.
Answer: A,C,D
NEW QUESTION # 81
Northern Trail Outfitters (NTO) has a requirement to ensure all user logins include a single multi-factor authentication (MFA) prompt. Currently, users are allowed the choice to login with a username and password or via single sign-on against NTO's corporate Identity Provider, which includes built-in MFA.
Which configuration will meet this requirement?
- A. Create a custom login flow that enforces MFA and assign it to a permission set. Then assign the permission set to all employees.
- B. Create and assign a permission set to all employees that includes "MFA for User Interface Logins."
- C. For all employee profiles, set the Session Level Required at Login to High Assurance and add the corporate identity provider to the High Assurance list for the org's Session Security Levels.
- D. Enable "MFA for User Interface Logins" for your organization from Setup -> Identity Verification.
Answer: D
NEW QUESTION # 82
......
Salesforce Identity-and-Access-Management-Architect Dumps PDF Are going to be The Best Score: https://vcecollection.trainingdumps.com/Identity-and-Access-Management-Architect-valid-vce-dumps.html
