Salesforce Certified Identity and Access Management Designer - Identity-and-Access-Management-Designer FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financial system, and CPQ system. Below is the SSO implementation landscape.

What role combination is represented by the systems in this scenario''

A. Salesforce Org1 and Salesforce Org2 are the only Service Providers. B. Salesforce Org1 and Salesforce Org2 are acting as Identity Providers. C. Salesforce Org1 and PingFederate are acting as Identity Providers. D. Financial System and CPQ System are the only Service Providers.

Discussion 0

Correct Answer: C Vote an answer

Question 2

Which two statements are capable of Identity Connect? Choose 2 answers

A. Automated user synchronization and de-activation. B. Support multiple orgs connecting to multiple Active Directory servers. C. Supports both Identity-Provider-Initiated and Service-Provider-Initiated SSO. D. Synchronization of Salesforce Permission Set Licence Assignments.

Discussion 0

Correct Answer: A,C Vote an answer

Question 3

Universal Containers (UC) has built a custom token-based Two-factor authentication (2FA) system for their existing on-premise applications. They are now implementing Salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution as Architect should consider?

A. Replace the custom 2FA system with Salesforce 2FA for on-premise applications and Salesforce. B. Use the custom 2FA system for on-premise applications and native 2FA for Salesforce. C. Replace the custom 2FA system with an AppExchange App that supports on premise application and salesforce. D. Use Custom Login Flows to connect to the existing custom 2FA system for use in Salesforce.

Discussion 0

Correct Answer: A Vote an answer

Question 4

Universal containers (UC) is concerned that having a self-registration page will provide a means for "bots" or unintended audiences to create user records, thereby consuming licences and adding dirty dat a. Which two actions should UC take to prevent unauthorised form submissions during the self-registration process? Choose 2 answers

A. Use hidden fields populated via java script events in the self-registration page. B. Primarily use lookup and picklist fields on the self registration page. C. Use open-ended security questions and complex password requirements D. Require a captcha at the end of the self-registration process.

Discussion 0

Correct Answer: A,D Vote an answer

Question 5

Universal Containers (UC) has a Desktop application to collect leads for marketing campaigns. UC wants to extend this application to integrate with Salesforce to create leads. Integration between the desktop application and salesforce should be seamless. What Authorization flow should the Architect recommend?

A. JWT Bearer Token flow B. Username and Password Flow C. User Agent Flow D. Web Server Authentication Flow

Discussion 0

Correct Answer: C Vote an answer

Question 6

Northern Trail Outfitters (NTO) has a number of employees who do NOT need access Salesforce objects. Trie employees should sign in to a custom Benefits web app using their Salesforce credentials.
Which license should the identity architect recommend to fulfill this requirement?

A. Identity Only License B. Identity Connect License C. External Identity License D. Identity Verification Credits Add-on License

Discussion 0

Correct Answer: A Vote an answer

Question 7

Universal Containers is using OpenID Connect to enable a connection from their new mobile app to its production Salesforce org.
What should be done to enable the retrieval of the access token status for the OpenID Connect connection?

A. Create a custom OAuth scope. B. Query using OpenID Connect discovery endpoint. C. A Leverage OpenID Connect Token Introspection. D. Enable cross-origin resource sharing (CORS) for the /services/oauth2/token endpoint.

Discussion 0

Correct Answer: C Vote an answer

Question 8

A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.
The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.
What should an Identity architect do to meet this requirement?

A. Upload a third-party certificate from Salesforce into the on-premise server. B. Configure the company firewall to allow traffic from Salesforce IP ranges. C. Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore. D. Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

Discussion 0

Correct Answer: B Vote an answer

Question 9

Northern Trail Outfitters recently acquired a company. Each company will retain its Identity Provider (IdP). Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.
How should the combined companys' employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?

A. Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button. B. Configure unique MyDomains for each company and have generated links use the appropriate MyDomam in the URL. C. Have generated links be prefixed with the appropriate IdP URL to invoke an IdP-initiated Security Assertion Markup Language flow when clicked. D. Have generated links append a querystnng parameter indicating the IdP. The login service will redirect to the appropriate IdP.

Discussion 0

Correct Answer: A Vote an answer

Question 10

Northern Trail Outfitters (NTO) is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable NTO-branded page.
The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.
Which approach should the identity architect recommend?

A. Create a full sandbox to replicate the portal site and update the branding accordingly. B. Configure an additional community site on the same org that is dedicated for the new brand. C. Implement Experience ID in the code and extend the URLs and endpomts, as required. D. Use Heroku to build the new brand site and embedded login to reuse identities.

Discussion 0

Correct Answer: C Vote an answer

Question 11

Universal containers wants salesforce inbound Oauth-enabled integration clients to use SAML-BASED single Sign-on for authentication. What Oauth flow would be recommended in this scenario?

A. User-Token Oauth flow B. Web server Oauth flow C. SAML assertion Oauth flow D. User-Agent Oauth flow

Discussion 0

Correct Answer: C Vote an answer

Question 12

Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post their ideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decides to use an API user using Oauth Username - password flow for the connection. How can the connection to salesforce be restricted only to the employee portal server?

A. Add the employee portals IP address to the login IP range on the user profile. B. Add the Employee portals IP address to the Trusted IP range for the connected App C. Use a digital certificate signed by the employee portal Server. D. Use a dedicated profile for the user the Employee portal uses.

Discussion 0

Correct Answer: B Vote an answer