Give You Free Regular Updates on Identity-and-Access-Management-Architect Exam Questions Jul 07, 2023 [Q134-Q157]

Rate this post

Give You Free Regular Updates on Identity-and-Access-Management-Architect Exam Questions Jul 07, 2023

Achieve the Identity-and-Access-Management-Architect Exam Best Results with Help from Salesforce Certified Experts

QUESTION 134
A technology enterprise is planning to implement single sign-on login for users. When users log in to the Salesforce User object custom field, data should be populated for new and existing users.
Which two steps should an identity architect recommend?
Choose 2 answers

Implement Auth.SamlJitHandler Interface.

Create and update methods.

Implement RegistrationHandler Interface.

Implement SesslonManagement Class.

QUESTION 135
An insurance company has a connected app in its Salesforce environment that is used to integrate with a Google Workspace (formerly knot as G Suite).
An identity and access management (IAM) architect has been asked to implement automation to enable users, freeze/suspend users, disable users, and reactivate existing users in Google Workspace upon similar actions in Salesforce.
Which solution is recommended to meet this requirement?

Configure user Provisioning for Connected Apps.

Update the Security Assertion Markup Language Just-in-Time (SAML JIt; handler in Salesforce for user provisioning and de-provisioning.

Build a custom REST endpoint in Salesforce that Google Workspace can poll against.

Build an Apex trigger on the useriogin object to make asynchronous callouts to Google APIs.

QUESTION 136
A global fitness equipment manufacturer uses Salesforce to manage its sales cycle. The manufacturer has a custom order fulfillment app that needs to request order data from Salesforce. The order fulfillment app needs to integrate with the Salesforce API using OAuth 2.0 protocol.
What should an identity architect use to fulfill this requirement?

Canvas App Integration

OAuth Tokens

Authentication Providers

Connected App and OAuth scopes

QUESTION 137
Northern Trail Outfitters (NTO) has a requirement to ensure all user logins include a single multi-factor authentication (MFA) prompt. Currently, users are allowed the choice to login with a username and password or via single sign-on against NTO’s corporate Identity Provider, which includes built-in MFA.
Which configuration will meet this requirement?

Create and assign a permission set to all employees that includes “MFA for User Interface Logins.”

Create a custom login flow that enforces MFA and assign it to a permission set. Then assign the permission set to all employees.

Enable “MFA for User Interface Logins” for your organization from Setup -> Identity Verification.

For all employee profiles, set the Session Level Required at Login to High Assurance and add the corporate identity provider to the High Assurance list for the org’s Session Security Levels.

QUESTION 138
Under which scenario Web Server flow will be used?

Used for web applications when server-side code needs to interact with APIS.

Used for server-side components when page needs to be rendered.

Used for mobile applications and testing legacy Integrations.

Used for verifying Access protected resources.

QUESTION 139
Universal Container’s (UC) is using Salesforce Experience Cloud site for its container wholesale business. The identity architect wants to an authentication provider for the new site.
Which two options should be utilized in creating an authentication provider?
Choose 2 answers

A custom registration handier can be set.

A custom error URL can be set.

The default login user can be set.

The default authentication provider certificate can be set.

QUESTION 140

An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:
1 – Change of a user status in the central IAM Service triggers provisioning or deprovisioining in the integrated cloud applications.
2 – Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).
Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-Domain Identity Management) for provisioning and deprovisioning of users.

Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning and deprovisioning of users.

Configure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.

Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.

QUESTION 141
Universal containers(UC) wants to integrate a third-party reward calculation system with salesforce to calculate rewards. Rewards will be calculated on a schedule basis and update back into salesforce. The integration between Salesforce and the reward calculation system needs to be secure. Which are the recommended best practices for using Oauth flows in this scenario? Choose 2 answers

Oauth refresh token flow

Oauth SAML bearer assertion flow

Oauthjwt bearer token flow

Oauth Username-password flow

QUESTION 142
Northern Trail Outfitters (NTO) leverages Microsoft Active Directory (AD) for management of employee usernames, passwords, permissions, and asset access. NTO also owns a third-party single sign-on (SSO) solution. The third-party party SSO solution is used for all corporate applications, including Salesforce.
NTO has asked an architect to explore Salesforce Identity Connect for automatic provisioning and deprovisiorung of users in Salesforce.
What role does identity Connect play in the outlined requirements?

Service Provider

Single Sign-On

Identity Provider

User Management

QUESTION 143
Containers (UC) has an existing Customer Community. UC wants to expand the self-registration capabilities such that customers receive a different community experience based on the data they provide during the registration process. What is the recommended approach an Architect Should recommend to UC?

Create an After Insert Apex trigger on the user object to assign specific custom permissions.

Create separate login flows corresponding to the different community user personas.

Modify the Community pages to utilize specific fields on the User and Contact records.

Modify the existing Communities registration controller to assign different profiles.

QUESTION 144
Universal containers (UC) wants to implement a partner community. As part of their implementation, UC would like to modify both the Forgot password and change password experience with custom branding for their partner community users. Which 2 actions should an architect recommend to UC? Choose 2 answers

Build a community builder page for the change password experience and Custom Visualforce page for the Forgot password experience.

Build a custom visualforce page for both the change password and Forgot password experiences.

Build a custom visualforce page for the change password experience and a community builder page for the Forgot password experience.

Build a community builder page for both the change password and Forgot password experiences.

QUESTION 145
A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropriate way to generate sensor Information In Salesforce.
Which OAuth flow should the architect recommend?

OAuth 2.0 Asset Token Flow

OAuth 2.0 Device Authentication Row

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 SAML Bearer Assertion Flow

QUESTION 146
The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discuss Salesforce out-of-box capabilities for configuring the company*s login and registration experience on Salesforce Experience Cloud.
The CMO is looking to brand the login page with the company’s logo, background color, login button color, and dynamic right-frame from an external URL.
Which two solutions should the IAM specialist recommend?
Choose 2 answers

Use Experience Builder to build branded Reset and Forgot Password pages.

Build custom pages for branding requirements in Experience Cloud.

Build custom site pages for reset and forgot password features.

QUESTION 147
The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.
What should be used and considered before recommending it as a solution on the Salesforce Platform?

OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.

Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.

Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.

Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.

QUESTION 148
Northern Trail Outfitters (NTO) is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable NTO-branded page.
The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.
Which approach should the identity architect recommend?

Create a full sandbox to replicate the portal site and update the branding accordingly.

Implement Experience ID in the code and extend the URLs and endpomts, as required.

Use Heroku to build the new brand site and embedded login to reuse identities.

Configure an additional community site on the same org that is dedicated for the new brand.

QUESTION 149
Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HANA. UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs.
Which two Salesforce license types does UC need for its employees’
Choose 2 answers

Company Community and Identity licenses

Identity and Identity Connect licenses

Chatter Only and Identity licenses

Salesforce and Identity Connect licenses

QUESTION 150
Universal Containers built a custom mobile app for their field reps to create orders in Salesforce. OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained automatically without forcing the user to log in again. While that improved the field reps’ productivity, UC realized that they need a “logout” feature.
What should the logout function perform in this scenario, where user sessions are refreshed automatically?

Invoke the revocation URL and pass the refresh token.

Clear out the client Id to stop auto session refresh.

Invoke the revocation URL and pass the access token.

Clear out all the tokens to stop auto session refresh.

QUESTION 151
Universal Containers (UC) is using Active Directory as its corporate identity provider and Salesforce as its CRM for customer care agents, who use SAML based sign sign-on to login to Salesforce. The default agent profile does not include the Manage User permission. UC wants to dynamically update the agent role and permission sets.
Which two mechanisms are used to provision agents with the appropriate permissions?
Choose 2 answers

Use Login Flow in User Context to update role and permission sets.

Use Login Flow in System Context to update role and permission sets.

Use SAML Just-m-Time (JIT) Handler class run as current user to update role and permission sets.

Use SAML Just-in-Time (JIT) handler class run as an admin user to update role and permission sets.

QUESTION 152
Universal containers (UC) would like to enable SAML-BASED SSO for a salesforce partner community. UC has an existing ldap identity store and a third-party portal. They would like to use the existing portal as the primary site these users access, but also want to allow seamless access to the partner community. What SSO flow should an architect recommend?

User-Agent

IDP-initiated

Sp-Initiated

Web server

QUESTION 153
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

Enable “Allow customers and partners to self-register”.

Select the “Configurable Self-Reg Page” option under Login & Registration.

Set jp an external login page and call Salesforce APIs for user creation.

Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.

Customize me self-registration Apex handler to create only the user record.

QUESTION 154
Universal Containers (UC) has Active Directory (AD) as their enterprise identity store and would like to use it for Salesforce user authentication. UC expects to synchronize user data between Salesforce and AD and Assign the appropriate Profile and Permission Sets based on AD group membership. What would be the optimal way to implement SSO?

Use Active Directory with Reverse Proxy as the Identity Provider.

Use Microsoft Access control Service as the Authentication provider.

Use Active Directory Federation Service (ADFS) as the Identity Provider.

Use Salesforce Identity Connect as the Identity Provider.

QUESTION 155
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?

Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.

Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.

Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.

Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.

QUESTION 156
An architect has successfully configured SAML-BASED SSO for universal containers. SSO has been working for 3 months when Universal containers manually adds a batch of new users to salesforce. The new users receive an error from salesforce when trying to use SSO. Existing users are still able to successfully use SSO to access salesforce. What is the probable cause of this behaviour?

The administrator forgot to reset the new user’s salesforce password.

The Federation ID field on the new user records is not correctly set

The my domain capability is not enabled on the new user’s profile.

The new users do not have the SSO permission enabled on their profiles.

QUESTION 157
Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would like to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to achieve the goal?

Access Tokens

Mobile pins

Refresh Tokens

Scopes

Detailed New Identity-and-Access-Management-Architect Exam Questions for Concept Clearance: https://www.actualtorrent.com/Identity-and-Access-Management-Architect-questions-answers.html

Give You Free Regular Updates on Identity-and-Access-Management-Architect Exam Questions Jul 07, 2023 [Q134-Q157]

Be the first to reply

Leave a Reply Cancel reply