2023 Provide Updated Salesforce Identity-and-Access-Management-Architect Dumps as Practice Test and PDF [Q23-Q39]

20 Aug, 2023 By admin Identity-and-Access-Management-Architect, Salesforce 0 Comments

2023 Provide Updated Salesforce Identity-and-Access-Management-Architect Dumps as Practice Test and PDF [Q23-Q39]

Rate this post

2023 Provide Updated Salesforce Identity-and-Access-Management-Architect Dumps as Practice Test and PDF

Identity-and-Access-Management-Architect Dumps are Available for Instant Access

Salesforce Certified Identity and Access Management Architect exam covers a range of topics including authentication methods, authorization frameworks, data security, and compliance regulations. Candidates are expected to have a deep understanding of identity and access management concepts, as well as experience with Salesforce products like Salesforce Identity and Salesforce Shield. Successful completion of Identity-and-Access-Management-Architect exam demonstrates that the candidate has the expertise needed to ensure the security and privacy of Salesforce users and their data.

Salesforce Identity-and-Access-Management-Architect Exam Syllabus Topics:

Topic	Details
Topic 1	Identify the ways that users can be provisioned in Salesforce to enable SSO and apply access rights Identify the auditing and monitoring approaches available on the platform
Topic 2	Given a requirement, understand the advantages and limitations of External Identity solutions and associated licenses Identify the role Identity Connect product plays in a Salesforce Identity implementation
Topic 3	Describe the various implementation concepts of OAuth Describe the building blocks that are part of an identity solution
Topic 4	Describe the capabilities for customizing the user experience for Experience Cloud Given a scenario, identify the most appropriate OAuth flow
Topic 5	Given a scenario, recommend appropriate Scope and Configuration of the connected App for Authorization Given a scenario, determine when to use embedded login

NO.23 Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?

Use salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.

Use Delegated Authentication with callouts to a third-party fingerprint scanning application.

Use an appexchange product that does fingerprint scanning with native salesforce identity confirmation.

Use custom login flows with callouts to a third-party fingerprint scanning application.

NO.24 Under which scenario Web Server flow will be used?

Used for web applications when server-side code needs to interact with APIS.

Used for server-side components when page needs to be rendered.

Used for mobile applications and testing legacy Integrations.

Used for verifying Access protected resources.

NO.25 Which two capabilities does My Domain enable in the context of a SAML SSO configuration? Choose 2 answers

App Launcher

Resource deep linking

SSO from Salesforce Mobile App

NO.26 Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

Enable “Allow customers and partners to self-register”.

Select the “Configurable Self-Reg Page” option under Login & Registration.

Set jp an external login page and call Salesforce APIs for user creation.

Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.

Customize me self-registration Apex handler to create only the user record.

NO.27 Refer to the exhibit.

Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user’s brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?

For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.

NO.28 Northern Trail Outfitters (NTO) is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable NTO-branded page.
The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.
Which approach should the identity architect recommend?

Create a full sandbox to replicate the portal site and update the branding accordingly.

Implement Experience ID in the code and extend the URLs and endpomts, as required.

Use Heroku to build the new brand site and embedded login to reuse identities.

Configure an additional community site on the same org that is dedicated for the new brand.

NO.29 A global company’s Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) ‘Replay Detected and Assertion Invalid’ login errors.
Which two issues would cause these errors?
Choose 2 answers

The subject element is missing from the assertion sent to salesforce.

The certificate loaded into SSO configuration does not match the certificate used by the IdP.

The current time setting of the company’s identity provider (IdP) and Salesforce platform is out of sync by more than eight minutes.

The assertion sent to 5alesforce contains an assertion ID previously used.

NO.30 Universal Containers (UC) has a classified information system that its call center team uses only when they are working on a case with a record type “Classified”. They are only allowed to access the system when they own an open “Classified” case, and their access to the system is removed at all other times. They would like to implement SAML SSO eith Salesforce as the Idp, and automatically allow or deny the staff’s access to the classified information system based on whether they currently own an open “Classified” case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying the access to the classified information system based on the open “classified” case record criteria?

Use Salesforce reports to identify users that currently owns open “Classified” cases and should be granted access to the Classified information system.

Use Apex trigger on case to dynamically assign permission Sets that Grant access when an user is assigned with an open “Classified” case, and remove it when the case is closed.

Use Custom SAML JIT Provisioning to dynamically query the user’s open “Classified” cases when attempting to access the classified information system.

Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open “Classified” Cases.

NO.31 How should an identity architect automate provisioning and deprovisioning of users into Salesforce from an external system?

Call SOAP API upsertQ on user object.

Use Security Assertion Markup Language Just-in-Time (SAML JIT) on incoming SAML assertions.

Run registration handler on incoming OAuth responses.

Call OpenID Connect (OIDC)-userinfo endpoint with a valid access token.

NO.32 Universal Containers (UC) has decided to use Salesforce as an Identity Provider for multiple external applications. UC wants to use the salesforce App Launcher to control the Apps that are available to individual users. Which three steps are required to make this happen?

Add each connected App to the App Launcher with a Start URL.

Set up an Auth Provider for each External Application.

Set up Salesforce as a SAML Idp with My Domain.

Set up Identity Connect to Synchronize user data.

Create a Connected App for each external application.

NO.33 An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?

Users once logged In, can go to the Change Password screen in Salesforce.

Users can click on the “Forgot your Password” link on the Salesforce.com login page.

Users can request the Salesforce Admin to reset their password.

Users can change it on the enterprise LDAP authentication portal.

NO.34 Universal Containers (UC) is using Active Directory as its corporate identity provider and Salesforce as its CRM for customer care agents, who use SAML based sign sign-on to login to Salesforce. The default agent profile does not include the Manage User permission. UC wants to dynamically update the agent role and permission sets.
Which two mechanisms are used to provision agents with the appropriate permissions?
Choose 2 answers

Use Login Flow in User Context to update role and permission sets.

Use Login Flow in System Context to update role and permission sets.

Use SAML Just-m-Time (JIT) Handler class run as current user to update role and permission sets.

Use SAML Just-in-Time (JIT) handler class run as an admin user to update role and permission sets.

NO.35 Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers

Delegated Authentication is enabled or disabled for the entire Salesforce org.

UC will be required to develop and support a custom SOAP web service.

Salesforce users will be locked out of Salesforce if the web service goes down.

The web service must reside on a public cloud service, such as Heroku.

NO.36 Universal Containers want users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN.
Which two options should an identity architect recommend to meet the requirement?
Choose 2 answers

Active Directory Password Sync Plugin

Configure Cloud Provider Load Balancer

Salesforce Trigger & Field on Contact Object

Salesforce Identity Connect

NO.37 IT security at Unversal Containers (UC) us concerned about recent phishing scams targeting its users and wants to add additional layers of login protection. What should an Architect recommend to address the issue?

Use the Salesforce Authenticator mobile app with two-step verification

Lock sessions to the IP address from which they originated.

Increase Password complexity requirements in Salesforce.

Implement Single Sign-on using a corporate Identity store.

NO.38 Universal containers (UC) is building a mobile application that will make calls to the salesforce REST API.
Additionally UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes should UC configure in the connected App? Choose 2 answers

Refresh token

API

full

Web

NO.39 Universal containers (UC) would like to enable SAML-BASED SSO for a salesforce partner community. UC has an existing ldap identity store and a third-party portal. They would like to use the existing portal as the primary site these users access, but also want to allow seamless access to the partner community. What SSO flow should an architect recommend?

User-Agent

IDP-initiated

Sp-Initiated

Web server