Salesforce IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT Online Practice Questions and Exam Preparation

Salesforce IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT Online Questions & Answers

• Question 1:

  Universal Containers (UC) uses Global Shipping (GS) as one of their shipping vendors. Regional leads of GS need access to UC's Salesforce instance for reporting damage of goods using Cases. The regional leads also need access to dashboards to keep track of regional shipping KPIs. UC internally uses a third-party cloud analytics tool for capacity planning and UC decided to provide access to this tool to a subset of GS employees. In addition to regional leads, the GS capacity planning team would benefit from access to this tool. To access the analytics tool, UC IT has set up Salesforce as the Identity provider for Internal users and would like to follow the same approach for the GS users as well.

  What are the most appropriate license types for GS Tregional Leads and the GS Capacity Planners? Choose 2 Answers

  A. Customer Community Plus license for GS Regional Leads and External Identity for GS Capacity Planners.
  B. Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.
  C. Identity Licence for GS Regional Leads and External Identity license for GS capacity Planners.
  D. Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.
  B. Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.
  D. Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.

• Question 2:

  Universal Containers (UC) is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.

  Which two page types are valid login page types for the site? Choose 2 answers

  A. Experience Builder Page
  B. lightning Experience Page
  C. Login Discovery Page
  D. Embedded Login Page
  C. Login Discovery Page
  D. Embedded Login Page

• Question 3:

  Universal containers (UC) has implemented SAML -based single Sign-on for their salesforce application.

  UC is using pingfederate as the Identity provider. To access salesforce, Users usually navigate to a bookmarked link to my domain URL.

  What type of single Sign-on is this?

  A. Sp-Initiated
  B. IDP-initiated with deep linking
  C. IDP-initiated
  D. Web server flow.
  A. Sp-Initiated

• Question 4:

  Northern Trail Outfitters (NTO) wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, NTO establishes a single customer view including their buying behaviors, channel preferences and purchasing history. All of this information exists but is spread across different systems and formats.

  NTO has decided to use Salesforce as the platform to build a 360 degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets.

  What should an Identity Architect do to provision, deprovision and authenticate users?

  A. Salesforce Identity is not needed since NTO uses Microsoft AD.
  B. Salesforce Identity can be included but NTO will be required to build a custom integration with Microsoft AD.
  C. Salesforce Identity is included in the Salesforce licenses so it does not need to be considered separately.
  D. A Salesforce Identity can be included but NTO will require Identity Connect.
  D. A Salesforce Identity can be included but NTO will require Identity Connect.

• Question 5:

  Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.

  What should an identity architect do to fulfill this requirement?

  A. Contact Salesforce Support and enable delegate single sign-on.
  B. Create a custom external authentication provider.
  C. Use certificate-based authentication.
  D. Configure OpenID Connect authentication provider.
  B. Create a custom external authentication provider.

• Question 6:

  Universal Containers is implementing a new Experience Cloud site and the identity architect wants to use dynamic branding features as of the login process.

  Which two options should the identity architect recommend to support dynamic branding for the site? Choose 2 answers

  A. To use dynamic branding, the community must be built with the Visuaiforce + Salesforce Tabs template.
  B. To use dynamic branding, the community must be built with the Customer Account Portal template.
  C. An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand.
  D. An external content management system (CMS) must be used for dynamic branding on Experience Cloud sites.
  B. To use dynamic branding, the community must be built with the Customer Account Portal template.
  C. An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand.

• Question 7:

  Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Amazon credentials.

  What should an identity architect recommend to meet these requirements?

  A. Configure a predefined authentication provider for Amazon.
  B. Create a custom external authentication provider for Amazon.
  C. Configure an OpenID Connect Authentication Provider for Amazon.
  D. Configure Amazon as a connected app.
  C. Configure an OpenID Connect Authentication Provider for Amazon.

• Question 8:

  Universal Containers (UC) has a Customer Community that uses Facebook for Authentication.

  UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user:

  How can this requirement be met?

  A. Use the updateUser method on the registration Handler Class.
  B. Develop a scheduled job that calls out to Facebook on a nightly basis.
  C. Use information in the signed Request that is received from facebook.
  D. Use SAML Just-In-Time Provisioning between Facebook and Salesforce.
  A. Use the updateUser method on the registration Handler Class.

• Question 9:

  An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).

  Which feature of Identity Connect is applicable for this scenano?

  A. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.
  B. If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.
  C. Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.
  D. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
  A. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.

• Question 10:

  Universal Containers (UC) has implemented SSO according to the diagram below. uses SAML while Salesforce Org 1 uses OAuth 2.0. Users usually start their day by first attempting to log into Salesforce Org 2 and then later in the day, they will log into either the Financial System or CPQ system depending upon their job position.

  Which two systems are acting as Identity Providers?

  A. Financial System
  B. Pingfederate
  C. Salesforce Org 2
  D. Salesforce Org 1
  B. Pingfederate
  D. Salesforce Org 1