Salesforce IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT Online Practice Questions and Exam Preparation

Salesforce IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT Online Questions & Answers

• Question 111:

  Universal Containers (UC) wants to build a custom mobile app for their field reps to create orders in salesforce. After the first time the users log in, they must be able to access salesforce upon opening the mobile app without being prompted to log in again. What Oauth flows should be considered to support this requirement?

  A. Web Server flow with a Refresh Token.
  B. Mobile Agent flow with a Bearer Token.
  C. User Agent flow with a Refresh Token.
  D. SAML Assertion flow with a Bearer Token.
  C. User Agent flow with a Refresh Token.

• Question 112:

  Universal Containers (UC) has a classified information system that its call center team uses only when they are working on a case with a record type "Classified". They are only allowed to access the system when they own an open "Classified" case, and their access to the system is removed at all other times. They would like to implement SAML SSO eith Salesforce as the Idp, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "Classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying the access to the classified information system based on the open "classified" case record criteria?

  A. Use Salesforce reports to identify users that currently owns open "Classified" cases and should be granted access to the Classified information system.
  B. Use Apex trigger on case to dynamically assign permission Sets that Grant access when an user is assigned with an open "Classified" case, and remove it when the case is closed.
  C. Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.
  D. Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases.
  D. Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases.

• Question 113:

  Universal Containers has multiple Salesforce instances where users receive emails from different instances. Users should be logged into the correct Salesforce instance authenticated by their IdP when clicking on an email link to a Salesforce record. What should be enabled in Salesforce as a prerequisite?

  A. My Domain
  B. External Identity
  C. Identity Provider
  D. Multi-Factor Authentication
  A. My Domain

• Question 114:

  Universal Containers (UC) is planning to deploy a custom mobile app that will allow users to get e-signatures from its customers on their mobile devices. The mobile app connects to Salesforce to upload the e-signature as a file attachment and uses OAuth protocol for both authentication and authorization. What is the most recommended and secure OAuth scope setting that an Architect should recommend?

  A. Id
  B. Web
  C. Api
  D. Custom_permissions
  D. Custom_permissions

• Question 115:

  Universal containers (UC) has implemented ansp-Initiated SAML flow between an external IDP and salesforce. A user at UC is attempting to login to salesforce1 for the first time and is being prompted for salesforce credentials instead of

  being shown the IDP login page.

  What is the likely cause of the issue?

  A. The "Redirect to Identity Provider" option has been selected in the my domain configuration.
  B. The user has not configured the salesforce1 mobile app to use my domain for login
  C. The "Redirect to identity provider" option has not been selected the SAML configuration.
  D. The user has not been granted the "Enable single Sign-on" permission
  B. The user has not configured the salesforce1 mobile app to use my domain for login

• Question 116:

  Containers (UC) uses a legacy Employee portal for their employees to collaborate. Employees access the portal from their company's internal website via SSO. It is set up to work with SiteMinder and Active Directory. The Employee portal has features to support posing ideas. UC decides to use Salesforce Ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to integrate Employee portal ideas with Salesforce idea through the API. What is the role of Salesforce in the context of SSO, based on this scenario?

  A. Service Provider, because Salesforce is the application for managing ideas.
  B. Connected App, because Salesforce is connected with Employee portal via API.
  C. Identity Provider, because the API calls are authenticated by Salesforce.
  D. An independent system, because Salesforce is not part of the SSO setup.
  D. An independent system, because Salesforce is not part of the SSO setup.

• Question 117:

  How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

  A. Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.
  B. Add the list of company's network IP addresses to the Login Range list under 2FA Setup.
  C. Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.
  D. Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.
  A. Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.

• Question 118:

  Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose.

  Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication? Choose 2 answers

  A. Salesforce license for sales users and Identity license for Marketing users
  B. Salesforce license for sales users and External Identity license for Marketing users
  C. Identity license for sales users and Identity connect license for Marketing users D. Salesforce license for sales users and platform license for Marketing users.
  A. Salesforce license for sales users and Identity license for Marketing users

  ---

  Explanation/Reference:

• Question 119:

  Universal containers(UC) wants to integrate a third-party reward calculation system with salesforce to calculate rewards. Rewards will be calculated on a schedule basis and update back into salesforce. The integration between Salesforce and the reward calculation system needs to be secure. Which are the recommended best practices for using Oauth flows in this scenario? Choose 2 answers

  A. Oauth refresh token flow
  B. Oauth SAML bearer assertion flow
  C. Oauthjwt bearer token flow
  D. Oauth Username-password flow
  B. Oauth SAML bearer assertion flow
  C. Oauthjwt bearer token flow

• Question 120:

  The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience. What should be used and considered before recommending it as a solution on the Salesforce Platform?

  A. OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.
  B. Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.
  C. Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.
  D. Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.
  D. Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.