Use Real Identity-and-Access-Management-Architect - 100% Cover Real Exam Questions [May-2024]
Dumps Brief Outline Of The Identity-and-Access-Management-Architect Exam - DumpsTorrent
NEW QUESTION # 25
Which two capabilities does My Domain enable in the context of a SAML SSO configuration? Choose 2 answers
- A. App Launcher
- B. Resource deep linking
- C. Login Forensics
- D. SSO from Salesforce Mobile App
Answer: B,D
NEW QUESTION # 26
An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer's sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.
Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150 sub-brands?
- A. Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the user experience.
- B. Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuth and Security Assertion Markup Language (SAML) flows.
- C. Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.
- D. Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.
Answer: D
Explanation:
Explanation
To support scalability and reduce maintenance costs for a multinational, multi-brand organization, the architect should recommend assigning each sub-brand a unique Experience ID and using the Experience ID to dynamically brand the login experience. Experience ID is a parameter that can be used to identify different brands or experiences within a single Experience Cloud site (formerly known as Community). Dynamic branding is a feature that allows Experience Cloud sites to display different branding elements, such as logos, colors, or images, based on the Experience ID or other criteria. This solution can provide a consistent and personalized brand experience for each sub-brand without creating multiple subdomains or orgs. References:
Experience ID, Dynamic Branding for Experience Cloud Sites
NEW QUESTION # 27
A manufacturer wants to provide registration for an Internet of Things (IoT) device with limited display input or capabilities.
Which Salesforce OAuth authorization flow should be used?
- A. OAuth 2.0 Device Flow
- B. OAuth 2.0 User-Agent Flow
- C. OAuth 2.0 Asset Token Flow
- D. OAuth 2.0 JWT Bearer How
Answer: A
Explanation:
Explanation
The OAuth 2.0 Device Flow is a type of authorization flow that allows users to register an IoT device with limited display input or capabilities, such as a smart TV, a printer, or a smart speaker1. The device flow works as follows1:
The device displays or reads out a verification code and a verification URL to the user.
The user visits the verification URL on another device, such as a smartphone or a laptop, and enters the verification code.
The user logs in to Salesforce and approves the device.
The device polls Salesforce for an access token using the verification code.
Salesforce returns an access token to the device, which can then access Salesforce APIs.
References:
OAuth 2.0 Device Flow
NEW QUESTION # 28
Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post their ideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decides to use an API user using Oauth Username - password flow for the connection. How can the connection to salesforce be restricted only to the employee portal server?
- A. Add the employee portals IP address to the login IP range on the user profile.
- B. Use a dedicated profile for the user the Employee portal uses.
- C. Use a digital certificate signed by the employee portal Server.
- D. Add the Employee portals IP address to the Trusted IP range for the connected App
Answer: D
NEW QUESTION # 29
An architect has successfully configured SAML-BASED SSO for universal containers. SSO has been working for 3 months when Universal containers manually adds a batch of new users to salesforce. The new users receive an error from salesforce when trying to use SSO. Existing users are still able to successfully use SSO to access salesforce. What is the probable cause of this behaviour?
- A. The new users do not have the SSO permission enabled on their profiles.
- B. The my domain capability is not enabled on the new user's profile.
- C. The administrator forgot to reset the new user's salesforce password.
- D. The Federation ID field on the new user records is not correctly set
Answer: D
NEW QUESTION # 30
Universal Containers (UC) is planning to deploy a custom mobile app that will allow users to get e-signatures from its customers on their mobile devices. The mobile app connects to Salesforce to upload the e-signature as a file attachment and uses OAuth protocol for both authentication and authorization. What is the most recommended and secure OAuth scope setting that an Architect should recommend?
- A. Api
- B. Id
- C. Custom_permissions
- D. Web
Answer: C
Explanation:
Explanation
The most recommended and secure OAuth scope setting for UC's custom mobile app is custom_permissions.
Custom_permissions are settings that can be used in Apex code or validation rules to check whether a user has access to a custom feature or functionality. Custom_permissions can also be used as OAuth scopes to limit the access of an external application, such as UC's mobile app, to certain custom features or functionalities in Salesforce. By configuring custom_permissions as OAuth scopes in the connected app settings, UC can restrict the mobile app access to only the e-signature feature and protect against unauthorized or excessive access.
The other options are not recommended or secure OAuth scope settings for UC's custom mobile app. Id is an OAuth scope that allows the mobile app to access basic information about the user and their org, such as name, email, profile picture, and instance URL. This scope does not provide any access to Salesforce data or features, such as uploading e-signatures. Web is an OAuth scope that allows the mobile app to access Salesforce data and features through a browser or web-view. This scope provides full access to Salesforce data and features, which could expose sensitive information or allow unwanted actions. Api is an OAuth scope that allows the mobile app to make REST or SOAP API calls to Salesforce using the access token. This scope also provides full access to Salesforce data and features, which could compromise security and compliance.
References: [OAuth Scopes], [Connected Apps], [Custom Permissions]
NEW QUESTION # 31
Northern Trail Outfitters (NTO) employees use a custom on-premise helpdesk application to request, approve, notify, and track access granted to various on-premises and cloud applications, including Salesforce.
Salesforce is currently used to authenticate users.
How should NTO provision Salesforce users as soon as they are approved in the helpdesk application with the approved profiles and permission sets?
- A. Build an integration that performs a remote call-in to the Salesforce SOAP or REST API.
- B. Use Salesforce Connect to integrate with the helpdesk application.
- C. Use a login flow to query the helpdesk to validate user status.
- D. Have the helpdesk initiate an IdP-initiated Just-m-Time provisioning Security Assertion Markup Language flow.
Answer: C
NEW QUESTION # 32
Universal Containers (UC) employees have Salesforce access from restricted IP ranges only, to protect against unauthorized access. UC wants to roll out the Salesforce1 mobile app and make it accessible from any location. Which two options should an Architect recommend? Choose 2 answers
- A. Relax the IP restriction with a second factor in the Connect App settings for Salesforce1 mobile app.
- B. Use Login Flow to bypass IP range restriction for the mobile app.
- C. Remove existing restrictions on IP ranges for all types of user access.
- D. Relax the IP restrictions in the Connect App settings for the Salesforce1 mobile app.
Answer: A,D
Explanation:
Explanation
The two options that an architect should recommend for UC to roll out the Salesforce1 mobile app and make it accessible from any location are:
Relax the IP restriction with a second factor in the Connected App settings for Salesforce1 mobile app.
This option allows UC to enable two-factor authentication (2FA) for the Salesforce1 mobile app, which requires users to verify their identity with a second factor, such as a verification code or a mobile app, after entering their username and password. By enabling 2FA in the Connected App settings, UC can relax the IP restriction for the Salesforce1 mobile app, as users can access it from any location as long as they provide the second factor.
Relax the IP restrictions in the Connected App settings for the Salesforce1 mobile app. This option allows UC to disable or modify the IP restriction for the Salesforce1 mobile app in the Connected App settings, which control how users can access a connected app, such as Salesforce1. By relaxing the IP restrictions, UC can allow users to access the Salesforce1 mobile app from any location without requiring 2FA.
The other options are not recommended for this scenario. Removing existing restrictions on IP ranges for all types of user access would compromise security and compliance, as it would expose Salesforce to unauthorized access from any location. Using Login Flow to bypass IP range restriction for the mobile app would require custom code and logic, which could introduce complexity and errors. References: [Connected Apps], [Two-Factor Authentication], [Require a Second Factor of Authentication for Connected Apps], [IP Restrictions for Connected Apps], [Login Flows]
NEW QUESTION # 33 
A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS . The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.
What is recommended to ensure these requirements are met ?
- A. Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.
- B. Configure Each ADFS system under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-
- C. Add a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.
- D. Use connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.
Answer: A
NEW QUESTION # 34
A company with 15,000 employees is using Salesforce and would like to take the necessary steps to highlight or curb fraudulent activity.
Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times and who logged in during non-business hours?
- A. Login Report
- B. Login Inspector
- C. Login History
- D. Login Forensics
Answer: D
Explanation:
Explanation
To track login data and highlight or curb fraudulent activity, the identity architect should use Login Forensics.
Login Forensics is a tool that analyzes login history data and provides insights into user login patterns, such as average number of logins, login outliers, login anomalies, and login risk scores. Login Forensics can help identify suspicious or malicious login attempts and take preventive actions. References: Login Forensics, Login Forensics Implementation Guide
NEW QUESTION # 35
Users logging into Salesforce are frequently prompted to verify their identity.
The identity architect is required to provide recommendations so that frequency of prompt verification can be reduced.
What should the identity architect recommend to meet the requirement?
- A. Implement multi-factor authentication for the Salesforce org.
- B. Set trusted IP ranges for the organization.
- C. Implement an single sign-on for Salesforce using an external identity provider.
- D. Implement 2FA authentication for the Salesforce org.
Answer: B
NEW QUESTION # 36
An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM do to fulfill this requirement?
- A. Create a default account for capturing all ecommerce contacts registered on the community because personAccount is not supported for this case.
- B. Confirm performance considerations with Salesforce Customer Support due to high peaks.
- C. Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.
- D. Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.
Answer: B
NEW QUESTION # 37
universal container plans to develop a custom mobile app for the sales team that will use salesforce for authentication and access management. The mobile app access needs to be restricted to only the sales team.
What would be the recommended solution to grant mobile app access to sales users?
- A. Use connected apps Oauth policies to restrict mobile app access to authorized users.
- B. Use a custom attribute on the user object to control access to the mobile app
- C. Add a new identity provider to authenticate and authorize mobile users.
- D. Use the permission set license to assign the mobile app permission to sales users
Answer: A
NEW QUESTION # 38
The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discuss Salesforce out-of-box capabilities for configuring the company*s login and registration experience on Salesforce Experience Cloud.
The CMO is looking to brand the login page with the company's logo, background color, login button color, and dynamic right-frame from an external URL.
Which two solutions should the IAM specialist recommend?
Choose 2 answers
- A. Use Experience Builder to build branded Reset and Forgot Password pages.
- B. Build custom pages for branding requirements in Experience Cloud.
- C. Build custom site pages for reset and forgot password features.
- D. Login & Registration pages can be branded in the Community Administration settings.
Answer: A,D
Explanation:
Explanation
Experience Builder and Community Administration settings are the tools that allow branding the login and registration pages in Experience Cloud. Custom pages are not necessary for this use case.
References: Architect Journey: Identity and Access Management Trailmix - Trailhead
NEW QUESTION # 39
Universal Container's (UC) is using Salesforce Experience Cloud site for its container wholesale business. The identity architect wants to an authentication provider for the new site.
Which two options should be utilized in creating an authentication provider?
Choose 2 answers
- A. The default authentication provider certificate can be set.
- B. A custom registration handier can be set.
- C. The default login user can be set.
- D. A custom error URL can be set.
Answer: B,D
NEW QUESTION # 40
Containers (UC) uses a legacy Employee portal for their employees to collaborate. Employees access the portal from their company's internal website via SSO. It is set up to work with SiteMinder and Active Directory. The Employee portal has features to support posing ideas. UC decides to use Salesforce Ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to integrate Employee portal ideas with Salesforce idea through the API. What is the role of Salesforce in the context of SSO, based on this scenario?
- A. An independent system, because Salesforce is not part of the SSO setup.
- B. Connected App, because Salesforce is connected with Employee portal via API.
- C. Service Provider, because Salesforce is the application for managing ideas.
- D. Identity Provider, because the API calls are authenticated by Salesforce.
Answer: A
NEW QUESTION # 41
Universal Containers (UC) wants to implement SAML SSO for their internal of Salesforce users using a third-party IdP. After some evaluation, UC decides NOT to SSO set up My Domain for their Salesforce org.
How does that decision impact their SSO implementation?
- A. Neither SP- nor IdP-initiated SSO will work.
- B. IdP-initiated SSO will NOT work.
- C. Either SP- or IdP-initiated SSO will work.
- D. SP-initiated SSO will NOT work
Answer: D
Explanation:
Explanation
This is because without My Domain, Salesforce will not know in advance what Identity Provider (IdP) to use for SSO, since it does not even know yet what Organization the user is trying to log in to1. SP-initiated SSO is the scenario where the user starts with a Salesforce link (login page, deep link, Outlook Sync URL, etc.) and then gets redirected to the IdP for authentication2. Without My Domain, SP-initiated SSO requires that the user do an IdP-initiated SSO at least once first so that Salesforce can set a cookie in their browser identifying the IdP1. The other options are not correct for this question because:
IdP-initiated SSO will work without My Domain, as long as the user starts SSO at the IdP and sends the identity information to Salesforce along with SAML protocol information that identifies the Organization and the IdP2.
Neither SP- nor IdP-initiated SSO will not work is false, as explained above.
Either SP- or IdP-initiated SSO will work is false, as explained above.
References: Considerations for setting up My Domain and SSO - Salesforce, SAML SSO with Salesforce as the Service Provider
NEW QUESTION # 42
Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless experience. The third-party employee portal only supports OAuth.
What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?
- A. Create a custom external authentication provider.
- B. Configure Salesforce for Delegated Authentication.
- C. Add the third-party portal as a connected app.
- D. Configure SSO to use the third-party portal as an identity provider.
Answer: D
Explanation:
Explanation
Configuring SSO to use the third-party portal as an identity provider is the best option to enable SSO between the portal and Salesforce. The portal can use OAuth as the protocol to authenticate users and redirect them to Salesforce. The other options are either not feasible or not relevant for this use case. References: Single Sign-On for Desktop and Mobile Applications using SAML and OAuth, Single Sign-On with SAML on Force.com
NEW QUESTION # 43
Universal containers uses an Employee portal for their employees to collaborate. employees access the portal from their company's internal website via SSO. It is set up to work with Active Directory. What is the role of Active Directory in this scenario?
- A. Authentication store
- B. Identity provider
- C. Service provider
- D. Identity store
Answer: B
NEW QUESTION # 44
An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenario?
- A. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
- B. If the number of provisioned users exceeds Salesforce license allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.
- C. Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.
- D. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.
Answer: D
Explanation:
Explanation
Identity Connect is a tool that synchronizes user data between Microsoft Active Directory and Salesforce. It allows user provisioning, deprovisioning, and single sign-on (SSO) between multiple Active Directory domains and a single Salesforce org. One of the features of Identity Connect is that it can revoke the user's Salesforce session immediately when the user is deprovisioned in an on-premise Active Directory. This can enhance security and compliance by preventing unauthorized access to Salesforce resources. References:
Identity Connect Implementation Guide, Identity Connect Overview
NEW QUESTION # 45
Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers
- A. Resource deep linking
- B. Login forensics
- C. App launcher
- D. SSO from salesforce1 mobile app.
Answer: A,D
NEW QUESTION # 46
Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce?
Choose 2 answers
- A. Users creating simple-to-guess password reset questions.
- B. Users leaving laptops unattended and not logging out of Salesforce.
- C. Users choosing passwords that are the same as their Facebook password.
- D. Users accessing Salesforce from a public Wi-Fi access point.
Answer: C,D
Explanation:
Explanation
Enabling Two-Factor Authentication (2FA) in Salesforce can mitigate the security risks of users accessing Salesforce from a public Wi-Fi access point or choosing passwords that are the same as their Facebook password. 2FA is an additional layer of protection beyond your password that requires users to verify their identity with another factor, such as a mobile app, a security key, or a verification code. This can prevent unauthorized access even if the user's password is compromised or guessed by a malicious actor. The other options are not directly related to 2FA, but rather to user behavior or password policies.
NEW QUESTION # 47
What information does the 'Relaystate' parameter contain in sp-Initiated Single Sign-on?
- A. Reference to a URL redirect parameter at the identity provider.
- B. Reference to a URL redirect parameter at the service provider.
- C. Reference to the login address URL of the service provider.
- D. Reference to the login address URL of the identity Provider.
Answer: B
NEW QUESTION # 48
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?
- A. Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.
- B. Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.
- C. Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.
- D. Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.
Answer: B
Explanation:
Explanation
The best solution to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials is to use SAML federated authentication, treat SAML sessions as high assurance, and raise the session level required for exporting reports. SAML federated authentication is a process that allows users to log in to Salesforce with an external identity provider (IdP), such as AD, that authenticates the user and issues a security token to Salesforce. By treating SAML sessions as high assurance, Salesforce assigns a higher level of trust and security to the sessions that are established by SAML federated authentication. By raising the session level required for exporting reports, Salesforce requires users to have a high assurance session before they can export reports. This solution ensures that only users who log in with AD credentials can export reports, while users who log in with Salesforce credentials can still view reports but not export them.
The other options are not valid solutions for this scenario. Using SAML federated authentication and blocking access to reports when accessed through a standard assurance session would prevent users who log in with Salesforce credentials from viewing reports at all, which is not the desired outcome. Using SAML federated authentication and custom SAML JIT provisioning to dynamically add or remove a permission set that grants the export reports permission would require UC to write custom code and logic to implement the JIT provisioning and manage the permission set, which could increase complexity and cost. Using SAML federated authentication with a login flow to dynamically add or remove a permission set that grants the export reports permission would also require UC to write custom code and logic to implement the login flow and manage the permission set, which could introduce errors and performance issues. References: [SAML Single Sign-On], [Session Security Levels], [Set Session Security Levels for Your Org], [Just-in-Time Provisioning for SAML], [Login Flows]
NEW QUESTION # 49
......
Certification Training for Identity-and-Access-Management-Architect Exam Dumps Test Engine: https://pass4sure.dumpstorrent.com/Identity-and-Access-Management-Architect-exam-prep.html