New 2024 Latest Questions Identity-and-Access-Management-Architect Dumps - Use Updated Salesforce Exam [Q71-Q96]

New 2024 Latest Questions Identity-and-Access-Management-Architect Dumps - Use Updated Salesforce Exam

Latest Identity-and-Access-Management-Architect Exam Dumps Salesforce Exam from Training Expert CertkingdomPDF

Salesforce Identity-and-Access-Management-Architect (IAM) certification exam is designed for professionals who want to demonstrate their expertise in designing and implementing secure identity and access management solutions using Salesforce. Salesforce Certified Identity and Access Management Architect certification is intended for individuals who are responsible for designing and implementing secure identity and access management solutions for Salesforce customers.

 

NEW QUESTION # 71
Universal containers (UC) is concerned that having a self-registration page will provide a means for "bots" or unintended audiences to create user records, thereby consuming licences and adding dirty data. Which two actions should UC take to prevent unauthorised form submissions during the self-registration process? Choose
2 answers

• A. Require a captcha at the end of the self-registration process.
• B. Use open-ended security questions and complex password requirements
• C. Use hidden fields populated via java script events in the self-registration page.
• D. Primarily use lookup and picklist fields on the self registration page.

Answer: A,C

NEW QUESTION # 72
Universal Containers (UC) wants to build a mobile application that twill be making calls to the Salesforce REST API. UC's Salesforce implementation relies heavily on custom objects and custom Apex code. UC does not want its users to have to enter credentials every time they use the app. Which two scope values should an Architect recommend to UC? Choose 2 answers.

• A. Full
• B. Api
• C. Custom_permissions
• D. Refresh_token

Answer: B,D

Explanation:
Explanation
The two scope values that an architect should recommend to UC are api and refresh_token. The api scope allows the app to access the Salesforce REST API and use custom objects and custom Apex code. The refresh_token scope allows the app to obtain a refresh token that can be used to get new access tokens without requiring the user to re-enter credentials. Option A is not a good choice because the custom_permissions scope allows the app to access custom permissions in Salesforce, but it does not affect how the app can access the REST API or avoid user re-authentication. Option D is not a good choice because the full scope allows the app to access all data accessible by the user, including the web UI and the API, but it may be unnecessary or insecure for UC's requirement. References: OAuth 2.0 Web Server Authentication Flow, Digging Deeper into OAuth 2.0 on Force.com

NEW QUESTION # 73
Universal Containers (UC) uses middleware to integrate multiple systems with Salesforce. UC has a strict, new requirement that usernames and passwords cannot be stored in any UC system. How can UC's middleware authenticate to Salesforce while adhering to this requirement?

• A. Create a Connected App that supports the User-Agent OAuth Flow.
• B. Create a Connected App that supports the JWT Bearer Token OAuth Flow.
• C. Create a Connected App that supports the Web Server OAuth Flow.
• D. Create a Connected App that supports the Refresh Token OAuth Flow

Answer: B

NEW QUESTION # 74
Containers (UC) has an existing Customer Community. UC wants to expand the self-registration capabilities such that customers receive a different community experience based on the data they provide during the registration process. What is the recommended approach an Architect Should recommend to UC?

• A. Modify the Community pages to utilize specific fields on the User and Contact records.
• B. Create separate login flows corresponding to the different community user personas.
• C. Modify the existing Communities registration controller to assign different profiles.
• D. Create an After Insert Apex trigger on the user object to assign specific custom permissions.

Answer: A

NEW QUESTION # 75
Refer to the exhibit.

Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?

• A. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.
• B. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.
• C. Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.
• D. For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Answer: B

NEW QUESTION # 76
Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow employees to post Ideas from the Employee portal. When users click on some of the links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with the relevant pages. What OAuth flow is best suited for this scenario?

• A. User-Agent flow
• B. SAML Bearer Assertion flow
• C. Web Server flow
• D. Web Application flow

Answer: C

Explanation:
Explanation
The best OAuth flow for this scenario is the web server flow. The web server flow is an OAuth authorization flow that allows a web application, such as UC's employee portal, to obtain an access token and a refresh token from Salesforce after the user grants permission. The web application can then use the access token to access Salesforce data and features, such as posting ideas, and use the refresh token to obtain a new access token when the previous one expires or becomes invalid. This flow is suitable for UC's scenario because it allows users to be redirected to Salesforce, authenticated, and presented with the relevant pages when they click on some of the links in the employee portal. This flow also provides a secure and seamless user experience by using a confidential client secret that is stored on the web server and not exposed to the browser.
The other options are not valid OAuth flows for this scenario. The web application flow is not a standard term for OAuth, but it could refer to the user-agent flow, which is an OAuth authorization flow that allows a browser or web-view, such as a mobile app or a desktop app, to obtain an access token from Salesforce by using a script or a pop-up window. This flow is not suitable for UC's scenario, as it does not use a web server or a client secret, and it does not provide a refresh token. The SAML bearer assertion flow is an OAuth authorization flow that allows an external application to obtain an access token from Salesforce by using a SAML assertion from an identity provider (IdP) that verifies the user's identity. This flow is not suitable for UC's scenario, as it does not involve user interaction or redirection to Salesforce. The user-agent flow is an OAuth authorization flow that allows a browser or web-view, such as a mobile app or a desktop app, to obtain an access token from Salesforce by using a script or a pop-up window. This flow is not suitable for UC's scenario, as it does not use a web server or a client secret, and it does not provide a refresh token. References:
[OAuth Authorization Flows], [OAuth 2.0 Web Server Flow for Web App Integration], [OAuth 2.0 User-Agent Flow for Desktop Apps], [OAuth 2.0 SAML Bearer Assertion Flow for Server-to-Server Integration]

NEW QUESTION # 77
An administrator created a connected app for a custom wet) application in Salesforce which needs to be visible as a tile in App Launcher The tile for the custom web application is missing in the app launcher for all users in Salesforce. The administrator requested assistance from an identity architect to resolve the issue.
Which two reasons are the source of the issue?
Choose 2 answers

• A. OAuth scope does not include "openid".
• B. StartURL for the connected app is not set in Connected App settings.
• C. The connected app is not set in the App menu as 'Visible in App Launcher".
• D. Session Policy is set as 'High Assurance Session required' for this connected app.

Answer: B,C

Explanation:
Explanation
The StartURL for the connected app is required to specify the landing page for the app. The connected app must also be set as visible in the App Launcher to appear as a tile for users. References: Connected App Basics, Manage Connected Apps

NEW QUESTION # 78
Northern Trail Outfitters (NTO) employees use a custom on-premise helpdesk application to request, approve, notify, and track access granted to various on-premises and cloud applications, including Salesforce.
Salesforce is currently used to authenticate users.
How should NTO provision Salesforce users as soon as they are approved in the helpdesk application with the approved profiles and permission sets?

• A. Build an integration that performs a remote call-in to the Salesforce SOAP or REST API.
• B. Use Salesforce Connect to integrate with the helpdesk application.
• C. Use a login flow to query the helpdesk to validate user status.
• D. Have the helpdesk initiate an IdP-initiated Just-m-Time provisioning Security Assertion Markup Language flow.

Answer: A

Explanation:
Explanation
Building an integration that performs a remote call-in to the Salesforce SOAP or REST API is the best way to provision Salesforce users as soon as they are approved in the helpdesk application. The API allows creating and updating user records with the approved profiles and permission sets. The other options are either not suitable or not sufficient for this use case. References: User SOAP API Developer Guide, User REST API Developer Guide

NEW QUESTION # 79
Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.
What should an identity architect do to fulfill this requirement?

• A. Use certificate-based authentication.
• B. Create a custom external authentication provider.
• C. Contact Salesforce Support and enable delegate single sign-on.
• D. Configure OpenID Connect authentication provider.

Answer: B

NEW QUESTION # 80
A financial enterprise is planning to set up a user authentication mechanism to login to the Salesforce system.
Due to regulatory requirements, the CIO of the company wants user administration, including passwords and authentication requests, to be managed by an external system that is only accessible via a SOAP webservice.
Which authentication mechanism should an identity architect recommend to meet the requirements?

• A. Identity Connect
• B. OAuth Web-Server Flow
• C. Delegated Authentication
• D. Just-in-Time Provisioning

Answer: C

NEW QUESTION # 81
Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce?
Choose 2 answers

• A. Request Salesforce Support to enable delegated authentication.
• B. Assign user "is Single Sign-on Enabled" permission via profile or permission set.
• C. Enable My Domain and select "Prevent login from https://login.salesforce.com".
• D. Once SSO is enabled, users are only able to login using Salesforce credentials.

Answer: B,C

Explanation:
Explanation
To ensure end users can only use single sign-on (SSO) to log in to Salesforce, two things should be done:
Enable My Domain and select "Prevent login from https://login.salesforce.com". My Domain is a feature that allows administrators to customize the Salesforce login URL with a unique domain name.
By preventing login from the standard login URL, administrators can enforce SSO and restrict users from logging in with their Salesforce credentials.
Assign user "is Single Sign-on Enabled" permission via profile or permission set. This permission allows users to log in to Salesforce using SSO. Users who do not have this permission will not be able to access Salesforce even if they have valid Salesforce credentials. References: My Domain, User Permissions for Single Sign-On

NEW QUESTION # 82
Northern Trail Outfitters (NTO) wants its customers to use phone numbers to log in to their new digital portal, which was designed and built using Salesforce Experience Cloud. In order to access the portal, the user will need to do the following:
1. Enter a phone number and/or email address
2. Enter a verification code that is to be sent via email or text.
What is the recommended approach to fulfill this requirement?

• A. Create a custom login page with an Apex controller. The controller has logic to send and verify the identity.
• B. Create a custom login flow that uses an Apex controller to verify the phone numbers with the company's verification service.
• C. Create a Login Discovery page and provide a Login Discovery Handler Apex class.
• D. Create an Authentication provider and implement a self-registration handler class.

Answer: C

NEW QUESTION # 83
Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers

• A. Delegated Authentication is enabled or disabled for the entire Salesforce org.
• B. Salesforce users will be locked out of Salesforce if the web service goes down.
• C. The web service must reside on a public cloud service, such as Heroku.
• D. UC will be required to develop and support a custom SOAP web service.

Answer: B,D

NEW QUESTION # 84
Universal Containers built a custom mobile app for their field reps to create orders in Salesforce. OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained automatically without forcing the user to log in again. While that improved the field reps' productivity, UC realized that they need a "logout" feature.
What should the logout function perform in this scenario, where user sessions are refreshed automatically?

• A. Clear out the client Id to stop auto session refresh.
• B. Clear out all the tokens to stop auto session refresh.
• C. Invoke the revocation URL and pass the refresh token.
• D. Invoke the revocation URL and pass the access token.

Answer: C

Explanation:
Explanation
The refresh token is used to obtain a new access token when the previous one expires. To revoke the user session, the logout function should invoke the revocation URL and pass the refresh token as a parameter. This will invalidate both the refresh token and the access token, and prevent the user from accessing Salesforce without logging in again2.
References:
Certification Exam Guide
Revoke OAuth Tokens

NEW QUESTION # 85
Universal Containers (UC) uses middleware to integrate multiple systems with Salesforce. UC has a strict, new requirement that usernames and passwords cannot be stored in any UC system. How can UC's middleware authenticate to Salesforce while adhering to this requirement?

• A. Create a Connected App that supports the User-Agent OAuth Flow.
• B. Create a Connected App that supports the JWT Bearer Token OAuth Flow.
• C. Create a Connected App that supports the Web Server OAuth Flow.
• D. Create a Connected App that supports the Refresh Token OAuth Flow

Answer: B

Explanation:
Explanation
A is correct because creating a connected app that supports the JWT Bearer Token OAuth Flow allows the middleware to authenticate to Salesforce without storing usernames and passwords. The JWT Bearer Token OAuth Flow uses a certificate and a private key to sign a JSON Web Token (JWT) that contains information about the user identity and requested access. The middleware sends the JWT to Salesforce, which verifies it using the certificate and grants an access token2.
B is incorrect because creating a connected app that supports the Refresh Token OAuth Flow requires storing usernames and passwords in the middleware. The Refresh Token OAuth Flow uses a username-password authentication flow to obtain an access token and a refresh token. The middleware can use the refresh token to obtain new access tokens without user interaction, but it still needs to store the username and password for the initial authentication3.
C is incorrect because creating a connected app that supports the Web Server OAuth Flow requires user interaction to authenticate to Salesforce. The Web Server OAuth Flow redirects the user to a Salesforce login page, where they enter their credentials and grant access to the middleware. The middleware then receives an authorization code that it can exchange for an access token and a refresh token4.
D is incorrect because creating a connected app that supports the User-Agent OAuth Flow also requires user interaction to authenticate to Salesforce. The User-Agent OAuth Flow is similar to the Web Server OAuth Flow, except that it does not return a refresh token. The middleware can only use the access token until it expires5.
References: 2: Accessing Salesforce with JWT OAuth Flow 3: OAuth Authorization Flows - Salesforce 4: OAuth Authorization Flows - Salesforce 5: OAuth Authorization Flows - Salesforce

NEW QUESTION # 86
Universal Containers (UC) wants to build a custom mobile app for their field reps to create orders in salesforce. After the first time the users log in, they must be able to access salesforce upon opening the mobile app without being prompted to log in again. What Oauth flows should be considered to support this requirement?

• A. SAML Assertion flow with a Bearer Token.
• B. User Agent flow with a Refresh Token.
• C. Mobile Agent flow with a Bearer Token.
• D. Web Server flow with a Refresh Token.

Answer: B,D

Explanation:
Explanation
The OAuth 2.0 user-agent flow and the OAuth 2.0 web server flow are both suitable for building a custom mobile app that can access Salesforce data without prompting the user to log in again1. Both of these flows use a refresh token that can be used to obtain a new access token when the previous one expires2. The user-agent flow uses the Canvas JavaScript SDK to obtain an OAuth token by using the login function in the SDK2. The web server flow redirects the user to the Salesforce OAuth authorization endpoint and then obtains an OAuth access token by making a POST request to the Salesforce OAuth token endpoint2. The mobile agent flow and the SAML assertion flow are not valid OAuth flows for Salesforce3.
References: OAuth Authorization Flows, Mastering Salesforce Canvas Apps, Access Data with API Integration

NEW QUESTION # 87
Containers (UC) uses a legacy Employee portal for their employees to collaborate. Employees access the portal from their company's internal website via SSO. It is set up to work with SiteMinder and Active Directory. The Employee portal has features to support posing ideas. UC decides to use Salesforce Ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to integrate Employee portal ideas with Salesforce idea through the API. What is the role of Salesforce in the context of SSO, based on this scenario?

• A. Connected App, because Salesforce is connected with Employee portal via API.
• B. Identity Provider, because the API calls are authenticated by Salesforce.
• C. An independent system, because Salesforce is not part of the SSO setup.
• D. Service Provider, because Salesforce is the application for managing ideas.

Answer: C

NEW QUESTION # 88
An identity architect's client has a homegrown identity provider (IdP). Salesforce is used as the service provider (SP). The head of IT is worried that during a SP initiated single sign-on (SSO), the Security Assertion Markup Language (SAML) request content will be altered.
What should the identity architect recommend to make sure that there is additional trust between the SP and the IdP?

• A. Ensure that the Issuer and Assertion Consumer service (ACS) URL is property configured between SP and IDP.
• B. Ensure that there is an HTTPS connection between IDP and SP.
• C. Encrypt the SAML Request using certification authority (CA) signed certificate and decrypt on IdP.
• D. Ensure that on the SSO settings page, the "Request Signing Certificate" field has a self-signed certificate.

Answer: C

Explanation:
Explanation
Encrypting the SAML Request using a CA signed certificate and decrypting it on the IdP ensures that the request content is not altered or tampered with during transit. This also adds an extra layer of security and trust between the SP and the IdP. References: SAML Single Sign-On Overview, SAML Assertion Encryption

NEW QUESTION # 89
An insurance company has a connected app in its Salesforce environment that is used to integrate with a Google Workspace (formerly knot as G Suite).
An identity and access management (IAM) architect has been asked to implement automation to enable users, freeze/suspend users, disable users, and reactivate existing users in Google Workspace upon similar actions in Salesforce.
Which solution is recommended to meet this requirement?

• A. Build an Apex trigger on the userlogin object to make asynchronous callouts to Google APIs.
• B. Build a custom REST endpoint in Salesforce that Google Workspace can poll against.
• C. Update the Security Assertion Markup Language Just-in-Time (SAML JIT) handler in Salesforce for user provisioning and de-provisioning.
• D. Configure user Provisioning for Connected Apps.

Answer: D

NEW QUESTION # 90
Universal Containers (UC) uses Salesforce as a CRM and identity provider (IdP) for their Sales Team to seamlessly login to intemaJ portals. The IT team at UC is now evaluating Salesforce to act as an IdP for its remaining employees.
Which Salesforce license is required to fulfill this requirement?

• A. Identity Connect
• B. External Identity
• C. Identity Verification
• D. Identity Only

Answer: D

NEW QUESTION # 91
Universal Containers is implementing a new Experience Cloud site and the identity architect wants to use dynamic branding features as of the login process.
Which two options should the identity architect recommend to support dynamic branding for the site?
Choose 2 answers

• A. To use dynamic branding, the community must be built with the Customer Account Portal template.
• B. An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand.
• C. To use dynamic branding, the community must be built with the Visuaiforce + Salesforce Tabs template.
• D. An external content management system (CMS) must be used for dynamic branding on Experience Cloud sites.

Answer: A,B

Explanation:
Explanation
Dynamic branding is a feature that allows Experience Cloud sites to display different branding elements, such as logos, colors, or images, based on the user's profile or preferences. To use dynamic branding, the community must be built with the Customer Account Portal template, which supports this feature. An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand and trigger the dynamic branding logic.
References: Dynamic Branding for Experience Cloud Sites, Create a Customer Account Portal

NEW QUESTION # 92
Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financial system, and CPQ system. Below is the SSO implementation landscape.

What role combination is represented by the systems in this scenario''

• A. Salesforce Org1 and PingFederate are acting as Identity Providers.
• B. Financial System and CPQ System are the only Service Providers.
• C. Salesforce Org1 and Salesforce Org2 are acting as Identity Providers.
• D. Salesforce Org1 and Salesforce Org2 are the only Service Providers.

Answer: D

Explanation:
Explanation
In a SAML-based SSO scenario, the identity provider (IdP) is the system that performs authentication and passes the user's identity and authorization level to the service provider (SP), which trusts the IdP and authorizes the user to access the requested resource1. In this case, PingFederate is the IdP that authenticates users for UC and sends SAML assertions to the SPs. The SPs are the systems that rely on PingFederate for authentication and provide access to their services based on the SAML assertions. The SPs in this scenario are Salesforce Org1, Salesforce Org2, Financial System, and CPQ System2. Therefore, the correct answer is B.
References:
SAML web-based authentication guide
SAML-based single sign-on: Configuration and Limitations

NEW QUESTION # 93
Universal Containers (UC) is building a customer community and will allow customers to authenticate using Facebook credentials. The First time the user authenticating using Facebook, UC would like a customer account created automatically in their accounting system. The accounting system has a web service accessible to Salesforce for the creation of accounts. How can the Architect meet these requirements?

• A. Use OAuth JWT flow to pass the data from Salesforce to the Accounting System.
• B. Use JIT Provisioning to automatically create the account in the accounting system.
• C. Add an Apex callout in the registration handler of the authorization provider.
• D. Create a custom application on Heroku that manages the sign-on process from Facebook.

Answer: C

Explanation:
Explanation
The best option for UC to meet the requirements is to add an Apex callout in the registration handler of the authorization provider. An authorization provider is a configuration in Salesforce that allows users to log in with an external authentication provider, such as Facebook. A registration handler is an Apex class that implements the Auth.RegistrationHandler interface and defines the logic for creating or updating a user account when a user logs in with an external authentication provider. An Apex callout is a method that invokes an external web service from Apex code. By adding an Apex callout in the registration handler, UC can create a customer account in their accounting system by calling the web service that is accessible to Salesforce. This option enables UC to automate the account creation process and integrate with their existing accounting system. The other options are not optimal for this scenario. Creating a custom application on Heroku that manages the sign-on process from Facebook would require UC to develop and maintain a separate application and infrastructure, which could increase complexity and cost. Using JIT provisioning to automatically create the account in the accounting system would require UC to configure Facebook as a SAML identity provider, which is not supported by Facebook. Using OAuth JWT flow to pass the data from Salesforce to the accounting system would require UC to obtain an OAuth token from the accounting system and use it to make API calls, which could introduce security and performance issues. References: [Authorization Providers],
[Create a Registration Handler Class], [Auth.RegistrationHandler Interface], [Apex Callouts], [Facebook as SAML Identity Provider], [OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration]

NEW QUESTION # 94
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have been purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

• A. Enable "Allow customers and partners to self-register".
• B. Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.
• C. Select the "Configurable Self-Reg Page" option under Login & Registration.
• D. Customize me self-registration Apex handler to create only the user record.
• E. Set jp an external login page and call Salesforce APIs for user creation.

Answer: A,C,D

Explanation:
Explanation
Enabling "Allow customers and partners to self-register" allows guests to create their own user accounts in the portal. Selecting the "Configurable Self-Reg Page" option allows the administrator to customize the self-registration page to capture the required fields. Customizing the self-registration Apex handler to create only the user record prevents the automatic creation of a contact record until verification. References: Enable Self-Registration, Customize Self-Registration

NEW QUESTION # 95
Universal Containers (UC) is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.
Which two page types are valid login page types for the site?
Choose 2 answers

• A. lightning Experience Page
• B. Experience Builder Page
• C. Embedded Login Page
• D. Login Discovery Page

Answer: C,D

Explanation:
Explanation
Login Discovery Page and Embedded Login Page are two valid login page types for Experience Cloud sites.
Login Discovery Page allows users to choose their preferred login method, such as username/password, SSO, or social sign-on. Embedded Login Page allows users to log in from any site page without being redirected to a separate login page. References: Login Discovery Page, Embedded Login

NEW QUESTION # 96
......

Updated Test Engine to Practice Identity-and-Access-Management-Architect Dumps & Practice Exam: https://www.certkingdompdf.com/Identity-and-Access-Management-Architect-latest-certkingdom-dumps.html

Pass Salesforce Identity-and-Access-Management-Architect PDF Dumps Recently Updated 245 Questions: https://drive.google.com/open?id=11UAiYXJCkyJLP3T_HuVR8V9p6YWtKIC_