(2024) Identity-and-Access-Management-Designer Dumps and Practice Test (245 Questions)
Guide (New 2024) Actual Salesforce Identity-and-Access-Management-Designer Exam Questions
NEW QUESTION # 55
Universal Containers (UC) is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.
Which two page types are valid login page types for the site?
Choose 2 answers
- A. lightning Experience Page
- B. Experience Builder Page
- C. Embedded Login Page
- D. Login Discovery Page
Answer: C,D
NEW QUESTION # 56
A consumer products company uses Salesforce to maintain consumer information, including orders. The company implemented a portal solution using Salesforce Experience Cloud for its consumers where the consumers can log in using their credentials. The company is considering allowing users to login with their Facebook or Linkedln credentials.
Once enabled, what role will Salesforce play?
- A. Facebook and Linkedln will be the SPs.
- B. Facebook and Linkedln will act as the IdPs and SPs.
- C. Salesforce will be the service provider (SP).
- D. Salesforce will be the identity provider (IdP).
Answer: C
NEW QUESTION # 57
IT security at Unversal Containers (UC) us concerned about recent phishing scams targeting its users and wants to add additional layers of login protection. What should an Architect recommend to address the issue?
- A. Increase Password complexity requirements in Salesforce.
- B. Implement Single Sign-on using a corporate Identity store.
- C. Lock sessions to the IP address from which they originated.
- D. Use the Salesforce Authenticator mobile app with two-step verification
Answer: D
NEW QUESTION # 58
Universal Containers (UC) has built a custom time tracking app for its employee. UC wants to leverage Salesforce Identity to control access to the custom app.
At a minimum, which Salesforce license is required to support this requirement?
- A. Identity Only
- B. Identity Connect
- C. Identity Verification
- D. External Identity
Answer: A
NEW QUESTION # 59
Universal Containers (UC) has a Customer Community that uses Facebook for of authentication. UC would like to ensure that changes in the Facebook profile are 65. reflected on the appropriate Customer Community user. How can this requirement be met?
- A. Use SAML Just-In-Time Provisioning between Facebook and Salesforce.
- B. Use information in the Signed Request that is received from Facebook.
- C. Use the updateUser() method on the Registration Handler class.
- D. Develop a scheduled job that calls out to Facebook on a nightly basis.
Answer: C
NEW QUESTION # 60
Which two capabilities does My Domain enable in the context of a SAML SSO configuration? Choose 2 answers
- A. Login Forensics
- B. App Launcher
- C. SSO from Salesforce Mobile App
- D. Resource deep linking
Answer: C,D
NEW QUESTION # 61
Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?
- A. Check the Refresh Token policy defined in the Salesforce Connected App.
- B. Verify that the Callback URL is correctly pointing to the new URI Scheme.
- C. Confirm that the access Token's Time-To-Live policy has been set appropriately.
- D. Validate that the users are checking the box to remember their passwords.
Answer: A
NEW QUESTION # 62
Which three capabilities does SAML-based Federated authentication provide? (Choose three.)
- A. Access tokens are used to access resources on the server once the user is authenticated.
- B. Web applications with no passwords are more secure and stronger against hacks.
- C. Centralized federation provides single point of access, control and auditing.
- D. SAML tokens can be in XML or JSON format and can be used interchangeably.
- E. Trust relationships between Identity Provider and Service Provider are required.
Answer: A,C,E
NEW QUESTION # 63
Containers (UC) has decided to implement a federated single Sign-on solution using a third-party Idp. In reviewing the third-party products, they would like to ensure the product supports the automated provisioning and deprovisioning of users. What are the underlining mechanisms that the UC Architect must ensure are part of the product?
- A. SOAP API for provisioning; Just-in-Time (JIT) for Deprovisioning.
- B. Just-In-time (JIT) for Provisioning; SOAP API for Deprovisioning.
- C. Just-in-Time (JIT) for both Provisioning and Deprovisioning.
- D. Provisioning API for both Provisioning and Deprovisioning.
Answer: C
NEW QUESTION # 64
Universal Containers (UC) has an existing e-commerce platform and is implementing a new customer community. They do not want to force customers to register on both applications due to concern over the customers experience. It is expected that 25% of the e-commerce customers willutilize the customer community . The e-commerce platform is capable of generating SAML responses and has an existing REST-ful API capable of managing users. How should UC create the identities of its e-commerce users with the customer community?
- A. Use anightly batch ETL job to sync users between the Customer Community and the e-commerce platform and use SAML to allow SSO.
- B. Use the e-commerce REST API to create users when a user self-register on the customer community and use SAML to allow SSO.
- C. Use the standard Salesforce API to create users in the Community When a User is Created in the e-Commerce platform and use SAML toallow SSO.
- D. UseSAML JIT in the Customer Community to create users when a user tries to login to the community from the e-commerce site.
Answer: D
NEW QUESTION # 65
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?
- A. Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.
- B. Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.
- C. Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.
- D. Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.
Answer: A
NEW QUESTION # 66
Universal Containers (UC) wants to integrate a web application with Salesforce. The UC team has implemented the OAuth Web-Server Authentication Flow for authentication purposes.
Which two considerations should an Architect point out to UC? (Choose two.)
- A. The web application should be hosted on a secure server.
- B. The flow will NOT provide an OAuth Refresh Token back to the server.
- C. The flow involves passing the user credentials back and forth.
- D. The web server must be able to protect consumer secret.
Answer: A,D
NEW QUESTION # 67
universal container plans to develop a custom mobile app for the sales team that will use salesforce for authentication and access management. The mobile app access needs to be restricted to only the sales team.
What would be the recommended solution to grant mobile app access to sales users?
- A. Use a custom attribute on the user object to control access to the mobile app
- B. Use the permission set license to assign the mobile app permission to sales users
- C. Use connected apps Oauth policies to restrict mobile app access to authorized users.
- D. Add a new identity provider to authenticate and authorize mobile users.
Answer: C
NEW QUESTION # 68
The CIO of universal containers(UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize Oauth 2.0. UC has listed an architect to analyze all of the applications that use Oauth flows to. See where refresh Tokens can be applied. Which two OAuth flows should the architect consider in their evaluation? Choose 2 answers
- A. Jwt bearer token
- B. Web server
- C. Username-password
- D. User-Agent
Answer: B,D
NEW QUESTION # 69
Universal containers(UC) has a customer Community that uses Facebook for authentication. UC would like to ensure that changes in the Facebook profile are reflected on the appropriate customer Community user. How can this requirement be met?
- A. Use information in the signed request that is received from Facebook.
- B. Develop a schedule job that calls out to Facebook on a nightly basis.
- C. Use the updateuser() method on the registration handler class.
- D. Use SAML just-in-time provisioning between Facebook and Salesforce
Answer: C
NEW QUESTION # 70
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers
- A. Set jp an external login page and call Salesforce APIs for user creation.
- B. Select the "Configurable Self-Reg Page" option under Login & Registration.
- C. Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.
- D. Enable "Allow customers and partners to self-register".
- E. Customize me self-registration Apex handler to create only the user record.
Answer: B,D,E
NEW QUESTION # 71
How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when NOT connected to an internal company network?
- A. Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.
- B. Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.
- C. Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.
- D. Add the company's list of network IP addresses to the Login Range list under 2FA Setup.
Answer: C
NEW QUESTION # 72
Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?
- A. The Oauth authorizations are being revoked by a nightly batch job.
- B. The app is requesting too many access Tokens in a 24-hour period
- C. The refresh token expiration policy is set incorrectly in salesforce
- D. The users forget to check the box to remember their credentials.
Answer: C
NEW QUESTION # 73
Universal Containers (UC) wants to integrate a third-party Reward Calculation system with Salesforce to calculate Rewards. Rewards will be calculated on a schedule basis and update back into Salesforce. The integration between Salesforce and the Reward Calculation System needs to be secure. Which are two recommended practices for using OAuth flow in this scenario. choose 2 answers
- A. OAuth JWT Bearer Token FLow
- B. OAuth Refresh Token FLow
- C. OAuth Username-Password Flow
- D. OAuth SAML Bearer Assertion FLow
Answer: A,D
NEW QUESTION # 74
Universal Containers want users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN.
Which two options should an identity architect recommend to meet the requirement?
Choose 2 answers
- A. Configure Cloud Provider Load Balancer
- B. Salesforce Trigger & Field on Contact Object
- C. Salesforce Identity Connect
- D. Active Directory Password Sync Plugin
Answer: C,D
NEW QUESTION # 75
......
Identity-and-Access-Management-Designer Exam Dumps Pass with Updated 2024 Certified Exam Questions: https://whizlabs.actual4dump.com/Salesforce/Identity-and-Access-Management-Designer-actualtests-dumps.html