[Q77-Q95] Latest Salesforce Identity-and-Access-Management-Architect First Attempt, Exam real Dumps Updated [Aug-2024]

Identity-and-Access-Management-Architect Salesforce

admin -

August 2, 2024

Rate this post

Latest Salesforce Identity-and-Access-Management-Architect First Attempt, Exam real Dumps Updated [Aug-2024]

Get the superior quality Identity-and-Access-Management-Architect Dumps Questions from DumpsTests. Nobody can stop you from getting to your dreams now. Your bright future is just a click away!

QUESTION 77
Universal Containers (UC) has a Customer Community that uses Facebook for Authentication. UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user:
How can this requirement be met?

Use the updateUser method on the registration Handler Class.

Develop a scheduled job that calls out to Facebook on a nightly basis.

Use information in the signed Request that is received from facebook.

Use SAML Just-In-Time Provisioning between Facebook and Salesforce.

QUESTION 78
Universal containers (UC) has implemented SAML -based single Sign-on for their salesforce application. UC is using PingFederate as the Identity provider. To access salesforce, Users usually navigate to a bookmarked link to my domain URL. What type of single Sign-on is this?

Sp-Initiated

IDP-initiated with deep linking

IDP-initiated

Web server flow.

Explanation
The type of single sign-on that UC is using is SP-initiated, which means that the service provider (Salesforce) initiates the SSO process by sending a SAML request to the identity provider (PingFederate) when the user navigates to the My Domain URL3. Therefore, option A is the correct answer. References: SAML SSO with Salesforce as the Service Provider

QUESTION 79
Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers

Resource deep linking

App launcher

SSO from salesforce1 mobile app.

Explanation
Enabling My Domain in the context of a SAML SSO configuration enables resource deep linking and SSO from Salesforce1 mobile app. Resource deep linking allows users to access specific records or pages after logging in with SSO5. SSO from Salesforce1 mobile app requires using the My Domain URL as the login server4. Enabling My Domain does not affect the app launcher or login forensics features. Therefore, option A and C are the correct answers. References: Salesforce Mobile Application Single Sign-On overview, SAML SSO with Salesforce as the Service Provider, Single Sign-On, Considerations for setting up My Domain and SSO

QUESTION 80
How should an identity architect automate provisioning and deprovisioning of users into Salesforce from an external system?

Call SOAP API upsertQ on user object.

Use Security Assertion Markup Language Just-in-Time (SAML JIT) on incoming SAML assertions.

Run registration handler on incoming OAuth responses.

Call OpenID Connect (OIDC)-userinfo endpoint with a valid access token.

Explanation
To automate provisioning and deprovisioning of users into Salesforce from an external system, the identity architect should run a registration handler on incoming OAuth responses. A registration handler is a class that implements the Auth.RegistrationHandler interface and defines how to create or update users in Salesforce based on the information from an external identity provider. OAuth is a protocol that allows users to authorize an external application to access Salesforce resources on their behalf. By running a registration handler on incoming OAuth responses, the identity architect can automate user provisioning and deprovisioning based on the OAuth attributes. References: Registration Handler, Authorize Apps with OAuth

QUESTION 81
Universal Containers (UC) is using a custom application that will act as the Identity Provider and will generate SAML assertions used to log in to Salesforce. UC is considering including custom parameters in the SAML assertion. These attributes contain sensitive data and are needed to authenticate the users. The assertions are submitted to salesforce via a browser form post. The majority of the users will only be able to access Salesforce via UC’s corporate network, but a subset of admins and executives would be allowed access from outside the corporate network on their mobile devices. Which two methods should an Architect consider to ensure that the sensitive data cannot be tampered with, nor accessible to anyone while in transit?

Use the Identity Provider’s certificate to digitally sign and Salesforce’s Certificate to encrypt the payload.

Use Salesforce’s Certificate to digitally sign the SAML Assertion and a Mobile Device Management client on the users’ mobile devices.

Use the Identity provider’s certificate to digitally Sign and the Identity provider’s certificate to encrypt the payload.

Use a custom login flow to retrieve sensitive data using an Apex callout without including the attributes in the assertion.

QUESTION 82
Universal Containers (UC) has a Customer Community that uses Facebook for Authentication. UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user:
How can this requirement be met?

Use the updateUser method on the registration Handler Class.

Develop a scheduled job that calls out to Facebook on a nightly basis.

Use information in the signed Request that is received from facebook.

Use SAML Just-In-Time Provisioning between Facebook and Salesforce.

Explanation
The best option for UC to ensure that changes in the Facebook profile are reflected on the appropriate customer community user is to use the updateUser method on the registration handler class. A registration handler class is an Apex class that implements the Auth.RegistrationHandler interface and defines the logic for creating or updating a user account when a user logs in with an external authentication provider, such as Facebook. The updateUser method is a method in the registration handler class that takes a user ID and a JSON string as parameters and updates the user record with the information from the JSON string. This method can be used to update the user’s profile, email, name, or other attributes based on the changes in the Facebook profile. The other options are not optimal for this scenario. Developing a scheduled job that calls out to Facebook on a nightly basis would introduce a delay in updating the user information and require custom code and API integration. Using information in the signed request that is received from Facebook would only provide limited information about the user, such as name, email, and locale, and not reflect any changes made after the initial login. Using SAML Just-in-Time provisioning between Facebook and Salesforce would require UC to configure Facebook as a SAML identity provider, which is not supported by Facebook. References:
[Create a Registration Handler Class], [Auth.RegistrationHandler Interface], [Facebook Signed Request],
[Facebook as SAML Identity Provider]

QUESTION 83
Universal Containers has multiple Salesforce instances where users receive emails from different instances.
Users should be logged into the correct Salesforce instance authenticated by their IdP when clicking on an email link to a Salesforce record.
What should be enabled in Salesforce as a prerequisite?

My Domain

External Identity

Identity Provider

Multi-Factor Authentication

QUESTION 84
An architect has successfully configured SAML-BASED SSO for universal containers. SSO has been working for 3 months when Universal containers manually adds a batch of new users to salesforce. The new users receive an error from salesforce when trying to use SSO. Existing users are still able to successfully use SSO to access salesforce. What is the probable cause of this behaviour?

The administrator forgot to reset the new user’s salesforce password.

The Federation ID field on the new user records is not correctly set

The my domain capability is not enabled on the new user’s profile.

The new users do not have the SSO permission enabled on their profiles.

Explanation
The Federation ID field on the new user records is not correctly set is the probable cause of this behavior. The Federation ID is an additional field contained in the Salesforce interface that allows admins to pick whatever username or username format they want to pass to Salesforce from their user directory for single sign-on. This field does not appear on the user page layout editor or on the user record page by default, and it must be populated with a unique value that matches the identity provider’s assertion for each user. If the Federation ID is missing or incorrect, the SSO will fail. The administrator does not need to reset the new user’s Salesforce password, as SSO bypasses the password authentication. The My Domain capability is not enabled on the new user’s profile, but on the org level, so it does not affect individual users. The new users do not have the SSO permission enabled on their profiles is not a valid option, as there is no such permission in Salesforce.
References: Certification – Identity and Access Management Architect – Trailhead, Federation ID field on User detail page is not visible, What is the purpose of Salesforce SSO by federation ID?

QUESTION 85
An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?

Users once logged In, can go to the Change Password screen in Salesforce.

Users can click on the “Forgot your Password” link on the Salesforce.com login page.

Users can request the Salesforce Admin to reset their password.

Users can change it on the enterprise LDAP authentication portal.

Explanation
Users can request the Salesforce Admin to reset their password if they are using delegated authentication with LDAP. The other options are not applicable for this scenario, as the password is managed by the LDAP server, not by Salesforce. References: Delegated Authentication, FAQs for Delegated Authentication

QUESTION 86
Universal Containers (UC) uses Global Shipping (GS) as one of their shipping vendors. Regional leads of GS need access to UC’s Salesforce instance for reporting damage of goods using Cases. The regional leads also need access to dashboards to keep track of regional shipping KPIs. UC internally uses a third-party cloud analytics tool for capacity planning and UC decided to provide access to this tool to a subset of GS employees.
In addition to regional leads, the GS capacity planning team would benefit from access to this tool. To access the analytics tool, UC IT has set up Salesforce as the Identity provider for Internal users and would like to follow the same approach for the GS users as well. What are the most appropriate license types for GS Tregional Leads and the GS Capacity Planners? Choose 2 Answers

Customer Community Plus license for GS Regional Leads and External Identity for GS Capacity Planners.

Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.

Identity License for GS Regional Leads and External Identity license for GS capacity Planners.

Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.

Explanation
The most appropriate license types for GS regional leads and the GS capacity planners are:
Customer Community Plus license for GS regional leads. This license type allows external users, such as customers or partners, to access standard Salesforce objects, such as cases and dashboards, and custom objects in a community. This license type also supports role hierarchy, sharing rules, and reports.
This license type is suitable for GS regional leads who need to report damage of goods using cases and access dashboards to track regional shipping KPIs.
External Identity license for GS capacity planners. This license type allows external users to access a limited set of standard Salesforce objects, such as contacts and documents, and custom objects in a community. This license type also supports identity features, such as single sign-on (SSO) and social sign-on. This license type is suitable for GS capacity planners who need to access the third-party cloud analytics tool using Salesforce as the identity provider.
The other options are not appropriate license types for this scenario. Customer Community license for GS capacity planners would not allow them to access the third-party cloud analytics tool using SSO, as this license type does not support identity features. Identity license for GS regional leads would not allow them to access cases and dashboards in the community, as this license type does not support standard Salesforce objects.
References: [Customer Community Plus Licenses], [External Identity Licenses], [Customer Community Licenses], [Identity Licenses]

QUESTION 87
Universal Containers (UC) is looking to build a Canvas app and wants to use the corresponding Connected App to control where the app is visible. Which two options are correct in regards to where the app can be made visible under the Connected App setting for the Canvas app? Choose 2 answers

As part of the body of a Salesforce Knowledge article.

In the mobile navigation menu on Salesforce for Android.

The sidebar of a Salesforce Console as a console component.

Included in the Call Control Tool that’s part of Open CTI.

QUESTION 88
An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM do to fulfill this requirement?

Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.

Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.

Create a default account for capturing all ecommerce contacts registered on the community because person Account is not supported for this case.

Confirm performance considerations with Salesforce Customer Support due to high peaks.

Explanation
According to the Salesforce documentation2, OAuth2 RPs (relying parties) are applications that use OAuth 2.0 for authentication and authorization with an external identity provider. This allows users to log in to multiple applications with a single identity provider account. The identity provider issues an access token to the relying party, which can be used to access protected resources on behalf of the user. This solution can support high volumes of logins per minute and unify multiple B2C Commerce sites and an Experience Cloud community with a single identity.

QUESTION 89
Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.
What should an identity architect do to fulfill this requirement?

Contact Salesforce Support and enable delegate single sign-on.

Create a custom external authentication provider.

Use certificate-based authentication.

Configure OpenID Connect authentication provider.

QUESTION 90
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have been purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

Enable “Allow customers and partners to self-register”.

Select the “Configurable Self-Reg Page” option under Login & Registration.

Set jp an external login page and call Salesforce APIs for user creation.

Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.

Customize me self-registration Apex handler to create only the user record.

Explanation
Enabling “Allow customers and partners to self-register” allows guests to create their own user accounts in the portal. Selecting the “Configurable Self-Reg Page” option allows the administrator to customize the self-registration page to capture the required fields. Customizing the self-registration Apex handler to create only the user record prevents the automatic creation of a contact record until verification. References: Enable Self-Registration, Customize Self-Registration

QUESTION 91
Northern Trail Outfitters (NTO) wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, NTO establishes a single customer view including their buying behaviors, channel preferences and purchasing history. All of this information exists but is spread across different systems and formats.
NTO has decided to use Salesforce as the platform to build a 360 degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets.
What should an Identity Architect do to provision, deprovision and authenticate users?

Salesforce Identity is not needed since NTO uses Microsoft AD.

Salesforce Identity can be included but NTO will be required to build a custom integration with Microsoft AD.

Salesforce Identity is included in the Salesforce licenses so it does not need to be considered separately.

A Salesforce Identity can be included but NTO will require Identity Connect.

QUESTION 92
Universal Containers (UC) uses Salesforce to allow customers to keep track of the order status. The customers can log in to Salesforce using external authentication providers, such as Facebook and Google. UC is also leveraging the App Launcher to let customers access an of platform application for generating shipping labels.
The label generator application uses OAuth to provide users access. What license type should an Architect recommend for the customers?

Customer Community license

Identity license

Customer Community Plus license

External Identity license

QUESTION 93
Universal containers (UC) would like to enable SAML-BASED SSO for a salesforce partner community. UC has an existing ldap identity store and a third-party portal. They would like to use the existing portal as the primary site these users’ access, but also want to allow seamless access to the partner community. What SSO flow should an architect recommend?

User-Agent

IDP-initiated

Sp-Initiated

Web server

Explanation
IDP-initiated SSO flow is when the user starts at the identity provider (IDP) site and then is redirected to the service provider (SP) site with a SAML assertion. This flow is suitable for UC’s scenario because they want to use their existing portal as the primary site and also enable seamless access to the partner community. The IDP-initiated flow does not require the user to log in again at the SP site, which is Salesforce in this case.
References: SAML SSO Flows, Single Sign-On, Salesforce Community Single Sign-on (SSO)

QUESTION 94
Universal Containers (UC) has a classified information system that its call center team uses only when they are working on a case with a record type “Classified”. They are only allowed to access the system when they own an open “Classified” case, and their access to the system is removed at all other times. They would like to implement SAML SSO with Salesforce as the Idp, and automatically allow or deny the staff’s access to the classified information system based on whether they currently own an open “Classified” case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying access to the classified information system based on the open “classified” case record criteria?

Use Salesforce reports to identify users that currently own open “Classified” cases and should be granted access to the Classified information system.

Use Apex trigger on case to dynamically assign permission Sets that Grant access when a user is assigned with an open “Classified” case, and remove it when the case is closed.

Use Custom SAML JIT Provisioning to dynamically query the user’s open “Classified” cases when attempting to access the classified information system.

Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open “Classified” Cases.

Explanation
Custom SAML JIT Provisioning allows Salesforce to dynamically create or update user records in the classified information system based on the SAML assertion sent by Salesforce as the IdP. This way, the staff can access the system only when they have an open “Classified” case, and their access is revoked when they don’t. Option A is incorrect because Salesforce reports are not a reliable way to grant or revoke access to the system, as they are not updated in real time and may not reflect the current status of the cases. Option B is incorrect because Apex triggers can only assign or remove permission sets within Salesforce, not in an external system. Option D is incorrect because a Common Connected App Handler using Apex is used to customize the behavior of a connected app, not to control access to an external system based on user attributes.
References: Custom SAML JIT Provisioning, Create a Custom Connected App Handler

QUESTION 95
A large consumer company is planning to create a community and will requ.re login through the customers social identity. The following requirements must be met:
1. The customer should be able to login with any of their social identities, however salesforce should only have one user per customer.
2. Once the customer has been identified with a social identity, they should not be required to authonze Salesforce.
3. The customers personal details from the social sign on need to be captured when the customer logs into Salesforce using their social Identity.
3. If the customer modifies their personal details in the social site, the changes should be updated in Salesforce
.
Which two options allow the Identity Architect to fulfill the requirements?
Choose 2 answers

Use Login Flows to call an authentication registration handler to provision the user before logging the user into the community.

Use authentication providers for social sign-on and use the custom registration handler to insert or update personal details.

Redirect the user to a custom page that allows the user to select an existing social identity for login.

Use the custom registration handler to link social identities to Salesforce identities.

Loading …

Guaranteed Success with Valid Salesforce Identity-and-Access-Management-Architect Dumps: https://www.dumpstests.com/Identity-and-Access-Management-Architect-latest-test-dumps.html

#Identity-and-Access-Management-Architect accurate answers Identity-and-Access-Management-Architect accurate study material Identity-and-Access-Management-Architect dumps discount Identity-and-Access-Management-Architect study guide free pdf Identity-and-Access-Management-Architect valid braindumps book Identity-and-Access-Management-Architect valid exam camp questions new Identity-and-Access-Management-Architect test prep

previous post L3M1 PDF Exam Material 2024 Realistic L3M1 Dumps Questions [Q48-Q65]

next post Latest Verified & Correct SAP C-S4CWM-2308 Questions & Answers Daily Updated [Q38-Q58]

[Q77-Q95] Latest Salesforce Identity-and-Access-Management-Architect First Attempt, Exam real Dumps Updated [Aug-2024]

No Responses

Leave a Reply Cancel reply

Related Certifications

Identity-and-Access-Management-Architect Practice Tests

Recent Posts

Recent Comments

Categories