The Realest Study Materials Identity-and-Access-Management-Designer Dumps Updated Feb 15, 2023 [Q37-Q57]

Rate this post

The Realest Study Materials Identity-and-Access-Management-Designer Dumps Updated Feb 15, 2023

LATEST Identity-and-Access-Management-Designer Exam Practice Material

NO.37 Universal containers (UC) has a classified information system that it’s call centre team uses only when they are working on a case with a record type of “classified”. They are only allowed to access the system when they own an open “classified” case, and their access to the system is removed at all other times. They would like to implement SAML SSO with salesforce as the IDP, and automatically allow or deny the staff’s access to the classified information system based on whether they currently own an open “classified” case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying access to the classified information system based on the open “classified” case record criteria?

Use a custom connected App handler using apex to dynamically allow access to the system based on whether the staff owns any open “classified” cases.

Use apex trigger on case to dynamically assign permission sets that grant access when a user is assigned with an open “classified” case, and remove it when the case is closed.

Use custom SAML jit provisioning to dynamically query the user’s open “classified” cases when attempting to access the classified information system

Use salesforce reports to identify users that currently owns open “classified” cases and should be granted access to the classified information system.

NO.38 Universal containers (UC) has built a custom based Two-factor Authentication (2fa) system for their existing on-premise applications. Thru are now implementing salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution an architect should consider?

Replace the custom 2fa system with salesforce 2fa for on-premise application and salesforce.

Use the custom 2fa system for on-premise applications and native 2fa for salesforce.

Replace the custom 2fa system with an app exchange app that supports on-premise applications and salesforce.

Use custom login flows to connect to the existing custom 2fa system for use in salesforce.

NO.39 What is one of the roles of an Identity Provider in a Single Sign-on setup using SAML?

Validate token

Create token

Consume token

Revoke token

NO.40 Universal Containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in Salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers

Disallow the use of Single Sign-on for any users of the mobile app.

Require High Assurance sessions in order to use the Connected App.

Set Login IP Ranges to the internal network for all of the app users Profiles.

Use Google Authenticator as an additional part of the login process

NO.41 Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financialsystem, and CPQ system. Below is the SSO implementation landscape.

What role combination is represented by the systems in this scenario”

Financial System and CPQ System are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are acting as Identity Providers.

Salesforce Org1 and PingFederate are acting as Identity Providers.

NO.42 Universal Containers (UC) is looking to purchase a third-party application as an Identity Provider. UC is looking to develop a business case for the purchase in general and has enlisted an Architect for advice. Which twocapabilities of an Identity Provider should the Architect detail to help strengthen the business case? Choose
2 answers

The Identity Provider can authenticate multiple applications.

The Identity Provider can authenticate multiple social media accounts.

The Identity provider can store credentials for multiple applications.

The Identity Provider can centralize enterprise password policy.

NO.43 Northern Trail Outfitters (NTO) wants its customers to use phone numbers to log in to their new digital portal, which was designed and built using Salesforce Experience Cloud. In order to access the portal, the user will need to do the following:
1. Enter a phone number and/or email address
2. Enter a verification code that is to be sent via email or text.
What is the recommended approach to fulfill this requirement?

Create a Login Discovery page and provide a Login Discovery Handler Apex class.

Create a custom login page with an Apex controller. The controller has logic to send and verify the identity.

Create an Authentication provider and implement a self-registration handler class.

Create a custom login flow that uses an Apex controller to verify the phone numbers with the company’s verification service.

NO.44 Universal Containers want users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN.
Which two options should an identity architect recommend to meet the requirement?
Choose 2 answers

Active Directory Password Sync Plugin

Configure Cloud Provider Load Balancer

Salesforce Trigger & Field on Contact Object

Salesforce Identity Connect

NO.45 An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?

Users once logged In, can go to the Change Password screen in Salesforce.

Users can click on the “Forgot your Password” link on the Salesforce.com login page.

Users can request the Salesforce Admin to reset their password.

Users can change it on the enterprise LDAP authentication portal.

NO.46 Universal Containers (UC) is building an authenticated Customer Community for its customers. UC does not want customer credentials stored in Salesforce and is confident its customers would be willing to use their social media credentials to authenticate to the Community.
Which two actions should an Architect recommend UC to take? (Choose two.)

Configure SSO settings for Facebook to serve as a SAML Identity Provider.

Configure an Authentication Provider for LinkedIn social media accounts.

Create a custom Apex Registration Handler to handle new and existing users.

Use Delegated Authentication to call the Twitter login API to authenticate users.

NO.47 Northern Trail Outfitters (NTO) employees use a custom on-premise helpdesk application to request, approve, notify, and track access granted to various on-premises and cloud applications, including Salesforce. Salesforce is currently used to authenticate users.
How should NTO provision Salesforce users as soon as they are approved in the helpdesk application with the approved profiles and permission sets?

Build an integration that performs a remote call-in to the Salesforce SOAP or REST API.

Use a login flow to query the helpdesk to validate user status.

Have the helpdesk initiate an IdP-initiated Just-m-Time provisioning Security Assertion Markup Language flow.

Use Salesforce Connect to integrate with the helpdesk application.

NO.48 Northern Trail Outfitters want to allow its consumer to self-register on it business-to-consumer (B2C) portal that is built on Experience Cloud. The identity architect has recommended to use Person Accounts.
Which three steps need to be configured to enable self-registration using person accounts?
Choose 3 answers

Enable access to person and business account record types under Public Access Settings.

Contact Salesforce Support to enable business accounts.

Under Login and Registration settings, ensure that the default account field is empty.

Contact Salesforce Support to enable person accounts.

Set organization-wide default sharing for Contact to Public Read Only.

NO.49 A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS . The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.
What is recommended to ensure these requirements are met ?

Use connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.

Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.

Add a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.

Configure Each ADFS system under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-

NO.50 Which two roles of the systems are involved in an environment where salesforce users are enabled to access Google Apps from within salesforce through App launcher and connected App set up? Choose 2 answers

Google is the identity provider

Salesforce is the identity provider

Google is the service provider

Salesforce is the service provider

NO.51 Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless expenence. The third-party employee portal only supports OAuth.
What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

Configure SSO to use the third party portal as an identity provider.

Create a custom external authentication provider.

Add the third-party portal as a connected app.

Configure Salesforce for Delegated Authentication.

NO.52 Universal containers (UC) would like to enable SAML-BASED SSO for a salesforce partner community. UC has an existing ldap identity store and a third-party portal. They would like to use the existing portal as the primary site these users access, but also want to allow seamless access to the partner community. What SSO flow should an architect recommend?

User-Agent

IDP-initiated

Sp-Initiated

Web server

NO.53 An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?

Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to “Admin Pre-Approved”.

Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to ‘Admin Pre-Approved”.

Enable the Full Access Scope and then set the connected app access settings to “Admin Pre-Approved”.

Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to “User may self authorize”.

NO.54 Universal containers (UC) has implemented ansp-Initiated SAML flow between an external IDP and salesforce. A user at UC is attempting to login to salesforce1 for the first time and is being prompted for salesforce credentials instead of being shown the IDP login page. What is the likely cause of the issue?

The “Redirect to Identity Provider” option has been selected in the my domain configuration.

The user has not configured the salesforce1 mobile app to use my domain for login

The “Redirect to identity provider” option has not been selected the SAML configuration.

The user has not been granted the “Enable single Sign-on” permission

NO.55 Universal containers (UC) is planning to deploy a custom mobile app that will allow users to get e-signatures from its customers on their mobile devices. The mobile app connects to salesforce to upload the e-signatures as a file attachment and uses Oauth protocol for both Authentication and authorization. What is the most recommended and secure Oauth scope setting that an architect should recommend?

Web

Custom_permissions

API

NO.56 Which two capabilities does My Domain enable in the context of a SAML SSO configuration? Choose 2 answers

App Launcher

Resource deep linking

SSO from Salesforce Mobile App

NO.57 Which three are features of federated Single sign-on solutions? Choose 3 Answers

It establishes trust between Identity Store and Service Provider.

It federates credentials control to authorized applications.

It solves all identity and access management problems.

It improves affiliated applications adoption rates.