Salesforce Certified Identity and Access Management Designer - Identity-and-Access-Management-Designer Exam Practice Test

Question 1

A global company is using the Salesforce Platform as an Identity Provider and needs to integrate a third-party application with its Experience Cloud customer portal.
Which two features should be utilized to provide users with login and identity services for the third-party application?
Choose 2 answers

A. Use a connected app.

B. Use the App Launcher with single sign-on (SSO).

C. External a Data source with Named Principal identity type.

D. Use Delegated Authentication.

Correct Answer: A,B

Question 2

Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?

A. Require the use of Salesforce security Tokens on password.

B. Include client ID and client secret in the login header callout.

C. Set up a proxy server for the login service in the DMZ.

D. Enforce mutual Authentication between systems using SSL.

Correct Answer: A

Question 3

A company's external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?

A. Leverage external objects and data classification policies.

B. Define a permission set that grants access to the app and assign to authorized users.

C. Create custom scopes and assign to the connected app.

D. Select "Admin approved users are pre-authonzed" and assign specific profiles.

Correct Answer: C

Question 4

Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HANA.
UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs.
Which two Salesforce license types does UC need for its employees'
Choose 2 answers

A. Salesforce and Identity Connect licenses

B. Identity and Identity Connect licenses

C. Company Community and Identity licenses

D. Chatter Only and Identity licenses

Correct Answer: A,B

Question 5

Containers (UC) uses an internal system for recruiting and would like to have the candidates' info available in the Salesforce automatically when they are selected. UC decides to use OAuth to connect to Salesforce from the recruiting system and would like to do the authentication using digital certificates. Which two OAuth flows should be considered to meet the requirement? Choose 2 answers

A. Refresh Token flow

B. SAML Bearer Assertion flow

C. JWT Bearer Token flow

D. Web Service flow

Correct Answer: B,C

Question 6

Uwversal Containers (UC) is building a custom employee hut) application on Amazon Web Services (AWS) and would like to store their users' credentials there. Users will also need access to Salesforce for internal operations. UC has tasked an identity architect with evaluating Afferent solutions for authentication and authorization between AWS and Salesforce.
How should an identity architect configure AWS to authenticate and authorize Salesforce users?

A. Configure AWS as an OpenID Connect Provider.

B. Develop a custom Auth server in AWS.

C. Configure the custom employee app as a connected app.

D. Create a custom external authentication provider.

Correct Answer: A

Question 7

Universal Containers (UC) has an existing Salesforce org configured for SP-Initiated SAML SSO with their Idp. A second Salesforce org is being introduced into the environment and the IT team would like to ensure they can use the same Idp for new org. What action should the IT team take while implementing the second org?

A. Use the same request bindings as the first org.

B. Use the same SAML Identity location as the first org.

C. Use the Salesforce Username as the SAML Identity Type.

D. Use a different Entity ID than the first org.

Correct Answer: D

Question 8

Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

A. Customize me self-registration Apex handler to create only the user record.

B. Enable "Allow customers and partners to self-register".

C. Set jp an external login page and call Salesforce APIs for user creation.

D. Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.

E. Select the "Configurable Self-Reg Page" option under Login & Registration.

Correct Answer: A,B,E

Question 9

Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.
What should an identity architect do to fulfill this requirement?

A. Configure OpenID Connect authentication provider.

B. Contact Salesforce Support and enable delegate single sign-on.

C. Use certificate-based authentication.

D. Create a custom external authentication provider.

Correct Answer: D

Question 10

Which two considerations should be made when implementing Delegated Authentication?
Choose 2 answers

A. The authentication web service can include custom attributes.

B. Salesforce servers receive but do not validate a user's credentials.

C. It requires trusted IP ranges at the User Profile level.

D. Just-in-time Provisioning can be configured for new users.

E. It can be used to authenticate API clients and mobile apps.

Correct Answer: D,E

Question 11

Universal Containers (UC) rolling out a new Customer Identity and Access Management Solution will be built on top of their existing Salesforce instance.
Several service providers have been setup and integrated with Salesforce using OpenlD Connect to allow for a seamless single sign-on experience. UC has a requirement to limit user access to only a subset of service providers per customer type.
Which two steps should be done on the platform to satisfy the requirement?
Choose 2 answers

A. Use Profiles and Permission Sets to assign user access to Admin Pre-Approved Connected Apps.

B. Manage which connected apps a user has access to by assigning authentication providers to the users profile.

C. Set each of the Connected App access settings to Admin Pre-Approved.

D. Assign the connected app to the customer community, and enable the users profile in the Community settings.

Correct Answer: A,C

Question 12

Universal Containers (UC) uses Salesforce for its customer service agents. UC has a proprietary system for order tracking which supports Security Assertion Markup Language (SAML) based single sign-on. The VP of customer service wants to ensure only active Salesforce users should be able to access the order tracking system which is only visible within Salesforce.
What should be done to fulfill the requirement?
Choose 2 answers

A. Set up the Corporate Identity store as an identity provider (IdP) for Order Tracking,

B. Customize Order Tracking to initiate a REST call to validate users in Salesforce after login.

C. Setup Salesforce as an identity provider (IdP) for order Tracking.

D. Setup Order Tracking as a Canvas app in Salesforce to POST IdP initiated SAML assertion.

Correct Answer: A,C

Salesforce Certified Identity and Access Management Designer - Identity-and-Access-Management-Designer Exam Practice Test

Latest Update

Useful Links

Contact Us