Download Exam Identity-and-Access-Management-Designer Practice Test Questions with 100% Verified Answers
Share Latest Identity-and-Access-Management-DesignerTest Practice Test Questions, Exam Dumps
NEW QUESTION 139
Which three types of attacks would a 2-Factor Authentication solution help garden against?
- A. Phishing attacks
- B. Network perimeter attacks
- C. Dictionary attacks
- D. Man-in-the-middle attacks
- E. Key logging attacks
Answer: B,C,E
NEW QUESTION 140
Universal containers(UC) is building a mobile application that will make calls to the salesforce REST API.
Additionally,UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes should UC configure in the connected App? Choose 2 answers
- A. Full
- B. API
- C. Refresh Tokens
- D. Web
Answer: A,B
NEW QUESTION 141
Universal containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use salesforce ideas and provide the ability for employees to post ideas from the company portal. They use SAML-BASED SSO to get into the company portal and would like to leverage it to access salesforce. Most of the users don't exist in salesforce and they would like the user records created in salesforce communities the first time they try to access salesforce. What recommendation should an architect make to meet this requirement?
- A. Use Identity connect to sync users
- B. Use salesforce APIs to create users on the fly
- C. Use on-the-fly provisioning
- D. Use just-in-time provisioning
Answer: D
NEW QUESTION 142
A farming enterprise offers smart farming technology to rts farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropnate way to generate sensor Information In Salesforce.
Which OAuth flow should the architect recommend?
- A. OAuth 2.0 Device Authentication Row
- B. OAuth 2.0 JWT Bearer Token Flow
- C. OAuth 2.0 Asset Token Flow
- D. OAuth 2.0 SAML Bearer Assertion Flow
Answer: C
NEW QUESTION 143
Universal Containers (UC) uses Salesforce to allow customers to keep track of the order status. The customers can log in to Salesforce using external authentication providers, such as Facebook and Google.
UC is also leveraging the App Launcher to let customers access an off-platform application for generating shipping labels. The label generator application uses OAuth to provide users access.
What license type should an Architect recommend for the customers?
- A. Customer Community Plus license
- B. Customer Community license
- C. External Identity license
- D. Identity license
Answer: D
NEW QUESTION 144
A company's external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?
- A. Define a permission set that grants access to the app and assign to authorized users.
- B. Create custom scopes and assign to the connected app.
- C. Leverage external objects and data classification policies.
- D. Select "Admin approved users are pre-authonzed" and assign specific profiles.
Answer: B
NEW QUESTION 145
Northern Trail Outfitters (NTO) is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable NTO-branded page.
The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.
Which approach should the identity architect recommend?
- A. Use Heroku to build the new brand site and embedded login to reuse identities.
- B. Implement Experience ID in the code and extend the URLs and endpomts, as required.
- C. Create a full sandbox to replicate the portal site and update the branding accordingly.
- D. Configure an additional community site on the same org that is dedicated for the new brand.
Answer: B
NEW QUESTION 146
Universal Containers (UC) uses Salesforce for its customer service agents. UC has a proprietary system for order tracking which supports Security Assertion Markup Language (SAML) based single sign-on. The VP of customer service wants to ensure only active Salesforce users should be able to access the order tracking system which is only visible within Salesforce.
What should be done to fulfill the requirement?
Choose 2 answers
- A. Setup Salesforce as an identity provider (IdP) for order Tracking.
- B. Set up the Corporate Identity store as an identity provider (IdP) for Order Tracking,
- C. Customize Order Tracking to initiate a REST call to validate users in Salesforce after login.
- D. Setup Order Tracking as a Canvas app in 5alesforce to POST IdP initiated SAML assertion.
Answer: A,B
NEW QUESTION 147
A consumer products company uses Salesforce to maintain consumer information, including orders. The company implemented a portal solution using Salesforce Experience Cloud for its consumers where the consumers can log in using their credentials. The company is considering allowing users to login with their Facebook or Linkedln credentials.
Once enabled, what role will Salesforce play?
- A. Facebook and Linkedln will act as the IdPs and SPs.
- B. Salesforce will be the identity provider (IdP).
- C. Facebook and Linkedln will be the SPs.
- D. Salesforce will be the service provider (SP).
Answer: D
NEW QUESTION 148
Northern Trail Outfitters (NTO) recently purchased Salesforce Identity Connect to streamline user provisioning across Microsoft Active Directory (AD) and Salesforce Sales Cloud.
NTO has asked an identity architect to identify which salesforce security configurations can map to AD permissions.
Which three Salesforce permissions are available to map to AD permissions?
Choose 3 answers
- A. Roles
- B. Public Groups
- C. Sharing Rules
- D. Profiles and Permission Sets
- E. Field-Level Security
Answer: A,B,D
NEW QUESTION 149
Universal containers(UC) has implemented SAML-BASED single Sign-on for their salesforce application and is planning to provide access to salesforce on mobile devices using the salesforce1 mobile app. UC wants to ensure that single Sign-on is used for accessing the salesforce1 mobile app. Which two recommendations should the architect make? Choose 2 answers
- A. Use the existing SAML SSO flow along with Web server flow
- B. Use the existing SAML SSO flow along with user agent flow.
- C. Configure the salesforce1 app to use the my domain URL
- D. Configure the embedded Web browser to use my domain URL.
Answer: B,C
NEW QUESTION 150
Universal Containers (UC) has an Experience Cloud site (Customer Community) where customers can authenticate and place orders, view the status of orders, etc. UC allows guest checkout.
Mow can a guest register using data previously collected during order placement?
- A. Use a Connected App Handler Apex Plugin class to collect only order details to retrieve customer data.
- B. Enable Security Assertion Markup Language Sign-On and use a login flow to collect only order details to retrieve customer data.
- C. Enable Facebook as an authentication provider and use a registration handler to collect only order details to retrieve customer data.
- D. Enable self-registration and customize a self-registration page to collect only order details to retrieve customer data.
Answer: D
NEW QUESTION 151
Universal Containers (UC) is building an integration between Salesforce and a legacy web application using the Canvas framework. The security team for UC has determined that a signed request from Salesforce is not an adequate authentication solution for the third-party app.
Which two options should the Architect consider for authenticating the third-party app using the Canvas framework? (Choose two.)
- A. Create a registration handler Apex class to allow the third-party application to authenticate itself against Salesforce as the IdP.
- B. Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC's IdP.
- C. Utilize Authorization Providers to allow the third-party application to authenticate itself against Salesforce as the IdP.
- D. Utilize the Canvas OAuth flow to allow the third-party application to authenticate itself against Salesforce as the IdP.
Answer: B,D
NEW QUESTION 152
What information does the 'Relaystate' parameter contain in sp-Initiated Single Sign-on?
- A. Reference to a URL redirect parameter at the identity provider.
- B. Reference to a URL redirect parameter at the service provider.
- C. Reference to the login address URL of the identity Provider.
- D. Reference to the login address URL of the service provider.
Answer: B
NEW QUESTION 153
A third-party app provider would like to have users provisioned via a service endpoint before users access their app from Salesforce.
What should an identity architect recommend to configure the requirement with limited changes to the third-party app?
- A. Redirect users to the third-party app for registration.
- B. Use Salesforce identity with Security Assertion Markup Language (SAML) for provisioning users.
- C. Use a connected app with user provisioning flow.
- D. Create Canvas app in Salesforce for third-party app to provision users.
Answer: C
NEW QUESTION 154
An identity architect has been asked to recommend a solution that allows administrators to configure personalized alert messages to users before they land on the Experience Cloud site (formerly known as Community) homepage.
What is recommended to fulfill this requirement with the least amount of customization?
- A. Use Login Flows to add a screen that shows personalized alerts.
- B. Build a Lightning web Component (LWC) for a homepage that shows custom alerts.
- C. Customize the registration handler Apex class to create a routing logic navigating to different home pages based on the user profile.
- D. Create custom metadata that stores user alerts and use a LWC to display alerts.
Answer: A
NEW QUESTION 155
The CIO of universal containers(UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize Oauth 2.0. UC has listed an architect to analyze all of the applications that use Oauth flows to. See where refresh Tokens can be applied. Which two OAuth flows should the architect consider in their evaluation? Choose 2 answers
- A. Username-password
- B. Jwt bearer token
- C. Web server
- D. User-Agent
Answer: C,D
NEW QUESTION 156
Universal Containers (UC) wants to implement SAML SSO for their internal of Salesforce users using a third-party IdP. After some evaluation, UC decides NOT to 65 set up My Domain for their Salesforce org. How does that decision impact their SSO implementation?
- A. SP-initiated SSO will NOT work
- B. Either SP- or IdP-initiated SSO will work.
- C. Neither SP- nor IdP-initiated SSO will work.
- D. IdP-initiated SSO will NOT work.
Answer: C
NEW QUESTION 157
Northern Trail Outfitters (NTO) believes a specific user account may have been compromised. NTO inactivated the user account and needs U perform a forensic analysis and identify signals that could Indicate a breach has occurred.
What should NTO's first step be in gathering signals that could indicate account compromise?
- A. Download the Setup Audit Trail and review all recent activities performed by the user.
- B. Download the Identity Provider Event Log and evaluate the details of activities performed by the user.
- C. Review the User record and evaluate the login and transaction history.
- D. Download the Login History and evaluate the details of logins performed by the user.
Answer: D
NEW QUESTION 158
Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post their ideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decides to use an API user using Oauth Username - password flow for the connection. How can the connection to salesforce be restricted only to the employee portal server?
- A. Add the Employee portals IP address to the Trusted IP range for the connected App
- B. Use a dedicated profile for the user the Employee portal uses.
- C. Use a digital certificate signed by the employee portal Server.
- D. Add the employee portals IP address to the login IP range on the user profile.
Answer: A
NEW QUESTION 159
A technology enterprise is planning to implement single sign-on login for users. When users log in to the Salesforce User object custom field, data should be populated for new and existing users.
Which two steps should an identity architect recommend?
Choose 2 answers
- A. Implement RegistrationHandler Interface.
- B. Create and update methods.
- C. Implement SesslonManagement Class.
- D. Implement Auth.SamlJitHandler Interface.
Answer: B,D
NEW QUESTION 160
A university is planning to set up an identity solution for its alumni. A third-party identity provider will be used for single sign-on Salesforce will be the system of records. Users are getting error messages when logging in.
Which Salesforce feature should be used to debug the issue?
- A. Apex Exception Email
- B. Debug Logs
- C. Login History
- D. View Setup Audit Trail
Answer: C
NEW QUESTION 161
Users logging into Salesforce are frequently prompted to verify their identity.
The identity architect is required to provide recommendations so that frequency of prompt verification can be reduced.
What should the identity architect recommend to meet the requirement?
- A. Set trusted IP ranges for the organization.
- B. Implement an single sign-on for Salesforce using an external identity provider.
- C. Implement 2FA authentication for the Salesforce org.
- D. Implement multi-factor authentication for the Salesforce org.
Answer: A
NEW QUESTION 162
Which two capabilities does My Domain enable in the context of a SAML SSO configuration? Choose 2 answers
- A. SSO from Salesforce Mobile App
- B. Resource deep linking
- C. App Launcher
- D. Login Forensics
Answer: A,B
NEW QUESTION 163
Universal Containers (UC) has an e-commerce website where customers can buy products, make payments and manage their accounts. UC decides to build a Customer Community on Salesforce and wants to allow the customers to access the community from their accounts without logging in again. UC decides to implement an SP-initiated SSO using a SAML-compliant Idp. In this scenario where Salesforce is the Service Provider, which two activities must be performed in Salesforce to make SP-initiated SSO work? Choose 2 answers
- A. Set up My Domain.
- B. Configure Delegated Authentication.
- C. Create a Connected App.
- D. Configure SAML SSO settings.
Answer: A,D
NEW QUESTION 164
......
Positive Aspects of Valid Dumps Identity-and-Access-Management-Designer Exam Dumps!: https://www.test4cram.com/Identity-and-Access-Management-Designer_real-exam-dumps.html
First Attempt Guaranteed Success in Identity-and-Access-Management-Designer Exam: https://drive.google.com/open?id=1YC7SsTxbaT0ngE9svLVP149l_aC_lk61