How To Pass The Salesforce Identity and Access Management Designer Exam?

test2022-08-08T08:49:39+00:00

By test Identity and Access Management Designer dumps, Salesforce Certified Identity and Access Management Designer certification dumps, Salesforce Identity and Access Management Designer exam questions 0 Comments

To pass your Salesforce Identity and Access Management Designer Exam, the best method is to challenge and improve your knowledge. The best tips to pass Identity and Access Management Designer exam is to use Identity and Access Management Designer dumps. FreeTestShare Identity and Access Management Designer dumps allow you to practice the types of questions that may occur on the exam and to think about the answers ahead of time. It contains Salesforce Identity and Access Management Designer exam questions and answers to help you pass the exam on the first try!

To put your skills to the test, try below free practice exam!

Page 1 of 4

1. Universal containers wants to implement single Sign-on for a salesforce org using an external identity provider and corporate identity store .

What type of Authentication flow is required to support deep linking?

Web server Oauth SSO flow.

Identity-provider-initiated SSO

Service-provider-initiated SSO

Start URL on identity provider

2. Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an external identity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.

What should a identity architect recommend to create partners?

On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.

Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.

Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.

Allow partners to register through the IdP and create partner users in Salesforce through an AP

3. A manufacturer wants to provide registration for an Internet of Things (IoT) device with limited display input or capabilities.

Which Salesforce OAuth authorization flow should be used?

OAuth 2.0 JWT Bearer How

OAuth 2.0 Device Flow

OAuth 2.0 User-Agent Flow

OAuth 2.0 Asset Token Flow

4. Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.

What should an identity architect do to fulfill this requirement?

Contact Salesforce Support and enable delegate single sign-on.

Create a custom external authentication provider.

Use certificate-based authentication.

Configure OpenID Connect authentication provider.

5. Northern Trail Outfitters is implementing a busmess-to-business (B2B) collaboration site using Salesforce Experience Cloud. The partners will authenticate with an existing identity provider and the solution will utilize Security Assertion Markup Language (SAML) to provide single sign-on to Salesforce. Delegated administration will be used in the Expenence Cloud site to allow the partners to administer their users' access.

How should a partner identity be provisioned in Salesforce for this solution?

Create only a contact.

Create a contactless user.

Create a user and a related contact.

Create a person account.

6. Universal Containers (UC) has decided to use Salesforce as an Identity Provider for multiple external applications. UC wants to use the salesforce App Launcher to control the Apps that are available to individual users .

Which three steps are required to make this happen?

Add each connected App to the App Launcher with a Start UR

Set up an Auth Provider for each External Application.

Set up Salesforce as a SAML Idp with My Domain.

Set up Identity Connect to Synchronize user data.

Create a Connected App for each external application.

7. Universal Containers (UC) is considering a Customer 360 initiative to gain a single source of the truth for its customer data across disparate systems and services. UC wants to understand the primary benefits of Customer 360 Identity and how it contributes ato successful Customer 360 Truth project.

What are two are key benefits of Customer 360 Identity as it relates to Customer 360? Choose 2 answers

Customer 360 Identity automatically integrates with Customer 360 Data Manager and Customer 360 Audiences to seamlessly populate all user data.

Customer 360 Identity enables an organization to build a single login for each of its customers, giving the organization an understanding of the user's login activity across all its digital properties and applications.

Customer 360 Identity supports multiple brands so you can deliver centralized identity services and correlation of user activity, even if it spans multiple corporate brands and user experiences.

Customer 360 Identity not only provides a unified sign up and sign in experience, but also tracks anonymous user activity prior to signing up so organizations can understand user activity before and after the users identify themselves.

8. A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS. The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.

What is recommended to ensure these requirements are met?

Use connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.

Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.

Add a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.

Configure Each ADFS system under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-

9. A technology enterprise is planning to implement single sign-on login for users. When users log in to the Salesforce User object custom field, data should be populated for new and existing users.

Which two steps should an identity architect recommend? Choose 2 answers

Implement Auth.SamlJitHandler Interface.

Create and update methods.

Implement RegistrationHandler Interface.

Implement SesslonManagement Class.

10. Universal Containers (UC) has a Customer Community that uses Facebook for Authentication.

UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user: How can this requirement be met?

Use the updateUser method on the registration Handler Class.

Develop a scheduled job that calls out to Facebook on a nightly basis.

Use information in the signed Request that is received from facebook.

Use SAML Just-In-Time Provisioning between Facebook and Salesforce.

Page 2 of 4

11. The CIO of universal containers(UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize Oauth 2.0. UC has listed an architect to analyze all of the applications that use Oauth flows to. See where refresh Tokens can be applied .

Which two OAuth flows should the architect consider in their evaluation? Choose 2 answers

Web server

Jwt bearer token

User-Agent

Username-password

12. The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials .

What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?

Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.

Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.

Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.

Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.

13. Universal containers (UC) has a customer Community that uses Facebook for authentication. UC would like to ensure that changes in the Facebook profile are reflected on the appropriate customer Community user .

How can this requirement be met?

Use the updateuser() method on the registration handler class.

Use SAML just-in-time provisioning between Facebook and Salesforce

Use information in the signed request that is received from Facebook.

Develop a schedule job that calls out to Facebook on a nightly basis.

14. which three are features of federated Single Sign-on solutions? Choose 3 answers

It federates credentials control to authorized applications.

It establishes trust between Identity store and service provider.

It solves all identity and access management problems.

It improves affiliated applications adoption rates.

It enables quick and easy provisioning and deactivating of users.

15. Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Amazon credentials.

What should an identity architect recommend to meet these requirements?

Configure a predefined authentication provider for Amazon.

Create a custom external authentication provider for Amazon.

Configure an OpenID Connect Authentication Provider for Amazon.

Configure Amazon as a connected app.

16. Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose .

Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication? Choose 2 answers

Salesforce license for sales users and Identity license for Marketing users

Salesforce license for sales users and External Identity license for Marketing users

Identity license for sales users and Identity connect license for Marketing users

Salesforce license for sales users and platform license for Marketing users.

17. An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).

Which feature of Identity Connect is applicable for this scenano?

When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.

If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.

Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.

When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.

18. Universal Containers built a custom mobile app for their field reps to create orders in Salesforce. OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained

automatically without forcing the user to log in again. While that improved the field reps' productivity, UC realized that they need a "logout" feature.

What should the logout function perform in this scenario, where user sessions are refreshed automatically?

Invoke the revocation URL and pass the refresh token.

Clear out the client Id to stop auto session refresh.

Invoke the revocation URL and pass the access token.

Clear out all the tokens to stop auto session refresh.

19. Universal Containers uses Salesforce as an identity provider and Concur as the Employee Expense management system. The HR director wants to ensure Concur accounts for employees are created only after the appropnate approval in the Salesforce org.

Which three steps should the identity architect use to implement this requirement? Choose 3 answers

Create an approval process for a custom object associated with the provisioning flow.

Create a connected app for Concur in Salesforce.

Enable User Provisioning for the connected app.

Create an approval process for user object associated with the provisioning flow.

Create an approval process for UserProvisionlngRequest object associated with the provisioning flow.

20. Under which scenario Web Server flow will be used?

Used for web applications when server-side code needs to interact with API

Used for server-side components when page needs to be rendered.

Used for mobile applications and testing legacy Integrations.

Used for verifying Access protected resources.

Page 3 of 4

21. Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for to give its customers the ability to login with their Facebook and Twitter credentials.

Which two actions should an identity architect recommend to meet these requirements? Choose 2 answers

Create a custom external authentication provider for Facebook.

Configure a predefined authentication provider for Facebook.

Create a custom external authentication provider for Twitter.

Configure a predefined authentication provider for Twitter.

22. Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation .

What two risks Should the Architect point out? Choose 2 answers

Delegated Authentication is enabled or disabled for the entire Salesforce org.

UC will be required to develop and support a custom SOAP web service.

Salesforce users will be locked out of Salesforce if the web service goes down.

The web service must reside on a public cloud service, such as Heroku.

23. Refer to the exhibit.

Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.

A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.

NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization.

what should an identity architect do to fulfill the above requirements?

For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.

Authorize third-party service by sending authorization requests to the community- url/services/oauth2/authonze/expid_value.

24. Universal Containers (UC) is looking to build a Canvas app and wants to use the corresponding Connected App to control where the app is visible .

Which two options are correct in regards to where the app can be made visible under the Connected App setting for the Canvas app? Choose 2 answers

As part of the body of a Salesforce Knowledge article.

In the mobile navigation menu on Salesforce for Android.

The sidebar of a Salesforce Console as a console component.

Included in the Call Control Tool that's part of Open CT

25. Universal Containers is implementing a new Experience Cloud site and the identity architect wants to use dynamic branding features as of the login process.

Which two options should the identity architect recommend to support dynamic branding for the site? Choose 2 answers

To use dynamic branding, the community must be built with the Visuaiforce + Salesforce Tabs template.

To use dynamic branding, the community must be built with the Customer Account Portal template.

An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand.

An external content management system (CMS) must be used for dynamic branding on Experience Cloud sites.

26. Universal containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app .

Which two are recommendations to make the UC? Choose 2 answers

Disallow the use of single Sign-on for any users of the mobile app.

Require high assurance sessions in order to use the connected App

Use Google Authenticator as an additional part of the logical processes.

Set login IP ranges to the internal network for all of the app users profiles.

27. Containers (UC) has an existing Customer Community. UC wants to expand the self-registration capabilities such that customers receive a different community experience based on the data they provide during the registration process .

What is the recommended approach an Architect Should recommend to UC?

Create an After Insert Apex trigger on the user object to assign specific custom permissions.

Create separate login flows corresponding to the different community user personas.

Modify the Community pages to utilize specific fields on the User and Contact records.

Modify the existing Communities registration controller to assign different profiles.

28. Which two statements are capable of Identity Connect? Choose 2 answers

Synchronization of Salesforce Permission Set Licence Assignments.

Supports both Identity-Provider-Initiated and Service-Provider-Initiated SS

Support multiple orgs connecting to multiple Active Directory servers.

Automated user synchronization and de-activation.

29. In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?

Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.

Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA

Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.

Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.

30. Universal containers (UC) is successfully using Delegated Authentication for their salesforce users. The service supporting Delegated Authentication is written in Java. UC has a new CIO that is requiring all company Web services be RESR-ful and written in . NET .

Which two considerations should the UC Architect provide to the new CIO? Choose 2 answers

Delegated Authentication will not work with a.net service.

Delegated Authentication will continue to work with rest services.

Delegated Authentication will continue to work with a.net service.

Delegated Authentication will not work with rest services.

Page 4 of 4

31. Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow employees to post Ideas from the Employee portal. When users click on some of the links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with the relevant pages .

What OAuth flow is best suited for this scenario?

Web Application flow

SAML Bearer Assertion flow

User-Agent flow

Web Server flow

32. Universal Containers (UC) wants to build a few applications that leverage the Salesforce REST API. UC has asked its Architect to describe how the API calls will be authenticated to a specific user .

Which two mechanisms can the Architect provide? Choose 2 Answers

Authentication Token

Session ID

Refresh Token

Access Token

33. Universal Containers (UC) wants to use Salesforce for sales orders and a legacy of system for order fulfillment. The legacy system must update the status of orders in 65* Salesforce in real time as they are fulfilled. UC decides to use OAuth for connecting the legacy system to Salesforce .

What OAuth flow should be considered that doesn't require storing credentials, client secret or refresh tokens?

Web Server flow

JWT Bearer Token flow

Username-Password flow

User Agent flow

34. A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.

The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.

What should an Identity architect do to meet this requirement?

Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

Configure the company firewall to allow traffic from Salesforce IP ranges.

Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

Upload a third-party certificate from Salesforce into the on-premise server.

35. A client is planning to rollout multi-factor authentication (MFA) to its internal employees and

wants to understand which authentication and verification methods meet the Salesforce criteria for secure authentication.

Which three functions meet the Salesforce criteria for secure mfa? Choose 3 answers

username and password + SMS passcode

Username and password + secunty key

Third-party single sign-on with Mobile Authenticator app

Certificate-based Authentication

Lightning Login

36. Northern Trail Outfitters would like to automatically create new employee users in Salesforce with an appropriate profile that maps to its Active Directory Department.

How should an identity architect implement this requirement?

Use the createUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Use a login flow to collect Security Assertion Markup Language attributes and assign the appropriate profile during Just-In-Time (JIT) provisioning.

Make a callout during the login flow to query department from Active Directory to assign the appropriate profile.

37. An identity architect is implementing a mobile-first Consumer Identity Access Management (CIAM) for external users. User authentication is the only requirement. The users email or mobile phone number should be supported as a username.

Which two licenses are needed to meet this requirement? Choose 2 answers

External Identity Licenses

Identity Connect Licenses

Email Verification Credits

SMS verification Credits

38. Universal containers (UC) wants users to authenticate into their salesforce org using credentials stored in a custom identity store. UC does not want to purchase or use a third-party Identity provider. Additionally, UC is extremely wary of social media and does not consider it to be trust worthy .

Which two options should an architect recommend to UC? Choose 2 answers

Use a professional social media such as LinkedIn as an Authentication provider

Build a custom web page that uses the identity store and calls frontdoor.jsp

Build a custom Web service that is supported by Delegated Authentication.

Implement the Openid protocol and configure an Authentication provider

How To Pass The Salesforce Identity and Access Management Designer Exam?

How To Pass The Salesforce Identity and Access Management Designer Exam?

Share this post

Author

Leave a Reply Cancel reply

Related Posts