Real Dumps for Salesforce Identity and Access Management Designer Exam

dumps2021-10-23T02:34:46+08:00

Identity and Access Management Designer exam is a hot one of Salesforce tests. To take this exam, you need to have 1+ years of experience designing and implementing Identity and Access Management solutions. There are 60 multiple-choice/Multiple-seclect questions in real Identity and Access Management Designer exam, and you have 120 minutes to complete all the questions. The required passing score is 67%. We have cracked the latest Identity and Access Management Designer exam dumps for you to study the test. Free Salesforce Identity and Access Management Designer exam real dumps are available below.

Page 1 of 5

1. Universal containers (UC) uses a home-grown employee portal for their employees to collaborate. UC decides to use salesforce ideas to allow the employees to post ideas from the employee portal. When clicking some links in the employee portal, the users should be redirected to salesforce, authenticated, and presented with relevant pages .

What scope should be requested when using the Oauth token to meet this requirement?

Web

Full

API

Visualforce

2. An identity architect wants to secure Salesforce APIs using Security Assertion Markup Language (SAML). For secunty purposes, administrators will need to authorize the applications that will be consuming the APIs.

Which Salesforce OAuth authorization flow should be used?

OAuth 2-0 SAML Bearer Assertion Flow

OAuth 2.0 JWT Bearer Flow

SAML Assertion Flow

OAuth 2.0 User-Agent Flow

3. Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers

Resource deep linking

App launcher

SSO from salesforce1 mobile app.

4. Which two capabilities does My Domain enable in the context of a SAML SSO configuration? Choose 2 answers

App Launcher

Resource deep linking

SSO from Salesforce Mobile App

5. The security team at Universal containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into salesforce with their active directory (AD) credentials when doing so. For all other uses of Salesforce, Users should be allowed to use AD credentials or salesforce credentials .

What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with salesforce credentials?

Use SAML Federated Authentication and Custom SAML jit provisioning to dynamically add or remove a permission set that grants the Export Reports permission.

Use SAML Federated Authentication, treat SAML sessions as high assurance, and raise the session level required for exporting reports.

Use SAML Federated Authentication and block access to reports when accesses through a standard assurance session.

Use SAML Federated Authentication with a login flow to dynamically add or remove a permission set that grants the export reports permission.

6. Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process .

Which two considerations should an architect point out to UC? Choose 2 answers

The web application should be hosted on a secure server.

The web server must be able to protect consumer privacy

The flow involves passing the user credentials back and forth.

The flow will not provide an Oauth refresh token back to the server.

7. Northern Trail Outfitters (NTO) leverages Microsoft Active Directory (AD) for management of employee usernames, passwords, permissions, and asset access. NTO also owns a third-party single sign-on (SSO) solution. The third-party party SSO solution is used for all corporate applications, including Salesforce.

NTO has asked an architect to explore Salesforce Identity Connect for automatic provisioning and deprovisiorung of users in Salesforce.

What role does identity Connect play in the outlined requirements?

Service Provider

Single Sign-On

Identity Provider

User Management

8. Universal Containers (UC) is building a custom Innovation platform on their Salesforce instance. The Innovation platform will be written completely in Apex and Visualforce and will use custom objects to store the Data. UC would like all users to be able to access the system without having to log in with Salesforce credentials. UC will utilize a third-party idp using SAML SSO .

What is the optimal Salesforce licence type for all of the UC employees?

Identity Licence.

Salesforce Licence.

External Identity Licence.

Salesforce Platform Licence.

9. A leading fitness tracker company is getting ready to launch a customer community. The company wants its customers to login to the community and connect their fitness device to their profile. Customers should be able to obtain exercise details and fitness recommendation In the community.

Which should be used to satisfy this requirement?

Named Credentials

OAuth Device Plow

Single Sign-On Settings

10. Under which scenario Web Server flow will be used?

Used for web applications when server-side code needs to interact with API

Used for server-side components when page needs to be rendered.

Used for mobile applications and testing legacy Integrations.

Used for verifying Access protected resources.

Page 2 of 5

11. Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app .

What should the Architect at UC first investigate?

Check the Refresh Token policy defined in the Salesforce Connected App.

Validate that the users are checking the box to remember their passwords.

Verify that the Callback URL is correctly pointing to the new URI Scheme.

Confirm that the access Token's Time-To-Live policy has been set appropriately.

12. Refer to the exhibit.

Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.

A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.

NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization.

what should an identity architect do to fulfill the above requirements?

For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.

Authorize third-party service by sending authorization requests to the community- url/services/oauth2/authonze/expid_value.

13. A client is planning to rollout multi-factor authentication (MFA) to its internal employees and

wants to understand which authentication and verification methods meet the Salesforce criteria for secure authentication.

Which three functions meet the Salesforce criteria for secure mfa? Choose 3 answers

username and password + SMS passcode

Username and password + secunty key

Third-party single sign-on with Mobile Authenticator app

Certificate-based Authentication

Lightning Login

14. architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct .

Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers

The Identity Provider is also used to SSO into five other applications.

The clock on the Identity Provider server is twenty minutes behind Salesforce.

The Issuer Certificate from the Identity Provider expired two weeks ago.

The default language for the Identity Provider and Salesforce are Different.

15. Which two are valid choices for digital certificates when setting up two-way SSL between Salesforce and an external system. Choose 2 answers

Use a trusted CA-signed certificate for salesforce and a trusted CA-signed cert for the external system

Use a trusted CA-signed certificate for salesforce and a self-signed cert for the external system

Use a self-signed certificate for salesforce and a self-signed cert for the external system

Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system

16. Northern Trail Outfitters (NTO) uses the Customer 360 Platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information.

What is the potential impact to the architecture if NTO decides to implement this feature?

Custom registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.

If contactless user is upgraded to Community license, the contact record is automatically created and linked to the user record, but not associated with an Account.

Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.

Passwordless authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record.

17. customer service representatives at Universal containers (UC) are complaining that whenever they click on links to case records and are asked to login with SAML SSO, they are being redirected to the salesforce home tab and not the specific case record .

What item should an architect advise the identity team at UC to investigate first?

My domain is configured and active within salesforce.

The salesforce SSO settings are using http post

The identity provider is correctly preserving the Relay state

The users have the correct Federation ID within salesforce.

18. What item should an Architect consider when designing a Delegated Authentication implementation?

The Web service should be secured with TLS using Salesforce trusted certificates.

The Web service should be able to accept one to four input method parameters.

The web service should use the Salesforce Federation ID to identify the user.

The Web service should implement a custom password decryption method.

19. Universal Containers (UC) wants to build a custom mobile app for their field reps to create orders in salesforce. After the first time the users log in, they must be able to access salesforce upon opening the mobile app without being prompted to log in again .

What Oauth flows should be considered to support this requirement?

Web Server flow with a Refresh Token.

Mobile Agent flow with a Bearer Token.

User Agent flow with a Refresh Token.

SAML Assertion flow with a Bearer Token.

20. Universal Containers (UC) wants to build a few applications that leverage the Salesforce REST API. UC has asked its Architect to describe how the API calls will be authenticated to a specific user .

Which two mechanisms can the Architect provide? Choose 2 Answers

Authentication Token

Session ID

Refresh Token

Access Token

Page 3 of 5

21. Universal Containers (UC) rolling out a new Customer Identity and Access Management Solution will be built on top of their existing Salesforce instance.

Several service providers have been setup and integrated with Salesforce using Open lD Connect to allow for a seamless single sign-on experience. UC has a requirement to limit user access to only a subset of service providers per customer type.

Which two steps should be done on the platform to satisfy the requirement? Choose 2 answers

Manage which connected apps a user has access to by assigning authentication providers to the users profile.

Assign the connected app to the customer community, and enable the users profile in the Community settings.

Use Profiles and Permission Sets to assign user access to Admin Pre-Approved Connected Apps.

Set each of the Connected App access settings to Admin Pre-Approved.

22. An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).

Which feature of Identity Connect is applicable for this scenano?

When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.

If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.

Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.

When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.

23. Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HANA. UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs.

Which two Salesforce license types does UC need for its employees? Choose 2 answers

Company Community and Identity licenses

Identity and Identity Connect licenses

Chatter Only and Identity licenses

Salesforce and Identity Connect licenses

24. Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials every time they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day .

What is the most likely cause of the issue?

The Oauth authorizations are being revoked by a nightly batch job.

The refresh token expiration policy is set incorrectly in salesforce

The app is requesting too many access Tokens in a 24-hour period

The users forget to check the box to remember their credentials.

25. Universal containers (UC) has implemented SAML -based single Sign-on for their salesforce application. UC is using pingfederate as the Identity provider. To access salesforce, Users usually navigate to a bookmarked link to my domain URL .

What type of single Sign-on is this?

Sp-Initiated

IDP-initiated with deep linking

IDP-initiated

Web server flow.

26. Universal containers (UC) has an e-commerce website while customers can buy products, make payments, and manage their accounts. UC decides to build a customer Community on Salesforce and wants to allow the customers to access the community for their accounts without logging in again. UC decides to implement ansp-Initiated SSO using a SAML-BASED complaint IDP.

In this scenario where salesforce is the service provider, which two activities must be performed in salesforce to make sp-Initiated SSO work? Choose 2 answers

Configure SAML SSO settings.

Configure Delegated Authentication

Create a connected App

Set up my domain

27. Universal Containers (UC) uses middleware to integrate multiple systems with Salesforce.

UC has a strict, new requirement that usernames and passwords cannot be stored in any UC system .

How can UC’s middleware authenticate to Salesforce while adhering to this requirement?

Create a Connected App that supports the JWT Bearer Token OAuth Flow.

Create a Connected App that supports the Refresh Token OAuth Flow

Create a Connected App that supports the Web Server OAuth Flow.

Create a Connected App that supports the User-Agent OAuth Flow.

28. Universal containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use salesforce ideas and provide the ability for employees to post ideas from the company portal. They use SAML-BASED SSO to get into the company portal and would like to leverage it to access salesforce. Most of the users don't exist in salesforce and they would like the user records created in salesforce communities the first time they try to access salesforce .

What recommendation should an architect make to meet this requirement?

Use on-the-fly provisioning

Use just-in-time provisioning

Use salesforce APIs to create users on the fly

Use Identity connect to sync users

29. Universal containers (UC) would like to enable SSO between their existing Active Directory infrastructure and salesforce. The it team prefers to manage all users in Active Directory and would like to avoid doing any initial setup of users in salesforce directly, including the correct assignment of profiles, roles and groups .

Which two optimal solutions should UC use to provision users in salesforce? Choose 2 answers

Use the salesforce REST API to sync users from active directory to salesforce

Use an app exchange product to sync users from Active Directory to salesforce.

Use Active Directory Federation Services to sync users from active directory to salesforce.

Use Identity connect to sync users from Active Directory to salesforce

30. Universal Containers (UC) has decided to use Salesforce as an Identity Provider for multiple external applications. UC wants to use the salesforce App Launcher to control the Apps that are available to individual users .

Which three steps are required to make this happen?

Add each connected App to the App Launcher with a Start UR

Set up an Auth Provider for each External Application.

Set up Salesforce as a SAML Idp with My Domain.

Set up Identity Connect to Synchronize user data.

Create a Connected App for each external application.

Page 4 of 5

31. Universal Containers built a custom mobile app for their field reps to create orders in Salesforce. OAuth is used for authenticating mobile users. The app is built in such a way that when a user session expires after Initial login, a new access token is obtained

automatically without forcing the user to log in again. While that improved the field reps' productivity, UC realized that they need a "logout" feature.

What should the logout function perform in this scenario, where user sessions are refreshed automatically?

Invoke the revocation URL and pass the refresh token.

Clear out the client Id to stop auto session refresh.

Invoke the revocation URL and pass the access token.

Clear out all the tokens to stop auto session refresh.

32. Universal containers (UC) is setting up their customer Community self-registration process.

They are uncomfortable with the idea of assigning new users to a default account record .

What will happen when customers self-register in the community?

The self-registration process will produce an error to the user.

The self-registration page will ask user to select an account.

The self-registration process will create a person Account record.

The self-registration page will create a new account record.

33. Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose .

Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication? Choose 2 answers

Salesforce license for sales users and Identity license for Marketing users

Salesforce license for sales users and External Identity license for Marketing users

Identity license for sales users and Identity connect license for Marketing users

Salesforce license for sales users and platform license for Marketing users.

34. Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.

What should an identity architect do to fulfill this requirement?

Contact Salesforce Support and enable delegate single sign-on.

Create a custom external authentication provider.

Use certificate-based authentication.

Configure OpenID Connect authentication provider.

35. Universal containers (UC) has a mobile application that it wants to deploy to all of its salesforce users, including customer Community users.

UC would like to minimize the administration overhead, which two items should an architect recommend? Choose 2 answers

Enable the "Refresh Tokens is valid until revoked " setting in the Connected App.

Enable the "Enforce Ip restrictions" settings in the connected App.

Enable the "All users may self-authorize" setting in the Connected App.

Enable the "High Assurance session required" setting in the Connected App.

36. Universal containers (UC) has a customer Community that uses Facebook for authentication. UC would like to ensure that changes in the Facebook profile are reflected on the appropriate customer Community user .

How can this requirement be met?

Use the updateuser() method on the registration handler class.

Use SAML just-in-time provisioning between Facebook and Salesforce

Use information in the signed request that is received from Facebook.

Develop a schedule job that calls out to Facebook on a nightly basis.

37. Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation .

What two risks Should the Architect point out? Choose 2 answers

Delegated Authentication is enabled or disabled for the entire Salesforce org.

UC will be required to develop and support a custom SOAP web service.

Salesforce users will be locked out of Salesforce if the web service goes down.

The web service must reside on a public cloud service, such as Heroku.

38. Containers (UC) uses an internal system for recruiting and would like to have the candidates' info available in the Salesforce automatically when they are selected. UC decides to use OAuth to connect to Salesforce from the recruiting system and would like to do the authentication using digital certificates .

Which two OAuth flows should be considered to meet the requirement? Choose 2 answers

JWT Bearer Token flow

Refresh Token flow

SAML Bearer Assertion flow

Web Service flow

39. Universal Containers (UC) is planning to deploy a custom mobile app that will allow users to get e-signatures from its customers on their mobile devices. The mobile app connects to Salesforce to upload the e-signature as a file attachment and uses OAuth protocol for both authentication and authorization .

What is the most recommended and secure OAuth scope setting that an Architect should recommend?

Web

Api

Custom_permissions

40. Universal Containers (UC) has decided to replace the homegrown customer portal with Salesforce Experience Cloud. UC will continue to use its third-party single sign-on (SSO) solution that stores all of its customer and partner credentials.

The first time a customer logs in to the Experience Cloud site through SSO, a user record needs to be created automatically.

Which solution should an identity architect recommend in order to automatically provision users in Salesforce upon login?

Just-in-Time (JIT) provisioning

Custom middleware and web services

Custom login flow and Apex handler

Third-party AppExchange solution

Page 5 of 5

41. Universal Containers (UC) has implemented a multi-org architecture in their company. Many users have licences across multiple orgs, and they are complaining about remembering which org and credentials are tied to which business process .

Which two recommendations should the Architect make to address the Complaints? Choose 2 answers

Activate My Domain to Brand each org to the specific business use case.

Implement SP-Initiated Single Sign-on flows to allow deep linking.

Implement IdP-Initiated Single Sign-on flows to allow deep linking.

Implement Delegated Authentication from each org to the LDAP provider.

42. Universal Containers (UC) has a Desktop application to collect leads for marketing campaigns. UC wants to extend this application to integrate with Salesforce to create leads. Integration between the desktop application and salesforce should be seamless.

What Authorization flow should the Architect recommend?

JWT Bearer Token flow

Web Server Authentication Flow

User Agent Flow

Username and Password Flow

43. Universal Containers (UC) has an existing e-commerce platform and is implementing a new customer community. They do not want to force customers to register on both applications due to concern over the customers experience. It is expected that 25% of the e-commerce customers will utilize the customer community. The e-commerce platform is capable of generating SAML responses and has an existing REST-ful API capable of managing users .

How should UC create the identities of its e-commerce users with the customer community?

Use SAML JIT in the Customer Community to create users when a user tries to login to the community from the e-commerce site.

Use the e-commerce REST API to create users when a user self-register on the customer community and use SAML to allow SS

Use a nightly batch ETL job to sync users between the Customer Community and the e-commerce platform and use SAML to allow SS

Use the standard Salesforce API to create users in the Community When a User is Created in the e-Commerce platform and use SAML to allow SS

44. Universal containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app .

Which two are recommendations to make the UC? Choose 2 answers

Disallow the use of single Sign-on for any users of the mobile app.

Require high assurance sessions in order to use the connected App

Use Google Authenticator as an additional part of the logical processes.

Set login IP ranges to the internal network for all of the app users profiles.

45. Universal containers (UC) wants users to authenticate into their salesforce org using credentials stored in a custom identity store. UC does not want to purchase or use a third-party Identity provider. Additionally, UC is extremely wary of social media and does not consider it to be trust worthy .

Which two options should an architect recommend to UC? Choose 2 answers

Use a professional social media such as LinkedIn as an Authentication provider

Build a custom web page that uses the identity store and calls frontdoor.jsp

Build a custom Web service that is supported by Delegated Authentication.

Implement the Openid protocol and configure an Authentication provider

46. Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow employees to post Ideas from the Employee portal. When users click on some of the links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with the relevant pages .

What OAuth flow is best suited for this scenario?

Web Application flow

SAML Bearer Assertion flow

User-Agent flow

Web Server flow

47. Universal containers wants to set up SSO for a selected group of users to access external applications from salesforce through App launcher .

Which three steps must be completed in salesforce to accomplish the goal?

Associate user profiles with the connected Apps.

Complete my domain and Identity provider setup.

Create connected apps for the external applications.

Complete single Sign-on settings in security controls.

Create named credentials for each external system.

Real Dumps for Salesforce Identity and Access Management Designer Exam

Real Dumps for Salesforce Identity and Access Management Designer Exam

Share this post

Leave a Reply Cancel reply

Related Posts