[Dec-2025] Pass Salesforce Identity-and-Access-Management-Architect Exam in First Attempt Guaranteed! [Q78-Q94]

4/5 - (1 vote)

[Dec-2025] Pass Salesforce Identity-and-Access-Management-Architect Exam in First Attempt Guaranteed!

Full Identity-and-Access-Management-Architect Practice Test and 244 unique questions with explanations waiting just for you, get it now!

NEW QUESTION 78
Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers

Resource deep linking

App launcher

SSO from salesforce1 mobile app.

NEW QUESTION 79
A group of users try to access one of Universal Containers’ Connected Apps and receive the following error message: ” Failed: Not approved for access.” What is the most likely cause of this issue?

The Connected App settings “All users may self-authorize” is enabled.

The Salesforce Administrators have revoked the OAuth authorization.

The Users do not have the correct permission set assigned to them.

The User of High Assurance sessions are required for the Connected App.

NEW QUESTION 80
Northern Trail Outfitters want to allow its consumer to self-register on it business-to-consumer (B2C) portal that is built on Experience Cloud. The identity architect has recommended to use Person Accounts.
Which three steps need to be configured to enable self-registration using person accounts?
Choose 3 answers

Enable access to person and business account record types under Public Access Settings.

Contact Salesforce Support to enable business accounts.

Under Login and Registration settings, ensure that the default account field is empty.

Contact Salesforce Support to enable person accounts.

Set organization-wide default sharing for Contact to Public Read Only.

NEW QUESTION 81
A company’s external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?

Select “Admin approved users are pre-authorized” and assign specific profiles.

Create custom scopes and assign to the connected app.

Define a permission set that grants access to the app and assign to authorized users.

Leverage external objects and data classification policies.

NEW QUESTION 82
Universal Containers (UC) is implementing Salesforce and would like to establish SAML SSO for its users to log in. UC stores its corporate user identities in a Custom Database. The UC IT Manager has heard good things about Salesforce Identity Connect as an Idp, and would like to understand what limitations they may face if they decided to use Identity Connect in their current environment. What limitation Should an Architect inform the IT Manager about?

Identity Connect will not support user provisioning in UC’s current environment.

Identity Connect will only support Idp-initiated SAML flows in UC’scurrent environment.

Identity Connect will only support SP-initiated SAML flows in UC’s current environment.

Identity connect is not compatible with UC’s current identity environment.

NEW QUESTION 83
Universal containers wants to implement single Sign-on for a salesforce org using an external identity provider and corporate identity store. What type of Authentication flow is required to support deep linking?

Web server Oauth SSO flow.

Identity-provider-initiated SSO

Service-provider-initiated SSO

Start URL on identity provider

NEW QUESTION 84
Universal containers wants salesforce inbound Oauth-enabledintegration clients to use SAML-BASED single Sign-on for authentication. What Oauth flow would be recommended in this scenario?

User-Agent Oauth flow

SAML assertion Oauth flow

User-Token Oauth flow

Web server Oauth flow

NEW QUESTION 85
Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.
What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.

Build an integration that queries LDAP periodically and creates new active users in Salesforce.

Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at first login.

NEW QUESTION 86
Universal Containers is implementing Salesforce Identity to broker authentication from its enterprise single sign-on (SSO) solution through Salesforce to third party applications using SAML.
What rote does Salesforce Identity play in its relationship with the enterprise SSO system?

Identity Provider (IdP)

Resource Server

Service Provider (SP)

Client Application

NEW QUESTION 87
Universal Containers wants to implement SAML SSO for their internal Salesforce users using a third-party IdP. After some evaluation, UC decides not to set up My Domain for their Salesforce org. How does that decision impact their SSO implementation?

SP-initiated SSO will not work.

Neither SP- nor IdP-initiated SSO will work.

Either SP- or IdP-initiated SSO will work.

IdP-initiated SSO will not work.

NEW QUESTION 88
An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer’s sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.
Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150 sub-brands?

Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.

Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuth and Security Assertion Markup Language (SAML) flows.

Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.

Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the user experience.

NEW QUESTION 89
Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for to give its customers the ability to login with their Facebook and Twitter credentials.
Which two actions should an identity architect recommend to meet these requirements?
Choose 2 answers

Create a custom external authentication provider for Facebook.

Configure a predefined authentication provider for Facebook.

Create a custom external authentication provider for Twitter.

Configure a predefined authentication provider for Twitter.

NEW QUESTION 90
How should an Architect force user to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

Use Custom Login Flows with Apex to detect the user’s IP address and prompt for 2FA if needed.

Add the list of company’s network IP addresses to the Login Range list under 2FA Setup.

Use an Apex Trigger on the UserLogin object to detect the user’s IP address and prompt for 2FA if needed.

Apply the “Two-factor Authentication for User Interface Logins” permission and Login IP Ranges for all Profiles.

NEW QUESTION 91
Universal Containers (UC) has built a custom time tracking app for its employee. UC wants to leverage Salesforce Identity to control access to the custom app.
At a minimum, which Salesforce license is required to support this requirement?

Identity Verification

Identity Connect

Identity Only

External Identity

NEW QUESTION 92
Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC’s security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?

Include client ID and client secret in the login header callout.

Set up a proxy server for the login service in the DMZ.

Require the use of Salesforce security Tokens on password.

Enforce mutual Authentication between systems using SSL.

NEW QUESTION 93
An insurance company has a connected app in its Salesforce environment that is usedto integrate with a Google Workspace (formerly knot as G Suite).
An identity and access management (IAM) architect has been asked to implement automation to enable users, freeze/suspend users, disable users, and reactivate existing users in Google Workspace upon similar actions in Salesforce.
Which solution is recommended to meet this requirement?

Configure user Provisioning for Connected Apps.

Update the Security Assertion Markup Language Just-in-Time (SAML JIT) handler in Salesforce for user provisioning and de-provisioning.

Build a custom REST endpoint in Salesforce that Google Workspace can poll against.

Build an Apex trigger on the userlogin object to make asynchronous callouts to Google APIs.

NEW QUESTION 94
Which two statements are capable of Identity Connect? Choose 2 answers

Synchronization of Salesforce Permission Set Licence Assignments.

Supports both Identity-Provider-Initiated and Service-Provider-Initiated SSO.

Support multiple orgs connecting to multiple Active Directory servers.

Automated user synchronization and de-activation.