Pass Identity-and-Access-Management-Architect Brain Dump Updated Certification Sample Questions [Q64-Q87]

Rate this post

Pass Identity-and-Access-Management-Architect Brain Dump Updated Certification Sample Questions

Online Identity-and-Access-Management-Architect Test Brain Dump Question and Test Engine

Salesforce Certified Identity and Access Management Architect certification exam is a proctored exam that consists of 60 multiple-choice questions. Candidates have 105 minutes to complete the exam, and the passing score is 70%. Identity-and-Access-Management-Architect exam is available in English and costs $400.

Salesforce Certified Identity and Access Management Architect certification exam is designed for experienced Salesforce professionals who have a deep understanding of the platform’s security capabilities and can design and implement complex security solutions. Salesforce Certified Identity and Access Management Architect certification exam is a significant milestone for security architects, security consultants, security analysts, and security engineers who aim to advance their careers in this field.

Q64. Universal Containers (UC) has an e-commerce website where customers can buy products, make payments, and manage their accounts. UC decides to build a Customer Community on Salesforce and wants to allow the customers to access the community from their accounts without logging in again. UC decides to implement an SP-initiated SSO using a SAML-compliant Idp. In this scenario where Salesforce is the Service Provider, which two activities must be performed in Salesforce to make SP-initiated SSO work? Choose 2 answers

Configure SAML SSO settings.

Create a Connected App.

Configure Delegated Authentication.

Set up My Domain.

Q65. A university is planning to set up an identity solution for its alumni. A third-party identity provider will be used for single sign-on Salesforce will be the system of records. Users are getting error messages when logging in.
Which Salesforce feature should be used to debug the issue?

Apex Exception Email

View Setup Audit Trail

Debug Logs

Q66. The CIO of universal containers(UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize Oauth 2.0. UC has listed an architect to analyze all of the applications that use Oauth flows to. See where refresh Tokens can be applied. Which two OAuth flows should the architect consider in their evaluation? Choose 2 answers

Web server

Jwt bearer token

User-Agent

Username-password

Q67. Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO’s Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

Configure an authentication provider to delegate authentication to the LDAP directory.

use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Q68. Universal containers uses an Employee portal for their employees to collaborate. employees access the portal from their company’s internal website via SSO. It is set up to work with Active Directory. What is the role of Active Directory in this scenario?

Identity store

Authentication store

Identity provider

Service provider

Q69. Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO’s Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

Configure an authentication provider to delegate authentication to the LDAP directory.

use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Q70. A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropriate way to generate sensor Information In Salesforce.
Which OAuth flow should the architect recommend?

OAuth 2.0 Asset Token Flow

OAuth 2.0 Device Authentication Row

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 SAML Bearer Assertion Flow

Q71. An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?

Users once logged In, can go to the Change Password screen in Salesforce.

Users can click on the “Forgot your Password” link on the Salesforce.com login page.

Users can request the Salesforce Admin to reset their password.

Users can change it on the enterprise LDAP authentication portal.

Q72. An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer’s sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.
Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150sub-brands?

Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.

Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuthand Security Assertion Markup Language (SAML) flows.

Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.

Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the user experience.

Q73. Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an externalidentity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.
What should a identity architect recommend to create partners?

On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.

Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.

Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.

Allow partners to register through the IdP and create partner users in Salesforce through an API.

Q74. Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce?
Choose 2 answers

Users leaving laptops unattended and not logging out of Salesforce.

Users accessing Salesforce from a public Wi-Fi access point.

Users choosing passwords that are the same as their Facebook password.

Users creating simple-to-guess password reset questions.

Q75. An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?

Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to “Admin Pre-Approved”.

Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to ‘Admin Pre-Approved”.

Enable the Full Access Scope and then set the connected app access settings to “Admin Pre-Approved”.

Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to “User may self authorize”.

Q76. Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

Enable “Allow customers and partners to self-register”.

Select the “Configurable Self-Reg Page” option under Login & Registration.

Set jp an external login page and call Salesforce APIs for user creation.

Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.

Customize me self-registration Apex handler to create only the user record.

Q77. A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect (OIDC).
When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC or SAML?

OIDC is more secure than SAML and therefore is the obvious choice.

The SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider.

If the user has a session on Salesforce, you do not want them to be prompted for a username and password when they login to the SP.

They are equivalent protocols and there is no real reason to choose one over the other.

Q78. A global company’s Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) ‘Replay Detected and Assertion Invalid’ login errors.
Which two issues would cause these errors?
Choose 2 answers

The subject element ismissing from the assertion sent to salesforce.

The certificate loaded into SSO configuration does not match the certificate used by the IdP.

The current time setting of the company’s identity provider (IdP) and Salesforce platform is out of sync by more than eight minutes.

The assertion sent to 5alesforce contains an assertion ID previously used.

Q79. Universal Containers (UC) wants to provide single sign-on (SSO) for a business-to-consumer (B2C) application using Salesforce Identity.
Which Salesforce license should UC utilize to implement this use case?

Identity Only

Salesforce Platform

External Identity

Partner Community

Q80. A group of userstry to access one of universal containers connected apps and receive the following error message: “Failed : Not approved for access”. what is most likely to cause of the issue?

The use of high assurance sections are required for the connected App.

The users do not have the correct permission set assigned to them.

The connected App setting “All users may self-authorize” is enabled.

The salesforce administrators gave revoked the Oauth authorization.

Q81. An identity architect has been asked to recommend a solution that allows administrators to configure personalized alert messages to users before they land on the Experience Cloud site (formerly known as Community) homepage.
What is recommended to fulfill this requirement with the least amount of customization?

Customize the registration handler Apex class to create a routing logic navigating to different home pages based on the user profile.

Use Login Flows to add a screen that shows personalized alerts.

Build aLightning web Component (LWC) for a homepage that shows custom alerts.

Create custom metadata that stores user alerts and use a LWC to display alerts.

Q82. Universal Containers has multiple Salesforce instances where users receive emails from different instances.
Users should be logged into the correct Salesforce instance authenticated by their IdP when clicking on an email link to a Salesforce record.
What should be enabled in Salesforce as a prerequisite?

My Domain

External Identity

Identity Provider

Multi-Factor Authentication

Q83. Northern Trail Outfitters (NTO) wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, NTO establishes a single customer view including their buying behaviors, channel preferences and purchasing history. All of this information exists but is spread across different systems and formats.
NTO has decided to use Salesforce as the platform to build a 360 degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets.
What should an Identity Architect do to provision, deprovision and authenticate users?

Salesforce Identity is not needed since NTO uses Microsoft AD.

Salesforce Identity can be included but NTO will be required to build a custom integration with Microsoft AD.

Salesforce Identity is included in the Salesforce licenses so it does not need to be considered separately.

A Salesforce Identity can be included but NTO will require Identity Connect.

Q84. The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discussSalesforce out-of-box capabilities for configuring the company*s login and registration experience on Salesforce Experience Cloud.
The CMO is looking to brand the login page with the company’s logo, background color, login button color, and dynamic right-frame from an external URL.
Which two solutions should the IAM specialist recommend?
Choose 2 answers

Use Experience Builder to build branded Reset and Forgot Password pages.

Build custom pages for branding requirements in Experience Cloud.

Build custom site pages for reset and forgot password features.

Q85. Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?

Use salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.

Use Delegated Authentication with callouts to a third-party fingerprint scanning application.

Use an appexchange product that does fingerprint scanning with native salesforce identity confirmation.

Use custom login flows with callouts to a third-party fingerprint scanning application.

Q86. An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM do to fulfill this requirement?

Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.

Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.

Create a default account for capturing all ecommerce contacts registered on the community because person Account is not supported for this case.

Confirm performance considerations with Salesforce Customer Support due to high peaks.

Q87. Universal Containers (UC) is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.
Which two page types are valid login page types for the site?
Choose 2 answers

Experience Builder Page

lightning Experience Page

Embedded Login Page