Skip to content

Free certification exam prep

  • HOME
  • ALL EXAMS
  • SAP
  • Amazon
  • Cisco
  • CompTIA
  • Google
  • HP
  • Huawei
  • Microsoft
  • Oracle
  • Salesforce
  • Contact
  • Home
  • 2026
  • March
  • 28
  • Pass Identity-and-Access-Management-Architect Brain Dump Updated Certification Sample Questions [Q64-Q87]

Pass Identity-and-Access-Management-Architect Brain Dump Updated Certification Sample Questions [Q64-Q87]

Posted on March 28, 2026 By freedumps No Comments on Pass Identity-and-Access-Management-Architect Brain Dump Updated Certification Sample Questions [Q64-Q87]
Identity-and-Access-Management-Architect, Salesforce
Rate this post

Pass Identity-and-Access-Management-Architect Brain Dump Updated Certification Sample Questions

Online Identity-and-Access-Management-Architect Test Brain Dump Question and Test Engine

Salesforce Certified Identity and Access Management Architect certification exam is a proctored exam that consists of 60 multiple-choice questions. Candidates have 105 minutes to complete the exam, and the passing score is 70%. Identity-and-Access-Management-Architect exam is available in English and costs $400.

Salesforce Certified Identity and Access Management Architect certification exam is designed for experienced Salesforce professionals who have a deep understanding of the platform’s security capabilities and can design and implement complex security solutions. Salesforce Certified Identity and Access Management Architect certification exam is a significant milestone for security architects, security consultants, security analysts, and security engineers who aim to advance their careers in this field.

 

Q64. Universal Containers (UC) has an e-commerce website where customers can buy products, make payments, and manage their accounts. UC decides to build a Customer Community on Salesforce and wants to allow the customers to access the community from their accounts without logging in again. UC decides to implement an SP-initiated SSO using a SAML-compliant Idp. In this scenario where Salesforce is the Service Provider, which two activities must be performed in Salesforce to make SP-initiated SSO work? Choose 2 answers

 
 
 
 
Explanation
To enable SP-initiated SSO with Salesforce as the Service Provider, two steps are required in Salesforce:
Option A is correct because configuring SAML SSO settings involves specifying the identity provider details, such as the entity ID, login URL, logout URL, and certificate2.
Option D is correct because setting up My Domain enables you to use a custom domain name for your Salesforce org and allows you to use SAML as an authentication method3.
Option B is incorrect because creating a connected app is not necessary for SP-initiated SSO using a SAML-compliant IdP. A connected app is used for OAuth-based authentication or OpenID Connect-based authentication4.
Option C is incorrect because configuring delegated authentication is not related to SP-initiated SSO using a SAML-compliant IdP. Delegated authentication is a feature that allows Salesforce to delegate user authentication to an external service, such as LDAP or Active Directory5.
References: SAML-based single sign-on: Configuration and Limitations, Configure SAML single sign-on with an identity provider, My Domain, Create a Connected App, Configure Salesforce for Delegated Authentication

Q65. A university is planning to set up an identity solution for its alumni. A third-party identity provider will be used for single sign-on Salesforce will be the system of records. Users are getting error messages when logging in.
Which Salesforce feature should be used to debug the issue?

 
 
 
 

Q66. The CIO of universal containers(UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize Oauth 2.0. UC has listed an architect to analyze all of the applications that use Oauth flows to. See where refresh Tokens can be applied. Which two OAuth flows should the architect consider in their evaluation? Choose 2 answers

 
 
 
 

Q67. Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO’s Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

 
 
 
 

Q68. Universal containers uses an Employee portal for their employees to collaborate. employees access the portal from their company’s internal website via SSO. It is set up to work with Active Directory. What is the role of Active Directory in this scenario?

 
 
 
 
Explanation
The role of Active Directory in this scenario is an identity provider. An identity provider is an application that authenticates users and provides information about them to service providers6. A service provider is an application that provides a service to users and relies on an identity provider for authentication6. In this scenario, the employee portal is a service provider that provides collaboration features to employees and relies on Active Directory for authentication. Active Directory is an identity provider that authenticates employees using their corporate credentials and sends information about them to the employee portal7.
References: Identity Provider Overview, Configure SSO to Salesforce Using Microsoft AD FS as the Identity Provider

Q69. Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO’s Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

 
 
 
 
Explanation
Login History allows administrators to view the login attempts of all users in the org, including the status, source IP, login type, and application. This can help identify and troubleshoot any login errors or issues.
References: Login History

Q70. A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropriate way to generate sensor Information In Salesforce.
Which OAuth flow should the architect recommend?

 
 
 
 
Explanation
To generate sensor information in Salesforce, the architect should recommend OAuth 2.0 Asset Token Flow.
OAuth 2.0 Asset Token Flow is a protocol that allows devices, such as sensors, to obtain an access token from Salesforce by using a certificate instead of an authorization code. The access token can be used to access Salesforce APIs and send data to Salesforce. OAuth 2.0 Asset Token Flow is designed for devices that do not have a user interface or a web browser. References: OAuth 2.0 Asset Token Flow, Authorize Apps with OAuth

Q71. An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?

 
 
 
 

Q72. An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer’s sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.
Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150sub-brands?

 
 
 
 
To support scalability and reduce maintenance costs for a multinational, multi-brand organization, the architect should recommend assigning each sub-brand a unique Experience ID and using the Experience ID to dynamically brand the login experience. Experience ID is a parameter that can be used to identify different brands or experiences within a single Experience Cloud site (formerly known as Community). Dynamic branding is afeature that allows Experience Cloud sites to display different branding elements, such as logos, colors, or images, based on the Experience ID or other criteria. This solution can provide a consistent and personalized brand experience for each sub-brandwithout creating multiple subdomains or orgs. References:
Experience ID, Dynamic Branding for Experience Cloud Sites

Q73. Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an externalidentity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.
What should a identity architect recommend to create partners?

 
 
 
 
To create partners using an external identity provider (IdP) and avoid duplicate accounts with Salesforce, the identity architect should recommend creating a custom page in Experience Cloud to self register partner with Experience Cloud and Ping identity store. Ping is an IdP that supports OpenID Connect protocol, which allows users to sign in with an external identity provider and access Salesforce resources. By creating a custom page in Experience Cloud, the identity architect can use a custom registration handler to link the partner’s Ping identity with their Salesforce identity and prevent duplicate accounts. The custom page can also provide a seamless user experience for the partners. References: OpenID Connect Authentication Providers, Social Sign-On with OpenID Connect, Create a Custom Registration Handler

Q74. Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce?
Choose 2 answers

 
 
 
 
Explanation
Enabling Two-Factor Authentication (2FA) in Salesforce can mitigate the security risks of users accessing Salesforce from a public Wi-Fi access point or choosing passwords that are the same as their Facebook password. 2FA is an additional layer of protection beyond your password that requires users to verify their identity with another factor, such as a mobile app, a security key, or a verification code. This can prevent unauthorized access even if the user’s password is compromised or guessed by a malicious actor. The other options are not directly related to 2FA, but rather to user behavior or password policies.

Q75. An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?

 
 
 
 
JWT Bearer Flow is an OAuth 2.0 flow that allows a client app to obtain an access token without user interaction. It requires a certificate to sign the JWT and the API and Offline Access scopes to access the Salesforce REST API and refresh the token. The connected app must also be pre-approved by the admin to avoid the OAuth approval page. References: OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration, Authorize an Org Using the JWT Flow

Q76. Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

 
 
 
 
 

Q77. A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect (OIDC).
When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC or SAML?

 
 
 
 

Q78. A global company’s Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) ‘Replay Detected and Assertion Invalid’ login errors.
Which two issues would cause these errors?
Choose 2 answers

 
 
 
 
A SAML SSO ‘Replay Detected and Assertion Invalid’ error occurs when Salesforce detects that the same assertion has been used more than oncewithin the validity period. This can happen if the assertion ID is reused by the IdP or if the assertion is resent by the user. Another possible cause is that the time settings of the IdP and Salesforce are not synchronized, which can result in an assertion being valid for a shorter or longer period than expected. References: SAML Single Sign-On Settings, Troubleshoot SAML Single Sign-On

Q79. Universal Containers (UC) wants to provide single sign-on (SSO) for a business-to-consumer (B2C) application using Salesforce Identity.
Which Salesforce license should UC utilize to implement this use case?

 
 
 
 

Q80. A group of userstry to access one of universal containers connected apps and receive the following error message: “Failed : Not approved for access”. what is most likely to cause of the issue?

 
 
 
 
The users do not have the correct permission set assigned to them is the most likely cause of the issue. A connected app is a framework that enables an externalapplication to integrate with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect1. Connected apps use these protocols to authorize, authenticate, and provide single sign-on (SSO) for external apps1. To access a connected app, users must have the appropriate permissions assignedto them, either through their profile or a permission set2. If the users do not have the required permissions, they will receive an error message when they try to access the connected app. The use of high assurance sessions are required for the connected app is not a validoption, as high assurance sessions are related to multi-factor authentication (MFA), not connected apps3. The connected app setting “All users may self-authorize” is enabled is not a cause of the issue, but a possible solution. This setting allows users to access the connected app without pre-approval from an administrator4. The Salesforce administrators have revoked the OAuth authorizationis not a likely cause of the issue, as OAuth authorization is granted by the users, not the administrators5. Revoking OAuth authorization would also affect all users, not just a group of them.
References: Learn About Connected Apps, Create a Connected App, [Multi-Factor Authentication (MFA) for Salesforce], [Connected App Basics], OAuth Authorization Flows

Q81. An identity architect has been asked to recommend a solution that allows administrators to configure personalized alert messages to users before they land on the Experience Cloud site (formerly known as Community) homepage.
What is recommended to fulfill this requirement with the least amount of customization?

 
 
 
 
Login Flows are custom post-authentication processes that can be used to add additional screens or logic after a user logs in to Salesforce. Login Flows can be used to show personalized alert messages to users based on their profile or other criteria before they land on the Experience Cloud site homepage. Login Flows require minimal customization and can be configured using Visual Workflow or Apex. References: Login Flows, Customizing User Authentication with Login Flows

Q82. Universal Containers has multiple Salesforce instances where users receive emails from different instances.
Users should be logged into the correct Salesforce instance authenticated by their IdP when clicking on an email link to a Salesforce record.
What should be enabled in Salesforce as a prerequisite?

 
 
 
 

Q83. Northern Trail Outfitters (NTO) wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, NTO establishes a single customer view including their buying behaviors, channel preferences and purchasing history. All of this information exists but is spread across different systems and formats.
NTO has decided to use Salesforce as the platform to build a 360 degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets.
What should an Identity Architect do to provision, deprovision and authenticate users?

 
 
 
 
Identity Connect is a Salesforce product that integrates Microsoft Active Directory with Salesforce user records. It allows provisioning, deprovisioning, and authentication of users based on AD data.The other options are either incorrect or irrelevant for this use case. References: Get to Know Identity Connect, Identity Connect

Q84. The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discussSalesforce out-of-box capabilities for configuring the company*s login and registration experience on Salesforce Experience Cloud.
The CMO is looking to brand the login page with the company’s logo, background color, login button color, and dynamic right-frame from an external URL.
Which two solutions should the IAM specialist recommend?
Choose 2 answers

 
 
 
 
Experience Builder and Community Administration settings are the tools that allow branding the login and registration pages in Experience Cloud. Custom pages are not necessary for this use case.
References: Architect Journey: Identity and Access Management Trailmix – Trailhead

Q85. Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?

 
 
 
 

Q86. An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM do to fulfill this requirement?

 
 
 
 
Explanation
According to the Salesforce documentation2, OAuth2 RPs (relying parties) are applications that use OAuth 2.0 for authentication and authorization with an external identity provider. This allows users to log in to multiple applications with a single identity provider account. The identity provider issues an access token to the relying party, which can be used to access protected resources on behalf of the user. This solution can support high volumes of logins per minute and unify multiple B2C Commerce sites and an Experience Cloud community with a single identity.

Q87. Universal Containers (UC) is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.
Which two page types are valid login page types for the site?
Choose 2 answers

 
 
 
 
Explanation
Login Discovery Page and Embedded Login Page are two valid login page types for Experience Cloud sites.
Login Discovery Page allows users to choose their preferred login method, such as username/password, SSO, or social sign-on. Embedded Login Page allows users to log in from any site page without being redirected to a separate login page. References: Login Discovery Page, Embedded Login

Loading ... Loading …

Loading

Real Salesforce Identity-and-Access-Management-Architect Exam Dumps with Correct 244 Questions and Answers: https://www.free4dump.com/Identity-and-Access-Management-Architect-braindumps-torrent.html

         

Related Links: www.stes.tyc.edu.tw www.stes.tyc.edu.tw www.stes.tyc.edu.tw myportal.utt.edu.tt myportal.utt.edu.tt www.stes.tyc.edu.tw

Tags: Identity-and-Access-Management-Architect intereactive testing engine Identity-and-Access-Management-Architect latest braindumps sheet Identity-and-Access-Management-Architect practice exams free Identity-and-Access-Management-Architect reliable test experience Identity-and-Access-Management-Architect test sample Identity-and-Access-Management-Architect valid dumps files

Post navigation

❮ Previous Post: CCDAK Dumps PDF New [2026] Ultimate Study Guide [Q23-Q45]
Next Post: [Q21-Q45] Real 1z1-076 dumps – Real Oracle dumps PDF in here [Mar-2026] ❯

You may also like

OmniStudio-Consultant
[Oct 01, 2024] Achive your Success with Latest Salesforce OmniStudio-Consultant Exam [Q13-Q35]
October 1, 2024
CRT-211
[Q219-Q240] 2022 Reliable Study Materials & Testing Engine for CRT-211 Exam Success!
October 13, 2022
Salesforce-Data-Cloud
Oct-2023 Salesforce Salesforce-Data-Cloud Actual Questions and 100% Cover Real Exam Questions [Q15-Q35]
October 26, 2023
Salesforce-Loyalty-Management
Verified Salesforce-Loyalty-Management exam dumps Q&As with Correct 106 Questions and Answers [Q22-Q42]
September 10, 2025

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Enter the text from the image below
 

Identity-and-Access-Management-Architect Practice Tests

  • [Dec-2025] Pass Salesforce Identity-and-Access-Management-Architect Exam in First Attempt Guaranteed! [Q78-Q94]
  • Pass Identity-and-Access-Management-Architect Brain Dump Updated Certification Sample Questions [Q64-Q87]

Related Certifications

  • Salesforce-Mobile (1)
  • CRT-450 (3)
  • Strategy-Designer (1)
  • CRT-251 (2)
  • B2C-Commerce-Developer (2)
  • Einstein-Analytics-and-Discovery-Consultant (1)
  • ADX-201 (1)
  • MCC-201 (1)
  • ADM-201 (1)
  • Salesforce-AI-Associate (1)

Recent Posts

  • Ace PCPP-32-101 Certification with 71 Actual Questions [Q41-Q65]
  • [Sep 27, 2026] Get Latest and 100% Accurate Databricks-Machine-Learning-Professional Exam Questions [Q36-Q51]
  • ISA-IEC-62443 Premium PDF & Test Engine Files with 221 Questions & Answers [Q87-Q107]
  • [Sep-2026] ITILFND_V4 Exam Dumps – Free Demo & 365 Day Updates [Q44-Q60]
  • New (2026) Network Appliance NS0-194 Exam Dumps [Q37-Q53]

Archives

  • September 2026 (17)
  • August 2026 (20)
  • July 2026 (9)
  • May 2026 (10)
  • April 2026 (8)
  • March 2026 (23)
  • February 2026 (23)
  • January 2026 (13)
  • December 2025 (22)
  • November 2025 (2)
  • October 2025 (4)
  • September 2025 (9)
  • August 2025 (8)
  • July 2025 (5)
  • April 2025 (6)
  • March 2025 (10)
  • February 2025 (16)
  • January 2025 (18)
  • December 2024 (10)
  • November 2024 (14)
  • October 2024 (19)
  • September 2024 (7)
  • August 2024 (4)
  • July 2024 (13)
  • June 2024 (22)
  • May 2024 (11)
  • April 2024 (4)
  • March 2024 (18)
  • February 2024 (15)
  • January 2024 (29)
  • December 2023 (42)
  • November 2023 (28)
  • October 2023 (24)
  • September 2023 (20)
  • August 2023 (14)
  • July 2023 (18)
  • June 2023 (17)
  • May 2023 (19)
  • April 2023 (30)
  • March 2023 (13)
  • February 2023 (28)
  • January 2023 (23)
  • December 2022 (36)
  • November 2022 (21)
  • October 2022 (21)
  • September 2022 (16)
  • August 2022 (35)
  • July 2022 (29)
  • June 2022 (33)

Categories

  • A10 Networks (1)
  • AACE International (1)
  • AACN (1)
  • ACAMS (4)
  • ACT (1)
  • Adobe (11)
  • AFP (1)
  • AGA (1)
  • AICPA (1)
  • Alibaba Cloud (2)
  • Amazon (16)
  • APMG-International (3)
  • ASIS (1)
  • ASQ (5)
  • ATLASSIAN (2)
  • Avaya (3)
  • BACB (1)
  • BCS (7)
  • BICSI (2)
  • Blue Prism (1)
  • Broadcom (1)
  • Business Architecture Guild (1)
  • CCE Global (1)
  • Certinia (1)
  • CertNexus (2)
  • CheckPoint (1)
  • CIDQ (1)
  • CIMA (6)
  • CIPS (2)
  • Cisco (39)
  • CISI (1)
  • Citrix (3)
  • CIW (1)
  • Cloud Security Alliance (1)
  • CloudBees (1)
  • College Admission (1)
  • CompTIA (15)
  • Confluent (1)
  • CWNP (1)
  • DAMA (1)
  • Databricks (5)
  • Docker (1)
  • EC-COUNCIL (6)
  • ECCouncil (2)
  • EMC (10)
  • EXIN (6)
  • F5 (2)
  • Facebook (2)
  • FINRA (1)
  • Forescout (1)
  • Fortinet (21)
  • GAQM (4)
  • GED (1)
  • Genesys (2)
  • GIAC (2)
  • Google (5)
  • H3C (1)
  • HashiCorp (2)
  • Hitachi (3)
  • HP (19)
  • HRCI (1)
  • Huawei (42)
  • IAPP (6)
  • IBM (12)
  • IIA (3)
  • IIBA (3)
  • IICRC (1)
  • ISACA (6)
  • ISC (5)
  • ISM (1)
  • ISQI (4)
  • Juniper (16)
  • Linux Foundation (2)
  • Lpi (3)
  • Maryland Insurance Administration (1)
  • Medical Professional (1)
  • Microsoft (38)
  • MikroTik (1)
  • MuleSoft (3)
  • NACE (1)
  • NASM (1)
  • NBMTM (1)
  • NCLEX (1)
  • Netskope (1)
  • NetSuite (2)
  • Network Appliance (5)
  • NFPA (1)
  • NICET (1)
  • NSCA (1)
  • Nutanix (11)
  • OCEG (1)
  • OMG (1)
  • Oracle (45)
  • Palo Alto Networks (7)
  • PCI SSC (1)
  • PECB (2)
  • Pegasystems (5)
  • PMI (5)
  • PRINCE2 (2)
  • PRMIA (1)
  • Python Institute (3)
  • Qlik (3)
  • RedHat (1)
  • RUCKUS (1)
  • Salesforce (78)
  • SAP (180)
  • Scrum (10)
  • ServiceNow (12)
  • Shared Assessments (2)
  • Sitecore (2)
  • Snowflake (5)
  • Splunk (4)
  • Symantec (1)
  • Tableau (5)
  • The Open Group (2)
  • Tibco (1)
  • Trend (1)
  • Uncategorized (34)
  • Veeam (1)
  • VMware (15)
  • WGU (3)
  • Workday (1)
  • WorldatWork (1)
  • DMCA
  • Privacy Policy
  • Contact now

Copyright © 2026 Free certification exam prep.

Theme: Oceanly News by ScriptsTown