Identity-and-Access-Management-Designer by Salesforce Valid Free Exam Practice Test

Question 1

Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HANA.
UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs.
Which two Salesforce license types does UC need for its employees'
Choose 2 answers

A. Company Community and Identity licenses B. Salesforce and Identity Connect licenses C. Chatter Only and Identity licenses D. Identity and Identity Connect licenses

Correct Answer: B,D

Question 2

Universal containers (UC) would like to enable SAML-BASED SSO for a salesforce partner community. UC has an existing ldap identity store and a third-party portal. They would like to use the existing portal as the primary site these users access, but also want to allow seamless access to the partner community. What SSO flow should an architect recommend?

A. User-Agent B. IDP-initiated C. Sp-Initiated D. Web server

Correct Answer: B

Question 3

Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times and who logged in during non-business hours?

A. Login History B. Login Inspector C. Login Report D. Login Forensics

Correct Answer: D

Question 4

Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?

A. Use Delegated Authentication with callouts to a third-party fingerprint scanning application. B. Use an appexchange product that does fingerprint scanning with native salesforce identity confirmation. C. Use custom login flows with callouts to a third-party fingerprint scanning application. D. Use salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.

Correct Answer: C

Question 5

Northern Trail Outfitters (NTO) wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, NTO establishes a single customer view including their buying behaviors, channel preferences and purchasing history. All of this information exists but is spread across different systems and formats.
NTO has decided to use Salesforce as the platform to build a 360 degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets.
What should an Identity Architect do to provision, deprovision and authenticate users?

A. Salesforce Identity can be included but NTO will be required to build a custom integration with Microsoft AD. B. Salesforce Identity is not needed since NTO uses Microsoft AD. C. A Salesforce Identity can be included but NTO will require Identity Connect. D. Salesforce Identity is included in the Salesforce licenses so it does not need to be considered separately.

Correct Answer: C

Question 6

Universal containers (UC) employees have salesforce access from restricted ip ranges only, to protect against unauthorised access. UC wants to rollout the salesforce1 mobile app and make it accessible from any location. Which two options should an architect recommend? Choose 2 answers

A. Relax the ip restriction in the connect app settings for the salesforce1 mobile app B. Remove existing restrictions on ip ranges for all types of user access. C. Use login flow to bypass ip range restriction for the mobile app. D. Relax the ip restriction with a second factor in the connect app settings for salesforce1 mobile app

Correct Answer: A,C

Question 7

Universal containers wants to set up SSO for a selected group of users to access external applications from salesforce through App launcher. Which three steps must be completed in salesforce to accomplish the goal?

A. Complete my domain and Identity provider setup. B. Create named credentials for each external system. C. Create connected apps for the external applications. D. Associate user profiles with the connected Apps. E. Complete single Sign-on settings in security controls.

Correct Answer: A,C,D

Question 8

Universal containers (UC) wants to implement a partner community. As part of their implementation, UC would like to modify both the Forgot password and change password experience with custom branding for their partner community users. Which 2 actions should an architect recommend to UC? Choose 2 answers

A. Build a custom visualforce page for the change password experience and a community builder page for the Forgot password experience. B. Build a community builder page for the change password experience and Custom Visualforce page for the Forgot password experience. C. Build a custom visualforce page for both the change password and Forgot password experiences. D. Build a community builder page for both the change password and Forgot password experiences.

Correct Answer: A,C

Question 9

Universal containers (UC) would like to enable self - registration for their salesforce partner community users. UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate profile and account values. Which two actions should the architect recommend to UC? Choose 2 answers

A. Configure registration for communities to use a custom visualforce page. B. Modify the communitiesselfregcontroller to assign the profile and account. C. Modify the selfregistration trigger to assign profile and account. D. Configure registration for communities to use a custom apex controller.

Correct Answer: A,B

Question 10

Universal Containers (UC) has a classified information system that its call center team uses only when they are working on a case with a record type "Classified". They are only allowed to access the system when they own an open "Classified" case, and their access to the system is removed at all other times. They would like to implement SAML SSO eith Salesforce as the Idp, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "Classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying the access to the classified information system based on the open "classified" case record criteria?

A. Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases. B. Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system. C. Use Salesforce reports to identify users that currently owns open "Classified" cases and should be granted access to the Classified information system. D. Use Apex trigger on case to dynamically assign permission Sets that Grant access when an user is assigned with an open "Classified" case, and remove it when the case is closed.

Correct Answer: A

Question 11

An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenano?

A. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately. B. If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion. C. Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box. D. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.

Correct Answer: A

Question 12

Universal Containers (UC) has an existing web application that it would like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?

A. Add the web application as a ConnectedApp using OAuth User-Agent flow. B. Create a Canvas app and use Signed Requests to authenticate the users. C. Rewrite the web application as a set of Visualforce pages and Apex code. D. Configure the web application as an item in the Salesforce App Launcher.

Correct Answer: B

Question 13

A global company has built an external application that uses data from its Salesforce org via an OAuth 2.0 authorization flow. Upon logout, the existing Salesforce OAuth token must be invalidated.
Which action will accomplish this?

A. Use a HTTP POST to request the refresh token for the current user. B. Use a HTTP POST to the System for Cross-domain Identity Management (SCIM) endpoint, including the current OAuth token. C. Use a HTTP POST to make a call to the revoke token endpoint. D. Enable Single Logout with a secure logout URL.

Correct Answer: C

Question 14

Which two capabilities does My Domain enable in the context of a SAML SSO configuration? Choose 2 answers

A. Resource deep linking B. SSO from Salesforce Mobile App C. Login Forensics D. App Launcher

Correct Answer: A,B

Question 15

Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless expenence. The third-party employee portal only supports OAuth.
What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

A. Create a custom external authentication provider. B. Add the third-party portal as a connected app. C. Configure SSO to use the third party portal as an identity provider. D. Configure Salesforce for Delegated Authentication.

Correct Answer: C

Salesforce Certified Identity and Access Management Designer - Identity-and-Access-Management-Designer Exam Practice Test