Question 1

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in

the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application

support teams to finish user deactivations. A terminated employee recently was able to login to NTO's

Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP

directory.

What should an identity architect recommend to prevent this from happening in the future?

Options :

A : Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

B : Configure an authentication provider to delegate authentication to the LDAP directory.

C : use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

D : Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Answer: B

Question 2

Universal containers (UC) is building a mobile application that will make calls to the salesforce REST API.

Additionally UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes

should UC configure in the connected App? Choose 2 answers

Options :

A :

Refresh token

B : API

C : full

D : Web

Answer: A,B

Question 3

Identity-and-Access-Management-Architect-page101-image4

An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication

and user management, which must be utilized by all applications as follows:

1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioining in the

integrated cloud applications.

2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users

authenticated at identity provider (Central IAM Service).

Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

Options :

A :

A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-Domain

Identity Management) for provisioning and deprovisioning of users.

B :

Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning and

deprovisioning of users

C :

Configure central IAM Service as an authentication provider and extend registration handler to manage

provisioning and deprovisioning of users.

D :

Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as

well as SAML-based SSO.

Answer: A

Question 4

An Identity architect works for a multinational, multi-brand organization. As they work with the organization

to understand their Customer Identity and Access Management requirements, the identity architect learns that

the brand experience is different for each of the customer's sub-brands and each of these branded experiences

must be carried through the login experience depending on which sub-brand the user is logging into.

Which solution should the architect recommend to support scalability and reduce maintenance costs, if the

organization has more than 150 sub-brands?

Options :

A : Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.

B : Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuth and Security Assertion Markup Language (SAML) flows.

C : Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.

D :

Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the

user experience.

Answer: A

Question 5

Universal Containers (UC) has an existing e-commerce platform and is implementing a new customer community. They do not want to force customers to register on both applications due to concern over the customers experience. It is expected that 25% of the e-commerce customers will utilize the customer community . The e-commerce platform is capable of generating SAML responses and has an existing REST-ful API capable of managing users. How should UC create the identities of its e-commerce users with the customer community?

Options :

A : Use SAML JIT in the Customer Community to create users when a user tries to login to the community from the e-commerce site.

B : Use the e-commerce REST API to create users when a user self-register on the customer community and use SAML to allow SSO.

C : Use a nightly batch ETL job to sync users between the Customer Community and the e-commerce platform and use SAML to allow SSO.

D : Use the standard Salesforce API to create users in the Community When a User is Created in the e-Commerce platform and use SAML to allow SSO.

Answer: A

Confidently Practice Online with Free Identity-and-Access-Management-Architect Exam Cram

Buying Options: