Question 1

Universal Containers is creating a mobile application that will be secured by Salesforce Identity using theOAuth 2.0 user-agent flow. Application users will authenticate using username and password. They should notbe forced to approve API access in the mobile app or reauthenticate for 3 months.Which two connected app options need to be configured to fulfill this use case?Choose 2 answers

Options :

A : Set Permitted Users to "Admin approved users are pre-authorized".

B : Set Permitted Users to "All users may self-authorize".

C : Set the Session Timeout value to 3 months.

D : Set the Refresh Token Policy to expire refresh token after 3 months.

Answer: B,D

Question 2

Universal Containers (UC) has built a custom token-based Two-factor authentication (2FA) system for their existing on-premise applications. They are now implementing Salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution as Architect should consider?

Options :

A : Use the custom 2FA system for on-premise applications and native 2FA for Salesforce.

B : Replace the custom 2FA system with an AppExchange App that supports on premise application and salesforce.

C : Use Custom Login Flows to connect to the existing custom 2FA system for use in Salesforce.

D : Replace the custom 2FA system with Salesforce 2FA for on-premise applications and Salesforce.

Answer: D

Question 3

Universal Containers (UC) is implementing Salesforce and would like to establish SAML SSO for its users tolog in. UC stores its corporate user identities in a Custom Database. The UC IT Manager has heard goodthings about Salesforce Identity Connect as an Idp, and would like to understand what limitations they mayface if they decided to use Identity Connect in their current environment. What limitation Should an Architectinform the IT Manager about?

Options :

A : Identity Connect will not support user provisioning in UC-s current environment.

B : Identity Connect will only support Idp-initiated SAML flows in UC-s current environment.

C : Identity Connect will only support SP-initiated SAML flows in UC-s current environment.

D : Identity connect is not compatible with UC-s current identity environment.

Answer: A

Question 4

A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect(OIDC).When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC orSAML?

Options :

A : OIDC is more secure than SAML and therefore is the obvious choice.

B : The SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider.

C : If the user has a session on Salesforce, you do not want them to be prompted for a username and password when they login to the SP.

D : They are equivalent protocols and there is no real reason to choose one over the other.

Answer: B

Question 5

Identity-and-Access-Management-Architect-page101-image4 An organization has a central cloud-based Identity and Access Management (IAM) Service for authenticationand user management, which must be utilized by all applications as follows:1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioining in theintegrated cloud applications.2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for usersauthenticated at identity provider (Central IAM Service).Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

Options :

A : A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-DomainIdentity Management) for provisioning and deprovisioning of users.

B : Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning anddeprovisioning of users

C : Configure central IAM Service as an authentication provider and extend registration handler to manageprovisioning and deprovisioning of users.

D : Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, aswell as SAML-based SSO.

Answer: A

Confidently Practice Online with Free Plat-Arch-203 Exam Cram

Buying Options: