[Jan 06, 2024] Valid Identity-and-Access-Management-Designer Test Answers & Identity-and-Access-Management-Designer Exam PDF [Q13-Q37]

Rate this post

[Jan 06, 2024] Valid Identity-and-Access-Management-Designer Test Answers & Identity-and-Access-Management-Designer Exam PDF

Valid Salesforce Identity and Access Management Designer Identity-and-Access-Management-Designer Dumps Ensure Your Passing

How much Identity-and-Access-Management-Designer Exam Cost

The price of the Salesforce Identity-and-Access-Management-Designer exam is $400 USD.

Salesforce is a customer relationship management (CRM) software that is widely used by businesses to manage their customer interactions, sales, and marketing processes. Salesforce offers a range of certifications for professionals who work with the software, one of which is the Salesforce Identity-and-Access-Management-Designer Certification Exam.

Salesforce Identity-and-Access-Management-Designer certification exam covers a wide range of topics related to identity and access management. Some of the key topics covered in the exam include Salesforce Identity and Access Management Architecture, Single Sign-On (SSO), Multi-Factor Authentication (MFA), User Provisioning, Access Control, and Auditing and Reporting. Individuals who pass this certification exam are expected to have a deep understanding of these topics and be able to apply them to real-world scenarios.

Q13. A global company’s Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) ‘Replay Detected and Assertion Invalid’ login errors.
Which two issues would cause these errors?
Choose 2 answers

The subject element is missing from the assertion sent to salesforce.

The certificate loaded into SSO configuration does not match the certificate used by the IdP.

The current time setting of the company’s identity provider (IdP) and Salesforce platform is out of sync by more than eight minutes.

The assertion sent to 5alesforce contains an assertion ID previously used.

Q14. Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose. Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication?
Choose 2 answers

Salesforce license for sales users and Identity license for Marketing users

Salesforce license for sales users and External Identity license for Marketing users

Identity license for sales users and Identity connect license for Marketing users

Salesforce license for sales users and platform license for Marketing users.

Q15. Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers

Resource deep linking

App launcher

SSO from salesforce1 mobile app.

Q16. When designing a multi-branded Customer Identity and Access Management solution on the Salesforce Platform, how should an identity architect ensure a specific brand experience in Salesforce is presented?

The Experience ID, which can be included in OAuth/Open ID flows and Security Assertion Markup Language (SAML) flows as a URL parameter.

Provide a brand picker that the end user can use to select its sub-brand when they arrive on salesforce.

Add a custom parameter to the service provider’s OAuth/SAML call and implement logic on its login page to apply branding based on the parameters value.

The Audience ID, which can be set in a shared cookie.

Q17. The CIO of Universal Containers (UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize OAuth 2.0. UC has enlisted an Architect to analyze all of the applications that use OAuth flows to see where refresh tokens can be applied.
Which two OAuth flows should the Architect consider in their evaluation? (Choose two.)

JWT Bearer Token

Web Server

Username-Password

User-Agent

Q18. Universal Containers (UC) is looking to purchase a third-party application as an Identity Provider. UC is looking to develop a business case for the purchase in general and has enlisted an Architect for advice. Which two capabilities of an Identity Provider should the Architect detail to help strengthen the business case? Choose 2 answers

The Identity Provider can authenticate multiple applications.

The Identity Provider can authenticate multiple social media accounts.

The Identity provider can store credentials for multiple applications.

The Identity Provider can centralize enterprise password policy.

Q19. IT security at Unversal Containers (UC) us concerned about recent phishing scams targeting its users and wants to add additional layers of login protection. What should an Architect recommend to address the issue?

Use the Salesforce Authenticator mobile app with two-step verification

Lock sessions to the IP address from which they originated.

Increase Password complexity requirements in Salesforce.

Implement Single Sign-on using a corporate Identity store.

Q20. How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when NOT connected to an internal company network?

Apply the “Two-factor Authentication for User Interface Logins” permission and Login IP Ranges for all Profiles.

Add the company’s list of network IP addresses to the Login Range list under 2FA Setup.

Use Custom Login Flows with Apex to detect the user’s IP address and prompt for 2FA if needed.

Use an Apex Trigger on the UserLogin object to detect the user’s IP address and prompt for 2FA if needed.

Q21. Refer to the exhibit.

Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user’s brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?

For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.

Q22. The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.
What should be used and considered before recommending it as a solution on the Salesforce Platform?

OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.

Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.

Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.

Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.

Q23. architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct. Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers

The Identity Provider is also used to SSO into five other applications.

The clock on the Identity Provider server is twenty minutes behind Salesforce.

The Issuer Certificate from the Identity Provider expired two weeks ago.

The default language for the Identity Provider and Salesforce are Different.

Q24. An identity architect has been asked to recommend a solution that allows administrators to configure personalized alert messages to users before they land on the Experience Cloud site (formerly known as Community) homepage.
What is recommended to fulfill this requirement with the least amount of customization?

Customize the registration handler Apex class to create a routing logic navigating to different home pages based on the user profile.

Use Login Flows to add a screen that shows personalized alerts.

Build a Lightning web Component (LWC) for a homepage that shows custom alerts.

Create custom metadata that stores user alerts and use a LWC to display alerts.

Q25. A university is planning to set up an identity solution for its alumni. A third-party identity provider will be used for single sign-on Salesforce will be the system of records. Users are getting error messages when logging in.
Which Salesforce feature should be used to debug the issue?

Apex Exception Email

View Setup Audit Trail

Debug Logs

Q26. Universal Containers wants to implement Single Sign-on for a Salesforce org using an external Identity Provider and corporate identity store.
What type of authentication flow is required to support deep linking’

Web Server OAuth SSO flow

Service-Provider-Initiated SSO

Identity-Provider-initiated SSO

StartURL on Identity Provider

Q27. Universal Containers (UC) wants to implement SAML SSO for their internal of Salesforce users using a third-party IdP. After some evaluation, UC decides NOT to 65 set up My Domain for their Salesforce org. How does that decision impact their SSO implementation?

IdP-initiated SSO will NOT work.

Neither SP- nor IdP-initiated SSO will work.

Either SP- or IdP-initiated SSO will work.

SP-initiated SSO will NOT work

Q28. Universal Containers (UC) wants to integrate a third-party Reward Calculation system with Salesforce to calculate Rewards. Rewards will be calculated on a schedule basis and update back into Salesforce. The integration between Salesforce and the Reward Calculation System needs to be secure. Which are two recommended practices for using OAuth flow in this scenario. choose 2 answers

OAuth Refresh Token FLow

OAuth Username-Password Flow

OAuth SAML Bearer Assertion FLow

OAuth JWT Bearer Token FLow

Q29. Northern Trail Outfitters (NTO) uses Salesforce Experience Cloud sites (previously known as Customer Community) to provide a digital portal where customers can login using their Google account.
NTO would like to automatically create a case record for first time users logging into Salesforce Experience Cloud.
What should an Identity architect do to fulfill the requirement?

Configure an authentication provider for Social Login using Google and a custom registration handler.

Implement a Just-in-Time handler class that has logic to create cases upon first login.

Create an authentication provider for Social Login using Google and leverage standard registration handler.

Implement a login flow with a record create component for Case.

Q30. Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Amazon credentials.
What should an identity architect recommend to meet these requirements?

Configure a predefined authentication provider for Amazon.

Create a custom external authentication provider for Amazon.

Configure an OpenID Connect Authentication Provider for Amazon.

Configure Amazon as a connected app.

Q31. Universal containers (UC) has implemented ansp-Initiated SAML flow between an external IDP and salesforce. A user at UC is attempting to login to salesforce1 for the first time and is being prompted for salesforce credentials instead of being shown the IDP login page. What is the likely cause of the issue?

The “Redirect to Identity Provider” option has been selected in the my domain configuration.

The user has not configured the salesforce1 mobile app to use my domain for login

The “Redirect to identity provider” option has not been selected the SAML configuration.

The user has notbeen granted the “Enable single Sign-on” permission

Q32. Universal containers (UC) would like to enable SSO between their existing Active Directory infrastructure and salesforce. The it team prefers to manage all users in Active Directory and would like to avoid doing any initial setup of users in salesforce directly, including the correct assignment of profiles, roles and groups. Which two optimal solutions should UC use to provision users in salesforce? Choose 2 answers

Use the salesforce REST API to sync users from active directory to salesforce

Use an app exchange product to sync users from Active Directory to salesforce.

Use Active Directory Federation Services to sync users from active directory to salesforce.

Use Identity connect to sync users from Active Directory to salesforce

Q33. Universal Containers (UC) is building an authenticated Customer Community for its customers. UC does not want customer credentials stored in Salesforce and is confident its customers would be willing to use their social media credentials to authenticate to the community. Which two actions should an Architect recommend UC to take?

Use Delegated Authentication to call the Twitter login API to authenticate users.

Configure an Authentication Provider for LinkedIn Social Media Accounts.

Create a Custom Apex Registration Handler to handle new and existing users.

Configure SSO Settings For Facebook to serve as a SAML Identity Provider.

Q34. Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an external identity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce.
What should a identity architect recommend to create partners?

On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.

Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.

Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.

Allow partners to register through the IdP and create partner users in Salesforce through an API.

Q35. Universal Containers (UC) is planning to add Wi-Fi enabled GPS tracking devices to its shipping containers so that the GPS coordinates data can be sent from the tracking device to its Salesforce production org via a custom API. The GPS devices have no direct user input or output capabilities.
Which OAuth flow should the identity architect recommend to meet the requirement?

OAuth 2.0 Asset Token Flow for Securing Connected Devices

OAuth 2.0 Username-Password Flow for Special Scenarios

OAuth 2.0 Web Server Flow for Web App Integration

OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration

Q36. Northern Trail Outfitters (NTO) uses Salesforce for Sales Opportunity Management. Okta was recently brought in to Just-in-Time (JIT) provision and authenticate NTO users to applications. Salesforce users also use Okta to authorize a Forecasting web application to access Salesforce records on their behalf.
Which two roles are being performed by Salesforce?
Choose 2 answers

SAML Identity Provider

OAuth Client

OAuth Resource Server

SAML Service Provider

Q37. Universal Containers has implemented a multi-org strategy and would like to centralize the management of their Salesforce user profiles.
What should the Architect recommend to allow Salesforce profiles to be managed from a central system of record?

Implement JIT provisioning on the SAML IdP that will pass the ProfileID in each assertion.

Implement Delegated Authentication that will update the user profiles as necessary.

Create an Apex scheduled job in one org that will synchronize the other org’s profiles.

Implement an OAuth JWT flow to pass the profile credentials between systems.

Identity-and-Access-Management-Designer Dumps Real Exam Questions Test Engine Dumps Training: https://www.examdumpsvce.com/Identity-and-Access-Management-Designer-valid-exam-dumps.html

Exam Dumps VCE

[Jan 06, 2024] Valid Identity-and-Access-Management-Designer Test Answers & Identity-and-Access-Management-Designer Exam PDF [Q13-Q37]

How much Identity-and-Access-Management-Designer Exam Cost

Leave a Reply Cancel reply