Certified Identity and Access Management Architect Exam 1

Question 1 of 60

CloudVista Solutions wants to implement a single sign-on solution leveraging Okta so that internal employees can use a single application for login. All the employees will log in to Okta and then will log in to Salesforce which will reside as a shortcut in the Okta application.

What role does Okta play in this scenario?

Okta is the service provider.
Okta is the identity provider.
Okta is the delegated identity provider.
Okta will delegate access to Salesforce.

Question 2 of 60

CloudVista Solutions has planned to implement a single sign-on solution with different applications, including their Salesforce org. The IT team wants to leverage Microsoft Azure for authentications. They require all users to log in to the Microsoft Azure portal one time and click a browser shortcut, which would then log the users automatically in Salesforce.

In the above scenario, what role does Salesforce play?

Salesforce is the service provider.
Salesforce is the identity provider.
Salesforce Identity provides authentication.
Salesforce can be the IdP and service provider.

Question 3 of 60

As a consumer, you recently set up an account with a bank, and you are trying to set up a bank account online. As part of the setup process, the bank is asking for your mobile phone number to send you a code. Once you enter the code, the bank web application lets you log in successfully.

What feature of identity management does your mobile phone provide as a service?

Mobile phone provides authorization for you to log in.
Mobile phone provides the code for login.
Mobile phone has a facetime feature to let user log in.
Mobile phone provides authentication as a service.

Question 4 of 60

A Salesforce Administrator created a connected app for a custom web application in Salesforce, which needs to be visible as a tile in App Launcher. The tile for the custom web application is missing in the App Launcher for all users in Salesforce. The Administrator has requested your assistance as the Identity Architect to resolve the issue.

Which reasons are the source of the issue? (Choose 2)

Auth scope does not include “openid”.
The connected app is not set as “Visible in App Launcher” in the app menu.
Session Policy is set as “High Assurance session required” for this connected app.
StartURL for the connected app is not set in connected app settings.

Question 5 of 60

What is an identity provider? (Choose 3)

An identity provider stores user credentials.
Identity providers reply with the user's credentials to authenticate users to the requesting system.
Identity providers offer user authorization as a service.
Identity providers determine what resources are available to users.
An identity provider is a trusted provider to enable single sign-on to other systems.

Question 6 of 60

You have been contacted by your CIO to configure single sign-on in your org.

As an admin, who is the issuer when you configure SAML single sign-on for your Salesforce org?

My Domain for the Salesforce org
The identity provider
Salesforce platform
The service provider

Question 7 of 60

When you configure SAML single sign-on setting in your Salesforce org, what is the entity ID?

The connected app endpoint
The service provider
Salesforce platform
The identity provider

Question 8 of 60

As a security architect, your CIO has tasked you to configure SSO settings in your Salesforce org using an external third-party provider.

When you configure a third-party identity provider as a single sign-on org, what are the key components you would start capturing? (Choose 4)

Secure domain for identity provider
Identity provider certificate
Connected app client and secret
Salesforce certificate
Secure My Domain for Salesforce org

Question 9 of 60

TRUE or FALSE: When configuring single sign-on, we can turn on SSO for individual users.

True
False

Question 10 of 60

CloudVista Solutions LDAP system stores user credentials as a numeric employee number. As a salesforce admin, you have been asked by your security team to leverage delegated authentication to the LDAP store as a preferred way for authenticating the users.

What additional steps are required for using delegated authentication? (Choose 2)

Extend the user database schema to include the Salesforce username as an attribute.
Update all users from numeric format to email format.
Raise a case to change the username requirements on the org.
Map your company usernames to Salesforce usernames.

Question 11 of 60

What is the maximum time for OpenID Connect tokens to be valid during a session?

120 minutes
720 minutes
60 minutes
1440 minutes

Question 12 of 60

CloudVista Solutions has multiple Salesforce orgs, which they acquired as part of an acquisition. The security team wants to leverage one of the orgs as an IdP and have the other Salesforce orgs as a service provider. There is a question raised to the security architect to recommend whether all the Salesforce instances need one common username for the employees.

TRUE or FALSE: They need a common username across all orgs.

True
False

Question 13 of 60

CloudVista Solutions wants to use Salesforce as their identity provider. They have a custom web application for managing benefits, which needs to leverage Salesforce for the login credentials. As a security architect, you have been tasked with setting up a connected app to configure the custom web app in your Salesforce Identity Provider org.

What are the valid subject type configuration options available to configure the connected app for the web application? (Choose 3)

Username
User ID
Federation ID
NameIdentifier

Question 14 of 60

CloudVista Solutions uses a legacy identity management system that can accept SAML requests for authenticating users.

What feature of Salesforce security would you recommend as a security architect?

Leverage Salesforce as an identity provider
Use social logins
Delegated authentication
Single sign-on with Salesforce

Question 15 of 60

CloudVista Solutions wants to leverage Identity Connect to synchronize their legacy Active Directory with Salesforce. As a security architect, you have been tasked by the CISO to come up with a best practice recommendation for synchronizing users between both systems.

What would be the best practice you would recommend to sync data between Active Directory and Salesforce for the first time? (Choose 2)

Run preliminary reconciliation report.
Resolve conflicts after first sync.
Review sync results.
Schedule live sync.

Question 16 of 60

TRUE or FALSE: Delegated authentication is the only solution to use when your external IdP supports SAML or OpenID Connect.

True
False

Question 17 of 60

Your IT team has decided to build a custom web service that will be used as an IdP for your Salesforce org to authenticate users. As a security architect, your IT team is asking for recommendations on the web service to be built as part of delegated authentication implementation in Salesforce.

What are the two best practices you would recommend your IT team to implement on their web service as part of delegated authentication implementation? (Choose 2)

Make your web service available by TLS.
Use the basic flow for passing credentials.
Pass an authentication token instead of the plain text password.
Use a dedicated integration user.

Question 18 of 60

When a user tries to reset their password, they receive the reset password email with the link. When they access the link, they view a message, “Passwords cannot be reset for single sign-on users.”

What is causing the issue? (Choose 2)

The user is set up with SAML SSO.
The user is set up with single sign-on.
The admin needs to reset the password on the org.
The password is managed on the company database.
The developer needs to use code to reset the password.

Question 19 of 60

TRUE or FALSE: Delegated authentication is a feature that allows direct use of LDAP for user authentication.

True
False

Question 20 of 60

What is TRUE about troubleshooting delegated authentication issues? (Choose 2)

User requires Modify All Data permissions.
Enable a custom report for delegated authentication logins to view successful and failed events.
21 most recent login errors are available on Delegated Authentication Error History.
The login history for the user does not include information for delegated authentication events.

Question 21 of 60

Your Salesforce org is configured to use an external IdP as the single sign-on provider. As a security architect, before implementing SSO, you notice SSO errors for some users.

What tool would you use to troubleshoot SSO issues?

Login History
Salsforce Optimizer
SAML Validator
Health Security Check

Question 22 of 60

Angus recently joined CloudVista Solutions as a Salesforce Admin. He has been getting complaints from users being unable to log in to Salesforce. The company recently implemented SSO using an external tool.

As the admin, what would you do first to validate user login issues?

Check with users on login issues.
Review login history and look for SAML errors on specific errors.
Have users log a Service Now ticket.
Send them links for training on how to login with Salesforce using SSO.

Question 23 of 60

What is TRUE about the hybrid app flows? (Choose 4)

Supports connected devices.
Access token response includes SID for the Session ID.
Supports user-agent flow.
Supports web server flow.
Supports refresh token flow.
Does not create a bridge between access token and web session.

Question 24 of 60

CloudVista Solutions has an external web application used by the sales team to track order information. The sales team also uses Salesforce to manage opportunities, contracts, products, and pricing. The CIO wants the web application to access product, pricing, and contract documents from Salesforce.

As a security architect, you have recommended the hybrid application approach leveraging hybrid user-agent token flow to access data from Salesforce. The CIO is concerned about security and wants to ensure there is a secure way to get session information to access resources on Salesforce.

What are three ways you would recommend to obtain session information to access Salesforce data and files? (Choose 3)

Implement the hybrid app token flow.
Select content scope.
Update cookies with details from content_domain and content_sid from the response.
Salesforce updates the cookies with the scope domain and SID.

Question 25 of 60

Which features of the hybrid app flow for web session management in Salesforce are TRUE? (Choose 4)

Uses implicit grant type.
Supports PKCE.
Bridges access token into a web session.
Requires web and refresh_token scopes.
Follows same flow as user-agent flow for desktop/mobile apps.
Uses hybrid_token for grant type.

Question 26 of 60

What is TRUE about JWT bearer flow for server-to-server integration? (Choose 4)

Does not require connected app.
Returns refresh token with proper scope assigned to connected app.
Uses jwt-bearer grant type.
Permitted users may be all users and admin approved users are pre-approved.
Requires digital signature.
Never returns refresh token regardless of scope.

Question 27 of 60

How are scopes defined for the JWT bearer flow for server-to-server integration in Salesforce? (Choose 2)

For admin approved users who are pre-authorized, scopes are derived from prior approvals.
If all users may self-authorize, scopes are derived from current approval.
If all users may self-authorize, scopes are derived from prior approvals.
For admin approved users who are pre-authorized, standard and custom scopes assigned to the connected app are returned.
If all users may self-authorize, standard and custom scopes assigned to the connected app are returned.

Question 28 of 60

What is TRUE about the JWT token in the JWT bearer flow for server-to-server integration login flow? (Choose 3)

Authorization server checks JWT against private key to verify request.
Client app signs JWT with public key.
Authorization server checks JWT against public key to verify request.
Client app signs JWT with private key.
Private key is from a X509 certificate.

Question 29 of 60

What is TRUE about the SAML bearer assertion flow? (Choose 4)

Client_secret is required.
Uses the token endpoint.
Requires a X509 certificate.
Uses the authorize endpoint.
Client_secret is optional on the request.
Requires a connected app.

Question 30 of 60

What is TRUE about username/password flow? (Choose 3)

Uses the authorize endpoint.
Revokes access token on Manage Current OAuth Connected App Sessions.
Allows generation of refresh token.
High degree of trust between client and resource owner.
Directly obtains access token.
Grant type is password.

Question 31 of 60

As a security architect, you come across username and password flows used in your client’s Salesforce instance for integration with external applications. The CISO is concerned about security for the username and password flow and wants to replace the flow with a secure solution.

Please select the best alternate option that you would recommend to replace this flow.

Web server flow with PKCE
OpenID Connect dynamic client registration flow
Client credentials flow for server-to-server integration
User-agent flow for external apps

Question 32 of 60

Abc Manufacturer has several applications which use mobile, Internet of Things (IoT), web applications, and integrations done using API. The CISO is concerned with the type of security authentication and wants to identify all scenarios that leverage an OAuth flow.

Please choose the options you would recommend to use the OAuth flow. (Choose 3)

End user logging into a web application
User logging in to a mobile app with Salesforce
API server logging in to another application
Two machines interacting with IoT device
Web application trying to make an API call to another application

Question 33 of 60

What are the components of Identity Connect? (Choose 3)

LDAP
Active Directory
Named credential
On-premise server
CA-signed certificate
Managed package

Question 34 of 60

As a security architect, what are the best practices for implementing Identity Connect? (Choose 3)

Schedule live and daily schedule sync in production.
Schedule sync only in production.
Resolve reconciliation report before the first sync.
Have a dedicated integration user.
Schedule live sync only in production.

Question 35 of 60

What is TRUE about Identity Connect? (Choose 3)

Supports SAML SSO integration.
It is a paid add-on feature.
Supports permission set licenses.
Requires My Domain.
Supports SAML OpenID Connect.

Question 36 of 60

CloudVista Solutions has Active Directory as an IdP and wants to implement SSO with their Salesforce org. The CISO has directed that the users will be set up in Active Directory first, and Salesforce will act as a service provider.

What feature of Salesforce will you recommend for the following scenario?

Implement My Domain.
Purchase Security Shield and implement it.
Purchase Salesforce Identity Connect and implement it.
Implement SSO in Salesforce and have Active Directory users synced with Salesforce.

Question 37 of 60

TRUE or FALSE: Identity Connect requires an on-premise application to be installed on the client network to sync with Active Directory.

True
False

Question 38 of 60

CloudVista Solutions wants to leverage Salesforce as a single sign-on solution for the enterprise. The security architect has recommended using Salesforce as an IdP and wants to use Salesforce as an IdP only.

What license type would you recommend the organization purchase from Salesforce to fulfill this requirement?

Identity Connect
Delegated Authentication
Identity Only license
External Identity license

Question 39 of 60

CloudVista Solutions is using a customer community for external customers to log in to Salesforce and perform business functions. From a security perspective, Salesforce is used as an IdP for internal and external users to log in. There is a need for a new set of external users who need to leverage Salesforce as an IdP and log in and access the organization’s business functions.

What license type would you recommend?

Identity Only license
Mobile license
External Identity license
Identity Connect

Question 40 of 60

CloudVista Solutions has a Salesforce org that has many person accounts, as most of the customers tend to be individual customers with no organization information. As part of their expansion into the B2B line of business, they are looking to implement a partner portal that will provide access to business contacts and organizations.

TRUE or FALSE: The current person account data model can be leveraged for partners.

True
False

Question 41 of 60

Where are social sign-on options enabled for communities?

My Domain > Authentication Configuration
Sites Builder > Login & Registration
Domains > Login & Registration
Auth Providers > Experience Cloud Sites
Sites Administration > Login & Registration

Question 42 of 60

CloudVista Solutions has a Salesforce org where they use person accounts. They are planning to implement a new Experience Cloud community where they want to create person accounts for external community users as part of the self-registration process. As a Salesforce Admin, you have been asked to identify if there is an out-of-the-box option to create person accounts automatically.

Where would you configure the option to create person accounts on the self-registration page?

Enter the record type of the person account as the account name on the self-registration page.
Check the Create Person Account checkbox on the user registration page.
Customize it as part of the autogenerated registration handler.
Leave Account field blank.

Question 43 of 60

TRUE or FALSE: If a social sign-on is not listed as an Auth provider, it cannot be used on an Experience site.

True
False

Question 44 of 60

CloudVista Solutions has multiple communities leveraging Experience Cloud for customers and partners. The business wants to have customers leverage their Facebook and Twitter (X) login information and use social sign-on to log in to the Salesforce community.

As a security architect, you have recommended leveraging the Auth providers feature to implement the social sign-on for Facebook and Twitter (X). Your CISO wants to know whether you have to implement the Auth providers feature for each community portal in your Salesforce org.

Is this TRUE or FALSE?

True
False

Question 45 of 60

CloudVista Solutions has recently decided to use Salesforce as the identity management solution for all of its external applications.

The CISO is exploring the options for additional verification for users using their mobile licenses. As a security architect, you were tasked to identify how to use the identity verification credit codes add-on feature.

What will you recommend to CISO on where the mobile verification add-on license is to be used?

Used when a user resets their password on a community site.
Used before the user is created to verify their identity via SMS.
Used before the user is created to verify their identity via email.
Used when a user accesses a community from a new device.

Question 46 of 60

CloudVista Solutions has recently implemented a Salesforce community to allow external users to use Salesforce and access certain business functions. The CIO has been tasked with allowing a secure way of authenticating users and providing a list of verification methods.

As a Salesforce Admin, what would be your answer to the verification methods that are available for authenticating a self-registered user? (Choose 2)

Email
Social media
SMS
No verification

Question 47 of 60

A junior Salesforce Admin who joined the company is looking to modify out-of-the-box standard profiles instead of cloning them to fit the needs of your organization for a newly built Salesforce Experience Cloud implementation.

As a Salesforce Solution Architect, what is the primary reason you would advise the junior Salesforce Admin not to modify out-of-the-box standard profiles?

Out-of-the-box Salesforce profiles cannot be modified.
It is easy to clone an out-of-the-box standard profile.
Out-of-the-box standard profiles are read-only and cannot be cloned.
Salesforce sometimes modifies out-of-the-box profiles during its releases – this would result in additional testing and might cause issues if not tested properly.

Question 48 of 60

What social sign-on providers are available with out-of-the-box integration with Salesforce for external users to log in to your Salesforce community? (Choose 3)

LinkedIn
Amazon
Facebook
Yahoo
PayPal
Google

Question 49 of 60

Cloud University is planning to implement a student portal to support existing students. The CIO is concerned about duplicate management since students often use multiple email addresses.

As a Salesforce Architect, what out-of-the-box de-duping capabilities in Salesforce will allow users self-registering to use existing contacts by matching the email address to existing users?

Matching based on email to a contact associated with the selected account is enabled automatically.
Update the autogenerated registration handler to find contacts by email address.
This feature is not available in Experience Cloud.

Question 50 of 60

As a Salesforce Admin, you have been asked by the business team to identify external user registrations on your community portal. The community portal leverages out-of-the-box community user registration.

What objects in Salesforce will you check to identify if the external community users are created successfully? (Choose 3)

User
Role
Contact
Account
Profile

Question 51 of 60

What information is displayed by the Salesforce Authenticator app when a request is sent for approval? (Choose 4)

Last four characters of password provided
Service
Device
IP of request
Location
Username

Question 52 of 60

CloudVista Solutions is planning to implement MFA on their Salesforce instance. The CISO has tasked you as a Security Architect to come up with different recommendations for implementing MFA in your Salesforce org.

What are the different ways you would recommend to your CISO to implement multi-factor authentication with your Salesforce instance? (Choose 4)

Set the session settings to MFA for High Assurance and have session security level policies for specific features access, like reports and dashboards, and certificates raise session to high assurance.
Use Salesforce MFA for SSO.
Enable org settings for MFA for API access.
Enable on profile to require high-assurance security level.
Use Apex to create your own MFA process.
Use your SSO identity provider MFA service.

Question 53 of 60

Your org has enabled SSO with an external provider that offers MFA. Users are challenged by both the IdP provider and Salesforce, which requests MFA.

How do you fix this issue so that only IdP MFA is enforced?

Enable "Let users authenticate with SF Authenticator" on Identity Verification settings.
Enable "Waive MFA for SSO Users" on Identity Verification settings.
Enable "Waive MFA for Exempt Users" on the SAML Single Sign-On settings.
Ensure security session level for SSO is set to high-assurance session.

Question 54 of 60

TRUE or FALSE: Email is a valid form for multi-factor authentication by Salesforce.

True
False

Question 55 of 60

What options are available to implement MFA with Apex? (Choose 3)

Method to complete verification.
TOTP (time-based one-time password) can be used with one standalone method.
Apex does not allow U2F-compatible security key.
Apex allows SMS, and SF Authenticator as stand alone methods.
Method to initiate verification.

Question 56 of 60

The CISO of your organization is concerned with Salesforce users bypassing SSO when using apps like Data Loader.

As a security architect, what solution would you suggest that will enforce MFA for users accessing tools such as Data Loader and connected apps?

Assign the user the Manage Multi-Factor Authentication in API permission.
Set "API Logins" to "Raise session to high assurance".
Enable "Require MFA for all API logins to your Salesforce org" on Identity Verification.
Assign the user the Multi-Factor Authentication for API Logins permission.

Question 57 of 60

A group of users try to access one of CloudVista Solutions’ connected apps and receive the error message, “Failed: Not approved for access.”.

What is the most likely cause of this issue?

The “All users may self-authorize” setting for the connected app is enabled.
High-assurance sessions are required for the connected app.
The users do not have the correct permission set assigned to them.
The Salesforce Administrators have revoked the OAuth authorization.

Question 58 of 60

CloudVista Solutions has a mobile application that it wants to deploy to all of its Salesforce users, including customer community users. CloudVista Solutions would like to minimize the administration overhead.

Which two items should an architect recommend? (Choose 2)

Enable the “Refresh Tokens is valid until revoked” setting in the connected app.
Enable the “All users may self-authorize” setting in the connected app.
Enable the “Enforce IP restrictions” settings in the connected app.
Enable the “High Assurance session required” setting in the connected app.

Question 59 of 60

CloudVista Solutions has decided to use Salesforce as an identity provider (IdP) for multiple external applications. CloudVista Solutions wants to use the Salesforce App Launcher to control the applications that are available to individual users.

Which steps are required to make this happen? (Choose 3)

Add each connected app to the App Launcher with a start URL.
Set up an Auth provider for each external application.
Set up Salesforce as a SAML IdP with My Domain.
Set up Identity Connect to synchronize user data.
Create a connected app for each external application.

Question 60 of 60

CloudVista Solutions has been through an audit and has been asked to identify extraneous user activity in their Salesforce instance. The compliance team has asked the Salesforce team to report on login activity and report on issues.

What tool would you recommend as a security architect?

Connected App
Debug Log
Field History Tracking
Login History

Average score
Your score

Certified Identity and Access Management Architect Exam 1

Certified Identity and Access Management Architect Exam 1

Buyan Thyagarajan

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question

21. Question

22. Question

23. Question

24. Question

25. Question

26. Question

27. Question

28. Question

29. Question

30. Question

31. Question

32. Question

33. Question

34. Question

35. Question

36. Question

37. Question

38. Question

39. Question

40. Question

41. Question

42. Question

43. Question

44. Question

45. Question

46. Question

47. Question

48. Question

49. Question

50. Question

51. Question

52. Question

53. Question

54. Question

55. Question

56. Question

57. Question

58. Question

59. Question

60. Question