Certified Identity and Access Management Architect Exam 2

Question 1 of 60

CloudVista Solutions recently acquired a company. Each company will retain its Identity Provider (IdP). Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.

How should the combined company’s employees collaborate in a single Salesforce org yet authenticate to the appropriate IdP?

Configure unique MyDomains for each company and have generated links use the appropriate MyDomain in the URL.
Have generated links append a querystring parameter indicating the IdP. The login service will redirect to the appropriate IdP.
Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.
Have generated links be prefixed with the appropriate IdP URL to invoke an Idp-initiated Security Assertion Markup Language flow when clicked.

Question 2 of 60

CloudVista Solutions uses Salesforce for sales opportunity management. Okta was recently brought in to Just-in-Time (JIT) provision and authenticate CloudVista users to applications. Salesforce users also use Okta to authorize a forecasting web application to access Salesforce records on their behalf.

Which two roles are being performed by Salesforce? (Choose 2)

SAML identity provider
SAML service provider
OAuth resource server
OAuth client

Question 3 of 60

A company with 15,000 employees is using Salesforce and would like to take the necessary steps to highlight or curb fraudulent activity.

Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times, and who logged in during non-business hours?

Login Report
Login Forensics
Login History
Login Inspector

Question 4 of 60

CloudVista Solutions would like its customers to register and log in to a portal built on Salesforce Experience Cloud. Customers should be able to use their Facebook or LinkedIn credentials for ease of use.

Which three steps should an identity architect take to implement social sign-on? (Choose 3)

Register both Facebook and LinkedIn as connected apps.
Update the default registration handlers to create and update users.
Check "Facebook” and “LinkedIn” under Login Page Setup.
Create authentication providers for both Facebook and LinkedIn.
Enable “Federated Single Sign-On Using SAML”.

Question 5 of 60

An identity architect’s client has a homegrown identity provider (IdP). Salesforce is used as the service provider (SP). The head of IT is worried that during an SP-initiated single-sign-on (SSO), the Security Assertion Markup Language (SAML) request content will be altered.

What should the identity architect recommend to make sure that there is additional trust between the SP and the IdP?

Ensure that the issuer and assertion consumer service (ACS) URL is properly configured between SP and IdP.
Ensure that on the SSO settings page, the Request Signing Certificate field has a self-signed certificate.
Ensure that there is an HTTPS connection between IdP and SP.
Encrypt the SAML request using certification authority (CA) signed certificate and decrypt on IdP.

Question 6 of 60

A financial services company uses Salesforce and has a compliance requirement to track information about devices from which users log in. Also, a Salesforce Security Administrator needs to have the ability to revoke the device from which users log in.

What should be used to fulfill this requirement?

Register both Facebook and LinkedIn as connected apps.
Use login flows to capture device from which users log in and store device and user information in a custom object.
Use multi-factor authentication (MFA) to meet the compliance requirement to track device information.
Use the Login History object to track information about devices from which users log in.
Use Activations feature.

Question 7 of 60

A government agency is setting up an identity solution for its citizens using a community built on Experience Cloud and requires the new user registration functionality to capture first name, last name, and phone number. The phone number will be used for identity verification.

Which feature should an identity architect recommend to meet the requirements?

Create a custom Lightning Web Component.
Use Login Discovery.
Use an external identity provider.
Integrate with social websites (Facebook, LinkedIn, Twitter).

Question 8 of 60

CloudVista Solutions recently purchased Salesforce Identity Connect to streamline user provisioning across Microsoft Active Directory (AD) and Salesforce Sales Cloud. CloudVista Solutions has asked an identity architect to identify which Salesforce security configurations can map to AD permissions.

Which Salesforce permissions are available to map to AD permissions? (Choose 3)

Sharing rules
Profiles and permission sets
Field-level security
Public groups
Roles

Question 9 of 60

CloudVista Solutions wants users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN.

Which two options should an identity architect recommend to meet the requirement? (Choose 2)

Salesforce Identity Connect
Active Directory Password Sync Plugin
Configure Cloud Provider Load Balancer
Salesforce Trigger & Field on Contact object

Question 10 of 60

CloudVista Solutions wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, CloudVista Solutions establishes a single customer view, including their buying behaviors, channel preferences, and purchasing history.

All of this information exists but is spread across different systems and formats. CloudVista Solutions has decided to use Salesforce as the platform to build a 360-degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets.

What should an identity architect do to provision, de-provision, and authenticate users?

Salesforce Identity is not needed since CloudVista Solutions uses Microsoft AD.
Salesforce Identity can be included but CloudVista Solutions will be required to build a custom integration with Microsoft AD.
Salesforce Identity is included in the Salesforce licenses so it does not need to be considered separately.
Salesforce Identity can be included but CloudVista Solutions will require Identity Connect.

Question 11 of 60

CloudVista Solutions has built a custom web app for its employees. CloudVista Solutions wants to leverage Salesforce Identity to control access to the custom app.

At a minimum, which Salesforce license is required to support this requirement?

Identity Verification
Identity Only
Identity Connect
External Identity

Question 12 of 60

The CIO of CloudVista Solutions is planning to implement a mobile-first Consumer Identity Access Management (CIAM) for external users. User authentication is the only requirement. The user’s email or mobile phone number should be supported as a username.

As an identity architect, which two licenses would you recommend to meet this requirement? (Choose 2)

Email Verification credits
Identity Connect licenses
External Identity licenses
SMS Verification credits

Question 13 of 60

An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, de-provisioning, and single-sign-on (SSO).

Which feature of Identity Connect is applicable to this scenario?

When Identity Connect is in place, the user's Salesforce session is revoked immediately if a user is deprovisioned in an on-premise AD.
When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
Identity Connect can be deployed as a managed package on Salesforce org, leveraging high availability of Salesforce platform out-of-the-box.
If the number of provisioned users exceeds Salesforce license allowances, Identity Connect will start disabling the existing Salesforce users in a first in, first out (FIFO) fashion.

Question 14 of 60

CloudVista Solutions is using Active Directory as its corporate identity provider and Salesforce as its CRM for customer care agents, who use SAML-based sign sign-on to log in to Salesforce. The default agent profile does not include the Manage User permission. UC wants to dynamically update the agent role and permission sets.

Which mechanisms are used to provision agents with the appropriate permissions? (Choose 2)

Use login flow in system context to update role and permission sets.
Use login flow in user context to update role and permission sets.
Use declarative registration handler process builder/flow to create, update users and contacts.
Authentication provider configuration is required for each social sign-on provider. Enable authentication providers in community.

Question 15 of 60

A financial enterprise is planning to set up a user authentication mechanism to log in to the Salesforce system. Due to regulatory requirements, the CIO of the company wants user administration, including passwords and authentication requests, to be managed by an external system that is only accessible via a SOAP web service.

Which authentication mechanism should an identity architect recommend to meet the requirements?

OAuth web server flow
Just-in-Time provisioning
Identity Connect

Question 16 of 60

A company with 15,000 employees is using Salesforce and would like to take the necessary steps to highlight or curb fraudulent activity.

Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times, and who logged in during non-business hours?

Login Forensics
Login Inspector
Login History
Login Inspector

Question 17 of 60

CloudVista Solutions is rolling out its new customer identity and access management solution built on top of its existing Salesforce instance. UC wants to allow customers to log in using Facebook, Google, and other social sign-on providers.

How should this functionality be enabled for them, assuming all social sign-on providers support OpenID Connect?

Configure a single sign-on setting and a registration handler for each social sign-on provider.
Configure a single sign-on setting and a registration handler for each social sign-on provider.
Configure a single sign-on setting and a JIT handler for each social sign-on provider.
Configure an authentication provider and a registration handler for each social sign-on provider.

Question 18 of 60

CloudVista Solutions wants to give customers the ability to submit and manage issues with their purchases. CloudVista Solutions needs to give its customers the ability to log in with their Facebook and Twitter credentials.

Which actions should an identity architect recommend to meet these requirements? (Choose 2)

Create a custom external authentication provider for Facebook.
Create a custom external authentication provider for Twitter.
Configure a predefined authentication provider for Twitter.
Configure a predefined authentication provider for Facebook.

Question 19 of 60

CloudVista Solutions uses the Customer 360 platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information.

What is the potential impact on the architecture if CloudVista Solutions decides to implement this feature?

Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.
Registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.
If contactless user is upgraded to Community license, the contact record is automatically created and linked to the user record but not associated with an account.
Password less authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record.

Question 20 of 60

A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect (OIDC).

When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC or SAML?

If the user has a session on Salesforce, you do not want them to be prompted for a username and password when they login to the SP.
They are equivalent protocols and there is no real reason to choose one over the other.
The SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider.
OIDC is more secure than SAML and, therefore, it is the obvious choice.

Question 21 of 60

CloudVista Solutions manages functional group permissions in a custom security application supported by a relational database and a REST service layer. Group permissions are mapped as permission sets in Salesforce.

Which action should an identity architect use to ensure functional group permissions are reflected as permission set assignments?

Use the Apex Just-in-Time (JIT) handler to query the Security Assertion Markup Language (SAML) attributes and set permission sets.
Use a login flow to query SAML attributes and set permission sets.
Use the Apex JIT handler to callout to the security application and set permission sets.
Use a login flow with invocable Apex to callout to the security application and set permission sets.

Question 22 of 60

Elliot recently joined CloudVista Solutions as a Salesforce Admin. He has been getting complaints from users who are unable to log in to Salesforce. The company recently implemented SSO using an external tool.

What would you recommend the admin do first to validate user login issues?

Check with users on login issues.
Review login history and look for SAML errors on specific errors.
Have users log a Service Now ticket.
Send them links for training on how to login with salesforce using SSO.

Question 23 of 60

CloudVista Solutions manages application functional permissions centrally as Active Directory groups. The CRM SuperUser and CRM_Reporting SuperUser groups should respectively give the user the Super User and Reporting Super User permission set in Salesforce. Salesforce is the service provider to a Security Assertion Markup Language (SAML) identity provider.

How should an identity architect ensure the Active Directory groups are reflected correctly when a user accesses Salesforce?

Use the Apex Just-in-Time handler to query standard SAML attributes and set permission sets.
Use a login flow to query standard SAML attributes and set permission sets.
Use a login flow to query custom SAML attributes and set permission sets.
Use the Apex Just-in-Time handler to query custom SAML attributes and set permission sets.

Question 24 of 60

A security architect is rolling out a new multi-factor authentication (MFA) mandate, where all employees must go through a secure authentication process before accessing Salesforce. There are multiple identity providers (IdP) in place and the architect is considering how the Authentication Method Reference field (AMR) in the Login History can help.

Which considerations should the architect keep in mind? (Choose 2)

AMR field shows the authentication methods used at IdP.
High-assurance sessions must be configured under Session Security Level Policies.
Both OIDC and Security Assertion Markup Language (SAML) are supported but AMR must be implemented at IdP.
Dependency on what is supported by OpenID Connect (OIDC) implementation at IdP.

Question 25 of 60

A healthcare company uses Salesforce and has a compliance requirement to track information about devices from which users log in. Also, a Salesforce Security Administrator needs to have the ability to revoke the device from which users log in.

What should be used to fulfill this requirement?

Use the Activations feature to meet the compliance requirement to track device information.
Use login flows to capture device from which users log in and store device and user information in a custom object.
Use multi-factor authentication (MFA) to meet the compliance requirement to track device information.
Use the Login History object to track information about devices from which users log in.

Question 26 of 60

CloudVista Solutions believes a specific user account may have been compromised. The CISO wants to inactivate the user account ASAP and needs to perform a forensic analysis and identify signals that could indicate a breach has occurred.

What should CloudVista Solutions’ first step be in gathering signals that could indicate account compromise?

Download the Identity Provider Event Log and evaluate the details of activities performed by the user.
Download the Login History and evaluate the details of logins performed by the user.
Review the user record and evaluate the login and transaction history.
Download the Setup Audit Trail and review all recent activities performed by the user.

Question 27 of 60

CloudVista Solutions employees use a custom on-premise helpdesk application to request, approve, notify, and track access granted to various on-premises and cloud applications, including Salesforce. Salesforce is currently used to authenticate users.

How should CloudVista Solutions provision Salesforce users as soon as they are approved in the help desk application with the approved profiles and permission sets?

Use a login flow to query the helpdesk to validate user status.
Use Salesforce Connect to integrate with the help desk application.
Have the help desk initiate an IdP-initiated Just-in-Time provisioning SAML flow.
Build an integration that performs a remote call-in to the Salesforce SOAP or REST API.

Question 28 of 60

An identity architect is setting up an integration between Salesforce and a third-party system. The third-party system needs to be able to authenticate to Salesforce and then make API calls against the REST API.

One of the requirements is that the solution needs to ensure the third-party service providers connected app in Salesforce minimize the need for end-user interaction and maximize security.

Which OAuth flow should be used to fulfill the requirement?

User-agent flow
Username-password flow
Web server flow
JWT bearer flow

Question 29 of 60

CloudVista Solutions allows employees to use a mobile device to access Salesforce for daily operations using a hybrid mobile app. This app uses mobile software development kits (SDK), leverages refresh tokens to regenerate access tokens when required and is distributed as a private app.

The Chief Security Officer is rolling out an org-wide compliance policy to enforce the re-verification of devices if an employee has not logged in from that device in the last week.

Which connected app setting should be leveraged to comply with this policy change?

Scope – Deny refresh_token scope for this connected app.
Refresh Token Policy – Expire the refresh token if it has not been used for 7 days.
Permitted User – Ask admins to maintain a list of users who are permitted based on last login date.
Session Policy – Set timeout value of the connected app to 7 days.

Question 30 of 60

CloudVista Solutions is planning to add Wi-Fi-enabled GPS tracking devices to its shipping containers so that the GPS coordinate data can be sent from the tracking device to its Salesforce production org via a custom API. The GPS devices have no direct user input or output capabilities.

Which OAuth flow should the identity architect recommend to meet the requirement?

OAuth 2.0 asset token flow for securing connected devices
OAuth 2.0 web server flow for web app integration
Oauth 2.0 username-password flow for special scenarios
2.0 JWT bearer flow for server-to-server integration

Question 31 of 60

A web service is developed that allows secure access to customer order status on the Salesforce platform. The service connects to Salesforce through a connected app with the web server flow. The following are the required actions for the authorization flow:

User authenticates and authorizes access.
Request an access token.
Salesforce grants an access token.
Request an authorization code.
Salesforce grants authorization code.

What is the correct sequence for the authorization flow?

2, 1, 3, 4, 5
4, 1, 5, 2, 3
4, 5, 2, 3, 1
1, 4, 5, 2, 3

Question 32 of 60

CloudVista Solutions is creating a web application that will be secured by Salesforce Identity using the OAuth 2.0 web server flow (this flow uses the OAuth 2.0 authorization code grant type).

Which OAuth concepts apply to this flow? (Choose 3)

Scopes
Authentication token
Access token
Verification URL
Client secret

Question 33 of 60

An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:

1. Users should not have to log in every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.

How should the identity architect configure the Salesforce connected app to meet the requirements?

Enable the API scope and offline access scope, upload a certificate so JWT bearer flow can be used, and then set the connected app access settings to “Admin Pre-Approved”. Enable the full access scope and then set the connected app access settings to “Admin Pre-Approved”.
App to access settings to “Admin Pre-Approved”.
Enable the API scope and offline access scope on the connected app, and then set the connected.
Enable the API scope and offline access scope on the connected app, and then set the connected app access settings to “User may self-authorize”.

Question 34 of 60

A third-party app provider would like to have users provisioned via a service endpoint before users access their app from Salesforce.

What should an identity architect recommend to configure the requirement with limited changes to the third-party app?

Use a connected app with user provisioning flow.
Use Salesforce Identity with Security Assertion Markup Language (SAML) for provisioning users.
Redirect users to the third-party app for registration.
Create the canvas app in Salesforce for the third-party app to provision users.

Question 35 of 60

A company wants to provide its employees with a custom mobile app that accesses Salesforce. Users are required to download the internal native IOS mobile app from the corporate intranet on their mobile device.

The app allows flexibility to access other non-Salesforce internal applications once users authenticate with Salesforce. The apps self-authorize, and users are permitted to use the apps once they have logged into Salesforce.

How should an identity architect meet the above requirements with the privately distributed mobile app?

Create a new hybrid mobile app and use the connected app with OAuth to authenticate users for Salesforce and non-Salesforce internal apps.
Use connected app with OAuth and Security Assertion Markup Language (SAML) to access other non-Salesforce internal apps.
Use Salesforce as an identity provider (IdP) to access the mobile app and use the external IdP for other non-Salesforce internal apps.
Configure mobile app settings in connected app and Salesforce as identity provider for non-Salesforce internal apps.

Question 36 of 60

CloudVista Solutions is creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow. Application users will authenticate using a username and password. They should not be forced to approve API access in the mobile app or reauthenticate for three months.

Which connected app options need to be configured to fulfill this use case? (Choose 2)

Set the Session Timeout value to 3 months.
Set Permitted Users to “All users may self-authorize”.
Set Permitted Users to “Admin approved users are pre-authorized”.
Set the Refresh Token Policy to expire refresh token after 3 months.

Question 37 of 60

An identity architect is setting up an integration between Salesforce and a third-party system. The third-party system needs to be able to authenticate to Salesforce and then make API calls against the REST API. One of the requirements is that the solution needs to ensure the third-party service provider’s connected app in Salesforce minimizes the need for end-user interaction and maximizes security.

Which OAuth flow should be used to fulfill the requirement?

User-agent flow
Username-password flow
Web server flow
JWT bearer flow

Question 38 of 60

CloudVista Solutions wants to allow its consumers to self-register on its business-to-consumer (B2C) portal that is built on Experience Cloud. The identity architect has recommended the use of person accounts.

Which steps need to be configured to enable self-registration using person accounts? (Choose 3)

Contact Salesforce support to enable person accounts.
Under Login and Registration settings, ensure that the Default Account field is empty.
Set Organization-Wide Default Sharing for Contact to "Public Read Only".
Enable access to person and business account record types under Public Access settings.
Contact Salesforce support to enable business accounts.

Question 39 of 60

CloudVista Solutions utilizes a third-party cloud solution for an employee portal. CloudVista Solutions also owns Salesforce Service Cloud and would like employees to be able to log in to Salesforce with their third-party portal credentials for a seamless experience. The third-party employee portal only supports OAuth.

What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

Add the third-party portal as a connected app.
Create a custom external authentication provider.
Configure Salesforce for delegated authentication.
Configure SSO to use the third-party portal as an identity provider.

Question 40 of 60

CloudVista Solutions is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable CloudVista Solutions branded page.

The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.

Which approach should the identity architect recommend?

Create a full sandbox to replicate the portal site and update the branding accordingly.
Use Heroku to build the new brand site and embedded login to reuse identities.
Configure an additional community site on the same org that is dedicated for the new brand.
Implement experience ID in the code and extend the URLs and endpoints as required.

Question 41 of 60

A global company is using the Salesforce platform as an identity provider and needs to integrate a third-party application with its Experience Cloud customer portal.

Which features should be utilized to provide users with login and identity services for the third-party application? (Choose 2)

Use a connected app
External data source with named principal identity type
Use the App Launcher with single sign-on (SSO)
Use delegated authentication

Question 42 of 60

CloudVista Solutions wants to implement a partner community. Active community users will need to review and accept the community rules and update key contact information for each community member before their annual partner event.

Which approach will meet this requirement?

Create a login flow that conditionally prompts users who have not accepted the new community rules and who have missing or outdated information.
Create tasks for users who need to update their data or accept the new community rules.
Add a banner to the community home page asking users to update their profile and accept the new community rules.
Create a custom landing page and email campaign asking all community members to login and verify their data.

Question 43 of 60

When designing a multi-branded customer identity and access management solution on the Salesforce platform, how should an identity architect ensure a specific brand experience in Salesforce is presented?

The experience ID, which can be included in OAuth/OpenID flows, and Security Assertion Markup Language (SAML) flows as a URL parameter.
Add a custom parameter to the service provider’s OAuth/SAML call and implement logic on its login page to apply branding based on the parameters value.
The audience ID, which can be set in a shared cookie.
Provide a brand picker that the end user can use to select its sub-brand when they arrive on Salesforce.

Question 44 of 60

CloudVista Solutions is planning to implement a community for its customers using Salesforce Experience Cloud. Customers are not able to self-register. CloudVista Solutions would like to have customers set their own passwords when provided access to the community.

Which recommendations should an identity architect make to fulfill this requirement? (Choose 2)

Add customers as contacts and add them to Experience Cloud site.
Allow password reset using the API to update Experience Cloud site membership.
Use login flows to allow users to reset password in Experience Cloud site.
Enable welcome emails while configuring the Experience Cloud site.

Question 45 of 60

A consumer products company uses Salesforce to maintain consumer information, including orders. The company implemented a portal solution using Salesforce Experience Cloud for its consumers where the consumers can log in using their credentials. The company is considering allowing users to log in with their Facebook or LinkedIn credentials.

Once enabled, what role will Salesforce play?

Facebook and LinkedIn will be the SPS.
Salesforce will be the identity provider (Idp).
Facebook and LinkedIn will act as the IdPs and SPs.
Salesforce will be the service provider (SP).

Question 46 of 60

CloudVista Solutions would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal should be able to self-register but be unable to automatically be assigned to a contact record until verified. External Identity licenses have been purchased for the project. After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.

Which steps should an identity architect follow to implement the outlined requirements? (Choose 3)

Select the “Configurable Self-Reg Page” option under Login & Registration.
Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.
Customize the self-registration Apex handler to create only the user record.
Enable “Allow customers and partners to self-register”.
Set up an external login page and call Salesforce APIs for user creation.

Question 47 of 60

A multinational industrial products manufacturer is planning to implement Salesforce CRM to manage their business. They have the following requirements:

1. They plan to implement partner communities to provide access to their partner network.
2. They have operations in multiple countries and are planning to implement multiple Salesforce orgs.
3. Some of their partners do business in multiple countries and will need information from multiple Salesforce communities.
4. They would like to provide a single login for their partners.

How should an identity architect solution this requirement with limited custom development?

Allow partners to choose the Salesforce org they need information from and use login flows to authenticate access.
Register partners in one org and access information from other orgs using APIS.
Create a partner login for the country of their operation and use SAML federation to provide access to other orgs.
Consolidate partner-related information in a single org and provide access through Salesforce community.

Question 48 of 60

CloudVista Solutions has an Experience Cloud site (customer community) where customers can authenticate and place orders, view the status of orders, etc. UC allows guest checkout.

How can a guest register use data previously collected during order placement?

Enable Security Assertion Markup Language Sign-On and use a login flow to collect only order details to retrieve customer data.
Enable Facebook as an authentication provider and use a registration handler to collect only order details to retrieve customer data.
Use a Connected App Handler Apex Plugin class to collect only order details to retrieve customer data.
Enable self-registration and customize a self-registration page to collect only order details to retrieve customer data.

Question 49 of 60

CloudVista Solutions is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.

Which page types are valid login page types for the site? (Choose 2)

Login Discovery page
Lightning Experience page
Experience Builder page
Embedded Login page

Question 50 of 60

CloudVista Solutions has several employees who do NOT need access to Salesforce objects. The employees should sign in to a custom benefits web app using their Salesforce credentials.

Which license should the identity architect recommend to fulfill this requirement?

Identity Connect license
Identity Only license
External Identity license
Identity Verification Credits Add-On license

Question 51 of 60

CloudVista Solutions recently acquired a company. Each company will retain its identity provider (IdP). Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.

How should the combined company’s employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?

Configure unique MyDomains for each company and have generated links use the appropriate MyDomain in the URL.
Have generated links append a querystring parameter indicating the IdP. The login service will redirect to the appropriate IdP.
Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.
Have generated links be prefixed with the appropriate IdP URL to invoke an Idp-initiated Security Assertion Markup Language flow when clicked.

Question 52 of 60

An enterprise is using a Lightweight Directory Access Protocol (LDAP) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).

How can end users change their passwords?

Users can change it on the enterprise LDAP authentication portal.
Users can click on the Forgot your Password link on the Salesforce.com login page.
Once logged in, users can go to the Change Password screen in Salesforce.
Users can request the Salesforce Admin to reset their password.

Question 53 of 60

A university is planning to set up an identity solution for its alumni. A third-party identity provider will be used for single sign-on, and Salesforce will be the system of record. Users are getting error messages when logging in.

Which Salesforce feature should be used to debug the issue?

Apex Exception Email
Debug Logs
View Setup Audit Trail
Login History

Question 54 of 60

CloudVista Solutions is setting up Salesforce to authenticate users with an external identity provider. The CloudVista Solutions Salesforce Administrator is having trouble getting things set up.

What should an identity architect use to show which part of the login assertion is failing?

SAML Metadata File Importer
Identity Provider Metadata Download
Connected App Manager
Security Assertion Markup Language Validator

Question 55 of 60

An administrator created a connected app for a custom web application in Salesforce, which needs to be visible as a tile in App Launcher. The tile for the custom web application is missing in the app launcher for all users in Salesforce. The administrator requested assistance from an identity architect to resolve the issue.

Which reasons are the source of the issue? (Choose 2)

Auth scope does not include “openid”.
The connected app is not set in the app menu as “Visible in App Launcher”.
Session Policy is set as “High Assurance session required” for this connected app.
StartURL for the connected app is not set in connected app settings.

Question 56 of 60

CloudVista Solutions would like to automatically create new employee users in Salesforce with an appropriate profile that maps to its Active Directory department.

How should an identity architect implement this requirement?

Make a callout during the login flow to query department from Active Directory to assign the appropriate profile.
Use a login flow to collect Security Assertion Markup Language attributes and assign the appropriate profile during Just-in-Time (JIT) provisioning.
Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.
Use the createUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Question 57 of 60

Users logging into Salesforce are frequently prompted to verify their identity. The identity architect is required to provide recommendations so that the frequency of prompt verification can be reduced.

What should the identity architect recommend to meet the requirement?

Set trusted IP ranges for the organization.
Implement a single sign-on for Salesforce using an external identity provider.
Implement 2FA authentication for the Salesforce org.
Implement multi-factor authentication for the Salesforce org.

Question 58 of 60

CloudVista Solutions has multiple Salesforce instances where users receive emails from different instances. Users should be logged into the correct Salesforce instance authenticated by their IdP when clicking on an email link to a Salesforce record.

What should be enabled in Salesforce as a prerequisite?

Multi-Factor Authentication
My Domain
Identity Provider
External Identity

Question 59 of 60

CloudVista Solutions is implementing Salesforce Identity to broker authentication from its enterprise single sign-on (SSO) solution through Salesforce to third-party applications using SAML.

What role does Salesforce Identity play in its relationship with the enterprise SSO system?

Client Application
Service Provider (SP)
Identity Provider (IdP)
Resource Server

Question 60 of 60

CloudVista Solutions wants to give customers the ability to submit and manage issues with their purchases. CloudVista Solutions needs to give its customers the ability to log in with their Amazon credentials.

What should an identity architect recommend to meet these requirements?

Configure an OpenID Connect authentication provider for Amazon.
Configure Amazon as a connected app.
Configure a predefined authentication provider for Amazon.
Create a custom external authentication provider for Amazon.

Average score
Your score

Certified Identity and Access Management Architect Exam 2

Buyan Thyagarajan

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question

21. Question

22. Question

23. Question

24. Question

25. Question

26. Question

27. Question

28. Question

29. Question

30. Question

31. Question

32. Question

33. Question

34. Question

35. Question

36. Question

37. Question

38. Question

39. Question

40. Question

41. Question

42. Question

43. Question

44. Question

45. Question

46. Question

47. Question

48. Question

49. Question

50. Question

51. Question

52. Question

53. Question

54. Question

55. Question

56. Question

57. Question

58. Question

59. Question

60. Question