Exit demo IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) PDF format · free preview

SalesForce IDENTITY-AND-ACCESS-MANAGEMENT-ARCHITECT - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/identity-and-access-management-architect.html

Question 1
Single choice

Uwversal Containers (UC) is building a custom employee hut) application on Amazon Web Services (AWS) and would like to store their users' credentials there. Users will also need access to Salesforce for internal operations. UC has tasked an identity architect with evaluating Afferent solutions for authentication and authorization between AWS and Salesforce.

How should an identity architect configure AWS to authenticate and authorize Salesforce users?

A.

Configure the custom employee app as a connected app.

B.

Configure AWS as an OpenID Connect Provider.

C.

Create a custom external authentication provider.

D.

Develop a custom Auth server in AWS.

Question 2
Single choice

The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.

What should be used and considered before recommending it as a solution on the Salesforce Platform?

A.

OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.

B.

Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.

C.

Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.

D.

Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.

Question 3
Single choice

Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless expenence. The third-party employee portal only supports OAuth.

What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

A.

Configure SSO to use the third party portal as an identity provider.

B.

Create a custom external authentication provider.

C.

Add the third-party portal as a connected app.

D.

Configure Salesforce for Delegated Authentication.

Question 4
Single choice

Universal containers (UC) has multiple salesforce orgs and would like to use a single identity provider to access all of their orgs.

How should UC'S architect enable this behavior?

A.

Ensure that users have the same email value in their user records in all of UC's salesforce orgs.

B.

Ensure the same username is allowed in multiple orgs by contacting salesforce support.

C.

Ensure that users have the same Federation ID value in their user records in all of UC's salesforce orgs.

D.

Ensure that users have the same alias value in their user records in all of UC's salesforce orgs.

Question 5
Single choice

A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.

The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.

What should an Identity architect do to meet this requirement?

A.

Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

B.

Configure the company firewall to allow traffic from Salesforce IP ranges.

C.

Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

D.

Upload a third-party certificate from Salesforce into the on-premise server.

Question 6
Single choice

The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials.

What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?

A.

Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.

B.

Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.

C.

Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.

D.

Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.

Question 7
Single choice

Universal Containers (UC) wants to build a custom mobile app for their field reps to create orders in salesforce. After the first time the users log in, they must be able to access salesforce upon opening the mobile app without being prompted to log in again.

What Oauth flows should be considered to support this requirement?

A.

Web Server flow with a Refresh Token.

B.

Mobile Agent flow with a Bearer Token.

C.

User Agent flow with a Refresh Token.

D.

SAML Assertion flow with a Bearer Token.

Question 8
Single choice

A global fitness equipment manufacturer uses Salesforce to manage its sales cycle. The manufacturer has a custom order fulfillment app that needs to request order data from Salesforce. The order fulfillment app needs to integrate with the Salesforce API using OAuth 2.0 protocol.

What should an identity architect use to fulfill this requirement?

A.

Canvas App Integration

B.

OAuth Tokens

C.

Authentication Providers

D.

Connected App and OAuth scopes

Question 9
Single choice

An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).

Mow can end users change their password?

A.

Users once logged In, can go to the Change Password screen in Salesforce.

B.

Users can click on the "Forgot your Password" link on the Salesforce.com login page.

C.

Users can request the Salesforce Admin to reset their password.

D.

Users can change it on the enterprise LDAP authentication portal.

Question 10
Single choice

Universal containers (UC) has a classified information system that it's call centre team uses only when they are working on a case with a record type of "classified". They are only allowed to access the system when they own an open "classified" case, and their access to the system is removed at all other times.
They would like to implement SAML SSO with salesforce as the IDP, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open
"classified" case record when they try to access the system using SSO.

What is the recommended solution for automatically allowing or denying access to the classified information system based on the open "classified" case record criteria?

A.

Use a custom connected App handler using apex to dynamically allow access to the system based on whether the staff owns any open "classified" cases.

B.

Use apex trigger on case to dynamically assign permission sets that grant access when a user is assigned with an open "classified" case, and remove it when the case is closed.

C.

Use custom SAML jit provisioning to dynamically query the user's open "classified" cases when attempting to access the classified information system

D.

Use salesforce reports to identify users that currently owns open "classified" cases and should be granted access to the classified information system.

Showing 10 of 261 questions · Unlock the full set