Free Salesforce Identity-and-Access-Management-Architect Exam Questions

Question 1

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in

the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application

support teams to finish user deactivations. A terminated employee recently was able to login to NTO's

Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP

directory.

What should an identity architect recommend to prevent this from happening in the future?

A : eate a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

B : nfigure an authentication provider to delegate authentication to the LDAP directory.

C : a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

D : tup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Answer: B

Question 2

Universal Containers (UC) has built a custom token-based Two-factor authentication (2FA) system for their existing on-premise applications. They are now implementing Salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution as Architect should consider?

A : the custom 2FA system for on-premise applications and native 2FA for Salesforce.

B : place the custom 2FA system with an AppExchange App that supports on premise application and salesforce.

C : Custom Login Flows to connect to the existing custom 2FA system for use in Salesforce.

D : place the custom 2FA system with Salesforce 2FA for on-premise applications and Salesforce.

Answer: D

Question 3

Universal Containers (UC) is implementing Salesforce and would like to establish SAML SSO for its users to

log in. UC stores its corporate user identities in a Custom Database. The UC IT Manager has heard good

things about Salesforce Identity Connect as an Idp, and would like to understand what limitations they may

face if they decided to use Identity Connect in their current environment. What limitation Should an Architect

inform the IT Manager about?

A : Identity Connect will not support user provisioning in UC's current environment.

B : Identity Connect will only support Idp-initiated SAML flows in UC's current environment.

C : Identity Connect will only support SP-initiated SAML flows in UC's current environment.

D : entity connect is not compatible with UC's current identity environment.

Answer: A

Question 4

Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would like

to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to

achieve the goal?

A : Access Tokens

B : Mobile pins

C : fresh Tokens

D : opes

Answer: D

Question 5

Universal containers (UC) is building a mobile application that will make calls to the salesforce REST API.

Additionally UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes

should UC configure in the connected App? Choose 2 answers

A : Refresh token

B : I

C : ll

D :

Answer: A,B