Identity-and-Access-Management-Designer Practice Exam Tests Latest Updated on Oct-2021
Pass Identity-and-Access-Management-Designer Exam in First Attempt Guaranteed Dumps!
NEW QUESTION 52
Universal Containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in Salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers
- A. Set Login IP Ranges to the internal network for all of the app users Profiles.
- B. Disallow the use of Single Sign-on for any users of the mobile app.
- C. Require High Assurance sessions in order to use the Connected App.
- D. Use Google Authenticator as an additional part of the login process
Answer: A,C
NEW QUESTION 53
Northern Trail Outfitters (NTO) leverages Microsoft Active Directory (AD) for management of employee usernames, passwords, permissions, and asset access. NTO also owns a third-party single sign-on (SSO) solution. The third-party party SSO solution is used for all corporate applications, including Salesforce.
NTO has asked an architect to explore Salesforce Identity Connect for automatic provisioning and deprovisiorung of users in Salesforce.
What role does identity Connect play in the outlined requirements?
- A. User Management
- B. Identity Provider
- C. Single Sign-On
- D. Service Provider
Answer: A
NEW QUESTION 54
Universal Containers (UC) is looking to build a Canvas app and wants to use the corresponding Connected App to control where the app is visible. Which two options are correct in regards to where the app can be made visible under the Connected App setting for the Canvas app? Choose 2 answers
- A. In the mobile navigation menu on Salesforce for Android.
- B. Included in the Call Control Tool that's part of Open CTI.
- C. The sidebar of a Salesforce Console as a console component.
- D. As part of the body of a Salesforce Knowledge article.
Answer: C,D
NEW QUESTION 55
Universal containers (UC) is building a mobile application that will make calls to the salesforce REST API. Additionally UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes should UC configure in the connected App? Choose 2 answers
- A. Web
- B. API
- C. Refresh token
- D. full
Answer: B,C
NEW QUESTION 56
Containers (UC) has multiple Salesforce Orgs and would like to use a single Identity Provider to access all of their orgs. How should UC's Architect enable this behaviour?
- A. Ensure that users have the same Alias value in their user records in all of UC's Salesforce orgs.
- B. Ensure the same username is allowed in multiple orgs by contacting Salesforce Support.
- C. Ensure that users have the same Email Value in their user records in all of UC's Salesforce orgs.
- D. Ensure that users have the same Federation ID value in their User records in all of UC's Salesforce orgs
Answer: D
NEW QUESTION 57
Which three types of attacks would a 2-Factor Authentication solution help garden against?
- A. Phishing attacks
- B. Man-in-the-middle attacks
- C. Network perimeter attacks
- D. Key logging attacks
- E. Dictionary attacks
Answer: C,D,E
NEW QUESTION 58
An Architect has configured a SAML-based SSO integration between Salesforce and an external Identity provider and is ready to test it. When the Architect attempts to log in to Salesforce using SSO, the Architect receives a SAML error. Which two optimal actions should the Architect take to troubleshoot the issue?
- A. Use the browser's Development tools to view the Salesforce page's markup.
- B. Paste the SAML Assertion Validator in Salesforce.
- C. Ensure the Callback URL is correctly set in the Connected Apps settings.
- D. Use a browser that has an add-on/extension that can inspect SAML.
Answer: B,D
NEW QUESTION 59
Universal Containers (UC) wants to use Salesforce for sales orders and a legacy of system for order fulfillment. The legacy system must update the status of orders in 65* Salesforce in real time as they are fulfilled. UC decides to use OAuth for connecting the legacy system to Salesforce. What OAuth flow should be considered that doesn't require storing credentials, client secret or refresh tokens?
- A. JWT Bearer Token flow
- B. Username-Password flow
- C. Web Server flow
- D. User Agent flow
Answer: A
NEW QUESTION 60
Universal Containers (UC) employees have Salesforce access from restricted IP ranges only, to protect against unauthorised access. UC wants to roll out the Salesforce1 mobile app and make it accessible from any location. Which two options should an Architect recommend? Choose 2 answers
- A. Relax the IP restrictions in the Connect App settings for the Salesforce1 mobile app.
- B. Use Login Flow to bypass IP range restriction for the mobile app.
- C. Remove existing restrictions on IP ranges for all types of user access.
- D. Relax the IP restriction with a second factor in the Connect App settings for Salesforce1 mobile app.
Answer: B,C
NEW QUESTION 61
An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer's sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.
Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150 sub-brands?
- A. Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.
- B. Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.
- C. Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the user experience.
- D. Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuth and Security Assertion Markup Language (SAML) flows.
Answer: B
NEW QUESTION 62
Universal containers (UC) does my domain enable in the context of a SAML SSO configuration? Choose 2 answers
- A. Resource deep linking
- B. App launcher
- C. Login forensics
- D. SSO from salesforce1 mobile app.
Answer: A,D
NEW QUESTION 63
Universal Containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in Salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers
- A. Set Login IP Ranges to the internal network for all of the app users Profiles.
- B. Disallow the use of Single Sign-on for any users of the mobile app.
- C. Require High Assurance sessions in order to use the Connected App.
- D. Use Google Authenticator as an additional part of the login process
Answer: C,D
NEW QUESTION 64
Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?
- A. The users forget to check the box to remember their credentials.
- B. The app is requesting too many access Tokens in a 24-hour period
- C. The refresh token expiration policy is set incorrectly in salesforce
- D. The Oauth authorizations are being revoked by a nightly batch job.
Answer: C
NEW QUESTION 65
Universal containers (UC) would like to enable self - registration for their salesforcepartner community users.
UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate profile and account values. Which two actions should the architect recommend to UC? Choose 2 answers
- A. Modify the selfregistration trigger to assign profile and account.
- B. Configure registrationfor communities to use a custom apex controller.
- C. Configure registration for communities to use a custom visualforce page.
- D. Modify the communitiesselfregcontroller to assign the profile and account.
Answer: C,D
NEW QUESTION 66
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?
- A. Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.
- B. Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.
- C. Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.
- D. Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.
Answer: A
NEW QUESTION 67
An architect needs to advise the team that manages the identity provider how to differentiate salesforce from other service providers. What SAML SSO setting in salesforce provides this capability?
- A. SAML identity location
- B. Issuer
- C. Identity provider login URL
- D. Entity id
Answer: D
NEW QUESTION 68
Universal Containers (UC) has an existing web application that it would like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?
- A. Create a Canvas app and use Signed Requests to authenticate the users.
- B. Configure the web application as an item in the Salesforce App Launcher.
- C. Rewrite the web application as a set of Visualforce pages and Apex code.
- D. Add the web application as a ConnectedApp using OAuth User-Agent flow.
Answer: A
NEW QUESTION 69
Universal containers (UC) is successfully using Delegated Authentication for their salesforce users. The service supporting Delegated Authentication is written in Java. UC has a new CIO that is requiring all company Web services be RESR-ful and written in . NET. Which two considerations should the UC Architect provide to the new CIO? Choose 2 answers
- A. Delegated Authentication will not work with a.net service.
- B. Delegated Authentication will not work with rest services.
- C. Delegated Authentication will continue to work with rest services.
- D. Delegated Authentication will continue to work with a.net service.
Answer: B,D
NEW QUESTION 70
Universal Containers (UC) wants to integrate a third-party Reward Calculation system with Salesforce to calculate Rewards. Rewards will be calculated on a schedule basis and update back into Salesforce. The integration between Salesforce and the Reward Calculation System needs to be secure. Which are two recommended practices for using OAuth flow in this scenario. choose 2 answers
- A. OAuth SAML Bearer Assertion FLow
- B. OAuth Username-Password Flow
- C. OAuth Refresh Token FLow
- D. OAuth JWT Bearer Token FLow
Answer: A,D
NEW QUESTION 71
Universal Containers (UC) uses Global Shipping (GS) as one of their shipping vendors. Regional leads of GS need access to UC's Salesforce instance for reporting damage of goods using Cases. The regional leads also need access to dashboards to keep track of regional shipping KPIs. UC internally uses a third-party cloud analytics tool for capacity planning and UC decided to provide access to this tool to a subset of GS employees. In addition to regional leads, the GS capacity planning team would benefit from access to this tool. To access the analytics tool, UC IT has set up Salesforce as the Identity provider for Internal users and would like to follow the same approach for the GS users as well. What are the most appropriate license types for GS Tregional Leads and the GS Capacity Planners? Choose 2 Answers
- A. Customer Community Plus license for GS Regional Leads and External Identity for GS Capacity Planners.
- B. Identity Licence for GS Regional Leads and External Identity license for GS capacity Planners.
- C. Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.
- D. Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.
Answer: C,D
NEW QUESTION 72
In an SP-Initiated SAML SSO setup where the user tries to access a resource on the Service Provider, What HTTP param should be used when submitting a SAML Request to the Idp to ensure the user is returned to the intended resourse after authentication?
- A. RedirectURL
- B. StartURL
- C. DisplayState
- D. RelayState
Answer: B
NEW QUESTION 73
architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct. Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers
- A. The clock on the Identity Provider server is twenty minutes behind Salesforce.
- B. The Identity Provider is also used to SSO into five other applications.
- C. The default language for the Identity Provider and Salesforce are Different.
- D. The Issuer Certificate from the Identity Provider expired two weeks ago.
Answer: C,D
NEW QUESTION 74
Northern Trail Outfitters (NTO) is planning to build a new customer service portal and wants to use passwordless login, allowing customers to login with a one-time passcode sent to them via email or SMS.
How should the quantity of required Identity Verification Credits be estimated?
- A. Identity Verification Credits are a direct add-on license based on the number of existing member-based or login-based Community licenses.
- B. Identity Verification Credits are consumed with each verification sent and should be estimated based on the number of logins that will incur a verification challenge.
- C. Each community comes with 10,000 Identity Verification Credits per month and only customers with more than 10,000 logins a month should estimate additional SMS verifications needed.
- D. Identity Verification Credits are consumed with each SMS (text message) sent and should be estimated based on the number of login verification challenges for SMS verification users.
Answer: D
NEW QUESTION 75
Users logging into Salesforce are frequently prompted to verify their identity.
The identity architect is required to provide recommendations so that frequency of prompt verification can be reduced.
What should the identity architect recommend to meet the requirement?
- A. Implement multi-factor authentication for the Salesforce org.
- B. Set trusted IP ranges for the organization.
- C. Implement an single sign-on for Salesforce using an external identity provider.
- D. Implement 2FA authentication for the Salesforce org.
Answer: B
NEW QUESTION 76
......
Salesforce Identity and Access Management Designer Free Certification Exam Material from LatestCram with 192 Questions: https://www.latestcram.com/Identity-and-Access-Management-Designer-exam-cram-questions.html
Identity-and-Access-Management-Designer Dumps Full Questions - Exam Study Guide: https://drive.google.com/open?id=1tbFJQNbTKwgq8GrD3lFoLURZgnnuF9OX
