Jun-2023 Latest ValidTorrent Identity-and-Access-Management-Designer Exam Dumps with PDF and Exam Engine Free Updated Today!
Following are some new Identity-and-Access-Management-Designer Real Exam Questions!
NEW QUESTION # 101
Universal containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers
- A. Use Google Authenticator as an additional part of the logical processes.
- B. Disallow the use of single Sign-on for any users of the mobile app.
- C. Require high assurance sessions in order to use the connected App
- D. Set login IP ranges to the internal network for all of the app users profiles.
Answer: A,C
NEW QUESTION # 102
An identity architect's client has a homegrown identity provider (IdP). Salesforce is used as the service provider (SP). The head of IT is worried that during a SP initiated single sign-on (SSO), the Security Assertion Markup Language (SAML) request content will be altered.
What should the identity architect recommend to make sure that there is additional trust between the SP and the IdP?
- A. Ensure that the Issuer and Assertion Consumer service (ACS) URL is property configured between SP and IDP.
- B. Ensure that on the SSO settings page, the "Request Signing Certificate" field has a self-signed certificate.
- C. Ensure that there is an HTTPS connection between IDP and SP.
- D. Encrypt the SAML Request using certification authority (CA) signed certificate and decrypt on IdP.
Answer: D
NEW QUESTION # 103
Universal Containers (UC) uses Salesforce for its customer service agents. UC has a proprietary system for order tracking which supports Security Assertion Markup Language (SAML) based single sign-on. The VP of customer service wants to ensure only active Salesforce users should be able to access the order tracking system which is only visible within Salesforce.
What should be done to fulfill the requirement?
Choose 2 answers
- A. Customize Order Tracking to initiate a REST call to validate users in Salesforce after login.
- B. Setup Salesforce as an identity provider (IdP) for order Tracking.
- C. Set up the Corporate Identity store as an identity provider (IdP) for Order Tracking,
- D. Setup Order Tracking as a Canvas app in 5alesforce to POST IdP initiated SAML assertion.
Answer: B,C
NEW QUESTION # 104
Universal containers (UC) has implemented SAML -based single Sign-on for their salesforce application. UC is using pingfederate as the Identity provider. To access salesforce, Users usually navigate to a bookmarked link to my domain URL. What type of single Sign-on is this?
- A. Web server flow.
- B. IDP-initiated with deep linking
- C. Sp-Initiated
- D. IDP-initiated
Answer: C
NEW QUESTION # 105
Universal Containers (UC) is building an authenticated Customer Community for its customers. UC does not want customer credentials stored in Salesforce and is confident its customers would be willing to use their social media credentials to authenticate to the community. Which two actions should an Architect recommend UC to take?
- A. Use Delegated Authentication to call the Twitter login API to authenticate users.
- B. Configure SSO Settings For Facebook to serve as a SAML Identity Provider.
- C. Configure an Authentication Provider for LinkedIn Social Media Accounts.
- D. Create a Custom Apex Registration Handler to handle new and existing users.
Answer: C,D
NEW QUESTION # 106
Universal containers (UC) would like to enable SSO between their existing Active Directory infrastructure and salesforce. The it team prefers to manage all users in Active Directory and would like to avoid doing any initial setup of users in salesforce directly, including the correct assignment of profiles, roles and groups.
Which two optimal solutions should UC use to provision users in salesforce? Choose 2 answers
- A. Use the salesforce REST API to sync users from active directory to salesforce
- B. Use an app exchange product to sync users from Active Directory to salesforce.
- C. Use Active Directory Federation Services to sync users from active directory to salesforce.
- D. Use Identity connect to sync users from Active Directory to salesforce
Answer: B,D
NEW QUESTION # 107
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?
- A. Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.
- B. Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.
- C. Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.
- D. Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.
Answer: D
NEW QUESTION # 108
Universal Containers (UC) is implementing Salesforce and would like to establish SAML SSO for its users to log in. UC stores its corporate user identities in a Custom Database. The UC IT Manager has heard good things about Salesforce Identity Connect as an Idp, and would like to understand what limitations they may face if they decided to use Identity Connect in their current environment. What limitation Should an Architect inform the IT Manager about?
- A. Identity connect is not compatible with UC's current identity environment.
- B. Identity Connect will not support user provisioning in UC's current environment.
- C. Identity Connect will only support Idp-initiated SAML flows in UC's current environment.
- D. Identity Connect will only support SP-initiated SAML flows in UC's current environment.
Answer: B
NEW QUESTION # 109
Universal Containers (UC) has an existing web application that it would like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?
- A. Configure the web application as an item in the Salesforce App Launcher.
- B. Rewrite the web application as a set of Visualforce pages and Apex code.
- C. Add the web application as a ConnectedApp using OAuth User-Agent flow.
- D. Create a Canvas app and use Signed Requests to authenticate the users.
Answer: D
NEW QUESTION # 110
Universal containers (UC) has implemented SAML SSO to enable seamless access across multiple applications. UC has regional salesforce orgs and wants it's users to be able to access them from their main Salesforce org seamless. Which action should an architect recommend?
- A. Configure the regional salesforce orgs as Identity Providers.
- B. Configure the main salesforce org as an Authentication provider.
- C. Configure the main salesforce org as the Identity provider.
- D. Configure the main Salesforce org as a service provider.
Answer: C
NEW QUESTION # 111
Refer to the exhibit.
Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?
- A. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.
- B. Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.
- C. For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.
- D. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.
Answer: D
NEW QUESTION # 112
Universal Containers (UC) implemented SSO to a third-party system for their Salesforce users to access the App Launcher. UC enabled "User Provisioning" on the Connected App so that changes to user accounts can be synched between Salesforce and the third party system. However, UC quickly notices that changes to user roles in Salesforce are not getting synched to the third-party system. What is the most likely reason for this behaviour?
- A. Salesforce roles have more than three levels in the role hierarchy.
- B. Required operation(s) was not mapped in User Provisioning Settings.
- C. The Approval queue for User Provisioning Requests is unmonitored.
- D. User Provisioning for Connected Apps does not support role sync.
Answer: D
NEW QUESTION # 113
An insurance company has a connected app in its Salesforce environment that is used to integrate with a Google Workspace (formerly knot as G Suite).
An identity and access management (IAM) architect has been asked to implement automation to enable users, freeze/suspend users, disable users, and reactivate existing users in Google Workspace upon similar actions in Salesforce.
Which solution is recommended to meet this requirement?
- A. Build an Apex trigger on the useriogin object to make asynchronous callouts to Google APIs.
- B. Configure user Provisioning for Connected Apps.
- C. Build a custom REST endpoint in Salesforce that Google Workspace can poll against.
- D. Update the Security Assertion Markup Language Just-in-Time (SAML JIt; handler in Salesforce for user provisioning and de-provisioning.
Answer: B
NEW QUESTION # 114
Universal Containers (UC) has a Customer Community that uses Facebook for of authentication. UC would like to ensure that changes in the Facebook profile are 65. reflected on the appropriate Customer Community user. How can this requirement be met?
- A. Use information in the Signed Request that is received from Facebook.
- B. Use the updateUser() method on the Registration Handler class.
- C. Develop a scheduled job that calls out to Facebook on a nightly basis.
- D. Use SAML Just-In-Time Provisioning between Facebook and Salesforce.
Answer: B
NEW QUESTION # 115
Universal Containers has implemented a multi-org strategy and would like to centralize the management of their Salesforce user profiles.
What should the Architect recommend to allow Salesforce profiles to be managed from a central system of record?
- A. Create an Apex scheduled job in one org that will synchronize the other org's profiles.
- B. Implement an OAuth JWT flow to pass the profile credentials between systems.
- C. Implement Delegated Authentication that will update the user profiles as necessary.
- D. Implement JIT provisioning on the SAML IdP that will pass the ProfileID in each assertion.
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION # 116
Universal Containers (UC) has a Customer Community that uses Facebook for Authentication. UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user:
How can this requirement be met?
- A. Use information in the signed Request that is received from facebook.
- B. Develop a scheduled job that calls out to Facebook on a nightly basis.
- C. Use SAML Just-In-Time Provisioning between Facebook and Salesforce.
- D. Use the updateUser method on the registration Handler Class.
Answer: D
NEW QUESTION # 117
......
Resources From:
- 2023 Latest ValidTorrent Identity-and-Access-Management-Designer Exam Dumps (PDF & Exam Engine) Free Share: https://www.validtorrent.com/Identity-and-Access-Management-Designer-valid-exam-torrent.html
- 2023 Latest ValidTorrent Identity-and-Access-Management-Designer PDF and Identity-and-Access-Management-Designer Exam Dumps Free Share: https://drive.google.com/open?id=1Xl2yQr94TCJ25EycN6ddUolxR0tv2s6j
Free Resources from ValidTorrent, We Devoted to Helping You 100% Pass All Exams!