Online Access Free Identity-and-Access-Management-Architect Exam Questions

No.# A and D is correct.

To enable self-registration for partner community users, UC should modify the CommunitiesSelfRegController class to assign the Profile and Account values based on the custom data elements captured from the partner user.

UC should also configure Registration for Communities to use a custom Apex controller that extends the CommunitiesSelfRegController class and overrides the default registration logic

No.# B
https://www.freecram.net/question/Salesforce.Identity-and-Access-Management-Designer.v2021-08-28.q43/universal-containers-uc-has-built-a-custom-token-based-two-factor-authentication-2fa-system-for-their

No.# B,D are correct : https://help.salesforce.com/s/articleView?id=sf.external_identity_login_discovery_login_types.htm&type=5

No.# A C

below can be set for Auth Providers

Auth. Provider ID
Provider Type
Name
URL Suffix
Consumer Key
Consumer Secret
Click to reveal
Authorize Endpoint URL
Token Endpoint URL
User Info Endpoint URL
Use Proof Key for Code Exchange (PKCE) Extension
Not Checked
Default Scopes
Include Consumer Secret in SOAP API Responses
Checked
Custom Error URL
Custom Logout URL
Registration Handler Type
Registration Handler
Execute Registration As
Portal
Icon URL
Use Salesforce MFA for this SSO Provider

No.# D
To enable the custom order fulfillment app to access Salesforce data via OAuth 2.0, the identity architect should use a Salesforce Connected App. This connected app acts as a bridge, allowing the order fulfillment app to request access to Salesforce data using OAuth 2.0, which is the open protocol for secure data sharing between applications through token exchange.
Here's why and how:
Why Connected Apps?
Security:
Connected Apps provide a secure way to authorize external apps to access Salesforce data by using OAuth 2.0.
Integration:
They facilitate integration by allowing external apps to authenticate and retrieve data from Salesforce.
Flexibility:
They allow various OAuth 2.0 flows for different use cases

No.# D
https://help.salesforce.com/s/articleView?id=sf.connected_app_user_provisioning.htm&language=en_US&type=5

No.# D is right.

The SAML Bearer Assertion Flow and the SAML Assertion Flow are both methods for exchanging a SAML assertion for an OAuth 2.0 access token, but they differ in how they use the assertion. The SAML Bearer Assertion Flow specifically adheres to OAuth 2.0 Bearer Token Usage, using the SAML assertion as a bearer token in the OAuth 2.0 token request. The SAML Assertion Flow is a broader term that can refer to any flow where a SAML assertion is used for authentication or authorization, not necessarily within the OAuth 2.0 framework.

No.# https://www.pass4success.com/salesforce/discussions/exam-identity-and-access-management-designer-topic-7-question-36-discussion

No.# OAuth 2.0 SAML Bearer Assertion Flow allows a client application to use a SAML assertion to request an access token from Salesforce. This flow can leverage theexisting SAML configuration for single sign-on and secure the Salesforce APIs.

No.# https://www.freecram.net/question/Salesforce.Identity-and-Access-Management-designer.v2021-08-02.q46/which-two-are-valid-choices-for-digital-certificates-when-setting-up-two-way-ssl-between-salesforce-and

No.# B. Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system
A. Use a trusted CA-signed certificate for salesforce and a trusted CA-signed cert for the external system

No.# For inbound integrations with Salesforce that utilize SAML-based single sign-on (SSO), the recommended OAuth flow is the OAuth 2.0 SAML Bearer Assertion Flow. This flow leverages a SAML assertion obtained from the external Identity Provider (IdP) as a credential to authenticate and authorize access to Salesforce.

https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flows.htm&type=5

No.# using self-signed certificates can indeed lead to higher maintenance for the trusting party. This is because the trusting party needs to manually add the self-signed certificate to their truststore, a process that can be time-consuming and error-prone, especially in large environments where many certificates need to be managed

No.# A D
https://help.salesforce.com/s/articleView?id=000383976&language=en_US&type=1

No.# Relay State represents your landing page when the SSO flow is complete.

For IdP-Init flow, Relay State can be hardcoded to be a specific page within the service provider (like a home page).

For SP-Init flow, Relay State is often the link or URL that a user clicked (for example, a link to an Account record in Salesforce) which started the SP-Init flow (i.e. where you originally intended to go).

No.# https://help.salesforce.com/s/articleView?id=xcloud.sso_saml.htm&type=5

No.# JIT doesnt support Deprovisioning. You'll need to perform an API call, in this case SOAP API to deprovision
https://developer.salesforce.com/forums/?id=9060G000000MRYxQAO

No.# https://www.freecram.net/question/Salesforce.Identity-and-Access-Management-Designer.v2022-05-30.q112/northern-trail-outfitters-nto-has-a-requirement-to-ensure-all-user-logins-include-a-single-multi-factor

B is correct, except the setting is actually called something slightly different.
I just now did in my org and its asking for MFA.

"Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org"

No.# The recommended way to configure the IdP for seamless access is to use IdP-initiated SSO that passes the SAML token upon Salesforce resource accessrequest.

This means that the user logs in to the corporate portal first, and then clicks a link to access a Salesforce resource. The IdP sends a SAML response to Salesforce with the user’s identity and other attributes.

Salesforce verifies the SAML response and logs in the user to the appropriate Salesforce org and community.
This way, the user does not have to log in again to Salesforce or enter any credentials

No.# D
For customers to access the off-platform shipping label generator application through the App Launcher, a Salesforce Community License should be recommended. This license allows customers to use the App Launcher and access connected apps like the label generator. The usage of external authentication providers (Facebook, Google) and the OAuth flow in the label generator application further supports the use of a Community License.

Identity Only is for internal users.
External identity license does not give user access to Case / Order object.
Customer Community Plus license is overkill.