Online Access Free Identity-and-Access-Management-Designer Exam Questions

No.# A - SAML assertion Oauth flow

No.# A is correct because SF is used to authenticate users meaning SF is identity provider. So if user uses login flow --> then it can call Helpdesk to find the status and create user in SF.

No.# Answer is A ....external identity license does not give user access to Case / Order object

No.# B and C is the right answer as it is asking which SF features provides Username / password capabilities . App Launcher is not a SF feature.

I passed the Identity-and-Access-Management-Designer with perfect score.

No.# A is wrong because a login flow would not be triggered until a user tries to login. The requirement says the user should be created as soon as they are approved. Plus login flows are not meant for JIT.
B is wrong because the helpdesk is not the idp so it can't initiate idp initiated JIT. Plus JIT is only done when the user attempts to login, not immediately when the help desk approves the user.
C - it's certainly possible to create users via soap or rest. Doesn't seem like an ideal answer, but it's the only valid option.
D is wrong because Salesforce connect is not used for creating users, it's used to access external data which is configured as an external object in Salesforce.

No.# Assuming the user is logging into Salesforce via SSO, the correct answer is RelayState
https://help.salesforce.com/s/articleView?id=sf.sso_saml_start_stop_pages.htm&type=5

redirect_url is configured at the connected app level and is not specific to a specific Idea or other record in Salesforce.
https://trailhead.salesforce.com/content/learn/projects/build-a-connected-app-for-api-integration/implement-the-oauth-20-web-server-authentication-flow

No.# Not a great question.
A is wrong since session timeout should mitigate this, not MFA
B is wrong because you can still use Salesforce from a public wifi even with MFA
C is wrong because this could be mitigated without MFA, by enforcing password policies.
D is wrong because they can still use their Facebook password even with MFA

Okay I guess B and D are still the best answers, because even though users can still do these things which are not secure, adding MFA makes it a little more secure.

No.# I think A, B D, E, are all correct.

Lightning login:
https://help.salesforce.com/s/articleView?id=sf.security_ll_overview.htm&type=5

Lightning Login relies on Salesforce Authenticator (version 2 or later), the multi-factor authentication mobile app that’s available as a free download for iOS and Android devices. By requiring two factors of authentication for login, Lightning Login adds an extra layer of security.

The first factor is something that the user has—for example, a mobile device that has Salesforce Authenticator installed and connected with the user’s Salesforce account.
The second factor is something that the user is, such as a fingerprint, or something that the user knows, such as a PIN. The second level of authentication enhances security by requiring access to the mobile device and the user’s fingerprint or PIN.

SMS: https://help.salesforce.com/s/articleView?id=sf.security_mfa_sms_for_external_users.htm&type=5

Third party: https://help.salesforce.com/s/articleView?id=sf.mfa_supported_verification_methods_totp.htm&type=5

Security Key: https://help.salesforce.com/s/articleView?id=sf.mfa_supported_verification_methods_securitykey.htm&type=5...

No.# This question is outdated since Salesforce requires MFA for all UI logins now.

No.# B. SF is the Idp
D. If the application should be "only visible within Salesforce" then option D Canvas makes sense.
And since Salesforce is the IdP, it makes sense that it would be an IdP initiated session.

No.# JWT and SAML both deal with digital certificates. So they are the best answers.
JWT makes sense because the server to server integration.
But I don't see how SAML makes sense, because I don't think the recruiting system user is logging into Salesforce.
If the recruiting system itself connects via API SSO, it should be SAML Assertion, not SAML Bearer Assertion.

No.# Only C is correct.
A is not correct because it's not secure. But if we have to choose a second option, I would choose A. On the exam we hope to see Web Server or Client Credentials option instead for this scenario.
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_username_password_flow.htm&type=5
B is not correct because SSO is not mentioned in the question, but if SSO did apply, it would be SAML Assertion Flow, not SAML Bearer Assertion
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5
C is correct because JWT applies for server to server. Since it's a scheduled job not initiated by a user, we assume it's server to server.
D is not correct because JWT doesn't support refresh token
https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5

No.# This is a poorly written question. It says it doesn't support SAML. This implies the website is not built on Salesforce Experience Cloud. If Salesforce is not being used as the platform, but Salesforce is needed for authentication, then we would assume it would be an Identity only license
https://help.salesforce.com/s/articleView?id=sf.identity_licenses.htm&type=5

But Identity only license is meant for SSO, which is not supported here. So that would imply maybe C) Delegated Authentication, but Delegate Authentication is documented as a feature for logging into Salesforce with non-Salesforce credentials. Not logging into another application with Salesforce credentials.

So the answer should be B and D.

A. Is wrong because Identity Connect requires Active Directory, and external consumer users would not be in AD.
B. Could be a right answer in the past, but as of Summer '24, it's not supported anymore.
D. Embeded Login requires a connected app, so if B is correct, so is D
https://help.salesforce.com/s/articleView?id=sf.external_identity_login_step_2.htm&type=5...

No.# Ans should be C.
Please See: https://help.salesforce.com/s/articleView?id=000392426&type=1

The service customers are very nice with immediate responses, if you have any questions about the Identity-and-Access-Management-Designer exam materials, don't worry about that for they can explain for you.

No.# Due to nature of 5 possible answers I assume that 3 are correct. A, D, E

No.# Should be B

No.# A & B are correct. You dont have to request authorization anymore.

https://help.salesforce.com/s/articleView?id=sf.sso_enforce_sso_login.htm&type=5

No.# ACDE : https://www.onelogin.com/learn/mfa-types-of-cyber-attacks#:~:text=In%20addition%20to%20combating%20common,to%20access%20the%20target%20account.