Practice Identity-and-Access-Management-Architect Exam Online

Question 1

A technology enterprise is setting up an identity solution with an external vendors wellness application for its

employees. The user attributes need to be returned to the wellness application in an ID token.

Which authentication mechanism should an identity architect recommend to meet the requirements?

A : OpenID Connect

B : User Agent Flow

C : JWT Bearer Token Flow

D : Web Server Flow

Answer: D

Question 2

Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would like

to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to

achieve the goal?

A :

Access Tokens

B :

Mobile pins

C : Refresh Tokens

D : Scopes

Answer: D

Question 3

Universal containers (UC) is building a mobile application that will make calls to the salesforce REST API.

Additionally UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes

should UC configure in the connected App? Choose 2 answers

A :

Refresh token

B : API

C : full

D : Web

Answer: A,B

Question 4

What information does the 'Relaystate' parameter contain in sp-Initiated Single Sign-on?

A : Reference to a URL redirect parameter at the identity provider.

B : Reference to a URL redirect parameter at the service provider.

C : Reference to the login address URL of the service provider.

D : Reference to the login address URL of the identity Provider.

Answer: B

Question 5

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in

the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application

support teams to finish user deactivations. A terminated employee recently was able to login to NTO's

Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP

directory.

What should an identity architect recommend to prevent this from happening in the future?

A : Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

B : Configure an authentication provider to delegate authentication to the LDAP directory.

C : use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

D : Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Answer: B

Name:	Salesforce Certified Identity and Access Management Architect( WI24)
Exam Code:	Identity-and-Access-Management-Architect
Certification:	Salesforce Architect
Vendor:	Salesforce
Total Questions:	250
Last Updated:	Apr 24, 2024

Salesforce Identity-and-Access-Management-Architect