Free Certified Identity and Access Management Designer Exam Questions and Answers

Universal Container's (UC) is using Salesforce Experience Cloud site for its container wholesale business. The identity architect wants to an authentication provider for the new site. Which two options should be utilized in creating an authentication provider? Choose 2 answers

Select 2 answers.

• AA. A custom registration handier can be set.
• BB. A custom error URL can be set.
• CC. The default login user can be set.
• DD. The default authentication provider certificate can be set.

A farming enterprise offers smart farming technology to rts farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropnate way to generate sensor Information In Salesforce. Which OAuth flow should the architect recommend?

• AA. OAuth 2.0 Asset Token Flow
• BB. OAuth 2.0 Device Authentication Row
• CC. OAuth 2.0 JWT Bearer Token Flow
• DD. OAuth 2.0 SAML Bearer Assertion Flow

Universal Containers (UC) is both a Salesforce and Google Apps customer. The UC IT team would like to manage the users for both systems in a single place to reduce administrative burden. Which two optimal ways can the IT team provision users and allow Single Sign-on between Salesforce and Google Apps ? Choose 2 answers

Select 2 answers.

• AA. Build a custom app running on Heroku as the Identity Provider that can sync user information between Salesforce and Google Apps.
• BB. Use a third-party product as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.
• CC. Use Identity Connect as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.
• DD. Use Salesforce as the Identity Provider and Google Apps as a Service Provider and configure User Provisioning for Connected Apps.

Northern Trail Outfitters (NTO) is planning to roll out a partner portal for its distributors using Experience Cloud. NTO would like to use an external identity provider (idP) and for partners to register for access to the portal. Each partner should be allowed to register only once to avoid duplicate accounts with Salesforce. What should a identity architect recommend to create partners?

• AA. On successful creation of Partners using Self Registration page in Experience Cloud, create identity in Ping.
• BB. Create a custom page m Experience Cloud to self register partner with Experience Cloud and Ping identity store.
• CC. Create a custom web page in the Portal and create users in the IdP and Experience Cloud using published APIs.
• DD. Allow partners to register through the IdP and create partner users in Salesforce through an API.

Universal containers (UC) wants to implement Delegated Authentication for a certain subset of Salesforce users. Which three items should UC take into consideration while building the Web service to handle the Delegated Authentication request? Choose 3 answers

Select 3 answers.

• AA. The web service needs to include Source IP as a method parameter.
• BB. UC should whitelist all salesforce ip ranges on their corporate firewall.
• CC. The web service can be written using either the soap or rest protocol.
• DD. Delegated Authentication is enabled for the system administrator profile.
• EE. The return type of the Web service method should be a Boolean value

An Architect needs to advise the team that manages the Identity Provider how to differentiate Salesforce from other Service Providers. What SAML SSO setting in Salesforce provides this capability?

• AA. Identity Provider Login URL.
• BB. Issuer.
• CC. Entity Id
• DD. SAML Identity Location.

Northern Trail Outfitters is implementing a busmess-to-business (B2B) collaboration site using Salesforce Experience Cloud. The partners will authenticate with an existing identity provider and the solution will utilize Security Assertion Markup Language (SAML) to provide single sign-on to Salesforce. Delegated administration will be used in the Expenence Cloud site to allow the partners to administer their users' access. How should a partner identity be provisioned in Salesforce for this solution?

• AA. Create only a contact.
• BB. Create a contactless user.
• CC. Create a user and a related contact.
• DD. Create a person account.

Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose. Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication? Choose 2 answers

Select 2 answers.

• AA. Salesforce license for sales users and Identity license for Marketing users
• BB. Salesforce license for sales users and External Identity license for Marketing users
• CC. Identity license for sales users and Identity connect license for Marketing users
• DD. Salesforce license for sales users and platform license for Marketing users.

Universal containers (UC) has decided to use identity connect as it's identity provider. UC uses active directory(AD) and has a team that is very familiar and comfortable with managing ad groups. UC would like to use AD groups to help configure salesforce users. Which three actions can AD groups control through identity connect? Choose 3 answers

Select 3 answers.

• AA. Public Group Assignment
• BB. Granting report folder access
• CC. Role Assignment
• DD. Custom permission assignment
• EE. Permission sets assignment

Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce? Choose 2 answers

Select 2 answers.

• AA. Enable My Domain and select "Prevent login from https://login.salesforce.com".
• BB. Request Salesforce Support to enable delegated authentication.
• CC. Once SSO is enabled, users are only able to login using Salesforce credentials.
• DD. Assign user "is Single Sign-on Enabled" permission via profile or permission set.