Free Identity-and-Access-Management-Architect: Salesforce Certified Identity and Access Management Architect (SU23) Exam Questions and Answers
203 verified practice questions for Identity-and-Access-Management-Architect.
The first 10 questions on this page are free to read, answers included — no account and no card. A plan opens the rest of the bank, the full timed practice test and your weak-topic reporting.
Last updated: September 19, 2026
- Provider
- Salesforce
- Questions in our bank
- 1000+
- Free to read
- First 10, with answers
- Our test mode duration & pass mark
- 130 mins · 70%
- Verified answers
- Reviewed weekly
- Practice format
- Multiple choice
Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.
Question #1
In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?
Please select an optionIncorrectCorrect answer: D
D is correct because using a self-signed certificate leads to higher maintenance for the trusting party, which is the client or browser that connects to the server. The trusting party needs to add the self-signed certificate to their truststore, which is a repository of trusted certificates, in order to establish a secure connection with the server. Otherwise, the trusting party will see a warning message or an error when accessing the server. A is incorrect because using a self-signed certificate leads to higher maintenance for the trusted party, not lower. The trusted party needs to maintain multiple self- signed certificates from different servers in their truststore. B is incorrect because using a self-signed certificate does not make the trusted party act as the trusted CA (Certificate Authority). The trusted CA is the entity that issues and validates certificates for servers. The trusted party only needs to trust the CA’s root certificate, which is usually pre-installed in their truststore. C is incorrect because using a self-signed certificate leads to higher maintenance for the trusting party, not lower. The trusting party still needs to maintain a trusted CA cert in their truststore, which is the self-signed certificate itself. References: 1: SSL Certificate Installation Instructions & Tutorials - DigiCert 2: How To Install an SSL Certificate from a Commercial … - DigitalOcean 3: Setup SSL CSR Creation and SSL Certificate Installatio - DigiCert
Was this answer correct?Question #2
Which three are features of federated Single sign-on solutions? Choose 3 Answers
Select 3 answers.
Please select an optionIncorrectCorrect answer: A, D, E
It federates credentials control to authorized applications. This means that users can access multiple applications across different domains or organizations using one set of credentials, without having to share their passwords with each application1. The applications rely on a trusted identity provider (IdP) to authenticate the users and grant them access. It establishes trust between Identity store and service provider. This means that the IdP and the service provider (SP) have a mutual agreement to exchange identity information using standard protocols, such as SAML, OpenID Connect, or OAuth2. The IdP and the SP also share metadata and certificates to ensure secure communication and verification. It improves affiliated applications adoption rates. This means that users are more likely to use applications that are connected to their existing identity provider, as they do not have to create or remember multiple passwords3. This also reduces the friction and frustration of logging in to different applications, and enhances the user experience. The other options are not features of federated single sign-on solutions because: It solves all identity and access management problems. This is false, as federated single sign-on solutions only address the authentication aspect of identity and access management, not the authorization, provisioning, governance, or auditing aspects. Federated single sign-on solutions also have some challenges, such as complexity, interoperability, and security risks. It enables quick and easy provisioning and deactivating of users. This is not necessarily true, as federated single sign-on solutions do not automatically create or delete user accounts in the service provider applications. Users still need to be provisioned and deprovisioned manually or through other mechanisms, such as just-in-time provisioning or SCIM. References: Federated Identity Management vs. Single Sign-On: What’s the Difference?, What is single sign-on?, Single Sign-On (SSO) Solution, [Identity Management vs. Access Management: What’s the Difference?], [Federated Identity Management Challenges], [Just-in-Time Provisioning for SAML], [SCIM User Provisioning]
Was this answer correct?Question #3
Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?
Please select an optionIncorrectCorrect answer: D
To enable a trusted connection between the login services and Salesforce, UC should enforce mutual authentication between systems using SSL. Mutual authentication is a process in which both parties in a communication verify each other’s identity using certificates7. SSL (Secure Sockets Layer) is a protocol that provides secure communication over the Internet using encryption and certificates8. By using mutual authentication with SSL, UC can ensure that only authorized login services can access Salesforce and vice versa. This can prevent unauthorized access, impersonation, or phishing attacks. References: Mutual Authentication, SSL (Secure Sockets Layer)
Was this answer correct?Question #4
Universal Containers (UC) is building an authenticated Customer Community for its customers. UC does not want customer credentials stored in Salesforce and is confident its customers would be willing to use their social media credentials to authenticate to the community. Which two actions should an Architect recommend UC to take?
Select 2 answers.
Please select an optionIncorrectCorrect answer: B, C
Configuring an Authentication Provider for LinkedIn Social Media Accounts allows UC to use LinkedIn as an external identity provider for its customer community. This means that customers can use their LinkedIn credentials to log in to the community without storing their credentials in Salesforce. Creating a Custom Apex Registration Handler allows UC to customize how new and existing users are handled when they log in with an external identity provider. This means that UC can control how user records are created, updated, or matched when customers use their social media credentials to authenticate to the community. These two actions can meet the requirement of UC to use social media credentials for its customer community.
Was this answer correct?Question #5
Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers
Select 2 answers.
Please select an optionIncorrectCorrect answer: B, C
The two risks that the architect should point out for using delegated authentication as the sole means of authenticating Salesforce users are: UC will be required to develop and support a custom SOAP web service. Delegated authentication is a feature that allows Salesforce to delegate the authentication process to an external service by making a SOAP callout to a web service that verifies the user’s credentials. This feature requires UC to develop and support a custom SOAP web service that can accept and validate the user’s username and password, and return a boolean value to indicate whether the authentication is successful or not. This could increase complexity and cost for UC, as they need to write custom code and maintain the web service. Salesforce users will be locked out of Salesforce if the web service goes down. Delegated authentication relies on the availability and performance of the external web service that handles the authentication requests from Salesforce. If the web service goes down or becomes slow, Salesforce users will not be able to log in or access Salesforce, as they will receive an error message or a timeout response. This could cause disruption and frustration for UC’s business operations and user satisfaction. The other options are not valid risks for using delegated authentication. Delegated authentication can be enabled or disabled for individual users or groups of users by using permission sets or profiles, not for the entire Salesforce org. The web service does not need to reside on a public cloud service, such as Heroku, as it can be hosted on any platform that supports SOAP services and can communicate with Salesforce. References: [Delegated Authentication], [Enable ‘Delegated Authentication’], [Troubleshoot Delegated Authentication]
Was this answer correct?Question #6
Universal Containers (UC) wants to integrate a third-party Reward Calculation system with Salesforce to calculate Rewards. Rewards will be calculated on a schedule basis and update back into Salesforce. The integration between Salesforce and the Reward Calculation System needs to be secure. Which are two recommended practices for using OAuth flow in this scenario. choose 2 answers
Select 2 answers.
Please select an optionIncorrectCorrect answer: C, D
OAuth is an open-standard protocol that allows a client app to access protected resources on a resource server, such as Salesforce API, by obtaining an access token from an authorization server. OAuth supports different types of flows, which are ways of obtaining an access token. For integrating a third-party Reward Calculation system with Salesforce securely, two recommended practices for using OAuth flow are: OAuth SAML Bearer Assertion Flow, which allows the client app to use a SAML assertion issued by a trusted identity provider to request an access token from Salesforce. This flow does not require the client app to store any credentials or secrets, and leverages the existing SSO infrastructure between Salesforce and the identity provider. OAuth JWT Bearer Token Flow, which allows the client app to use a JSON Web Token (JWT) signed by a private key to request an access token from Salesforce. This flow does not require any user interaction or consent, and uses a certificate to verify the identity of the client app. Verified References: [OAuth 2.0 SAML Bearer Assertion Flow for Server-to-Server Integration], [OAuth 2.0 JWT Bearer Token Flow for Server-to-Server Integration]
Was this answer correct?Question #7
Northern Trail Outfitters (NTO) uses Salesforce for Sales Opportunity Management. Okta was recently brought in to Just-in-Time (JIT) provision and authenticate NTO users to applications. Salesforce users also use Okta to authorize a Forecasting web application to access Salesforce records on their behalf. Which two roles are being performed by Salesforce? Choose 2 answers
Select 2 answers.
Please select an optionIncorrectCorrect answer: C, D
Salesforce acts as an OAuth client when it uses Okta to authorize a Forecasting web application to access Salesforce records on behalf of the user. Salesforce acts as a SAML service provider when it accepts SAML assertions from Okta to authenticate NTO users. References: OAuth 2.0 Web Server Authentication Flow, SAML Single Sign-On Overview
Was this answer correct?Question #8
A large consumer company is planning to create a community and will requ.re login through the customers social identity. The following requirements must be met: * 1. The customer should be able to login with any of their social identities, however salesforce should only have one user per customer. * 2. Once the customer has been identified with a social identity, they should not be required to authonze Salesforce. * 3. The customers personal details from the social sign on need to be captured when the customer logs into Salesforce using their social Identity. * 3. If the customer modifies their personal details in the social site, the changes should be updated in Salesforce. Which two options allow the Identity Architect to fulfill the requirements? Choose 2 answers
Select 2 answers.
Please select an optionIncorrectCorrect answer: B, D
To allow customers to log in to the community with any of their social identities, such as Facebook, Google, or Twitter, the identity architect needs to use authentication providers for social sign-on. Authentication providers are configurations that enable users to authenticate with an external identity provider and access Salesforce resources. To ensure that Salesforce has only one user per customer, regardless of how many social identities they have, the identity architect needs to use the custom registration handler to link social identities to Salesforce identities. The custom registration handler is a class that implements the Auth.RegistrationHandler interface and defines how to create or update users in Salesforce based on the information from the external identity provider. The custom registration handler can also be used to insert or update personal details of the customers when they log in to Salesforce using their social identity. References: Authentication Providers, Social Sign-On with Authentication Providers, Create a Custom Registration Handler
Was this answer correct?Question #9
A global company's Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) 'Replay Detected and Assertion Invalid' login errors. Which two issues would cause these errors? Choose 2 answers
Select 2 answers.
Please select an optionIncorrectCorrect answer: C, D
A SAML SSO ‘Replay Detected and Assertion Invalid’ error occurs when Salesforce detects that the same assertion has been used more than once within the validity period. This can happen if the assertion ID is reused by the IdP or if the assertion is resent by the user. Another possible cause is that the time settings of the IdP and Salesforce are not synchronized, which can result in an assertion being valid for a shorter or longer period than expected. References: SAML Single Sign-On Settings, Troubleshoot SAML Single Sign-On
Was this answer correct?Question #10
Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless experience. The third-party employee portal only supports OAuth. What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?
Please select an optionIncorrectCorrect answer: B
Configuring SSO to use the third-party portal as an identity provider is the best option to enable SSO between the portal and Salesforce. The portal can use OAuth as the protocol to authenticate users and redirect them to Salesforce. The other options are either not feasible or not relevant for this use case. References: Single Sign-On for Desktop and Mobile Applications using SAML and OAuth, Single Sign-On with SAML on Force.com
Was this answer correct?
Continue with Identity-and-Access-Management-Architect: Salesforce Certified Identity and Access Management Architect (SU23)
Unlock the full question bank
You have read the first 10 questions. A subscription opens every question in Identity-and-Access-Management-Architect: Salesforce Certified Identity and Access Management Architect (SU23), the full timed practice test, and your progress and weak-topic reporting.
Single exam
$19.99for 30 days
Full question bank and practice test for one exam, for 30 days.
Single exam
$49.99for 1 year
One exam for a full year. Nothing renews and nothing to cancel.
Full access
$39.99/mo
Every exam in the catalogue, month to month.
Full access
$199.99/yr
Every exam in the catalogue for a year.
Already subscribed? Sign in to pick up where you left off.
Other Salesforce certifications
- ADM-201: Administration Essentials for New Admins (opens in a new tab)
- Certified Sales Cloud Consultant (opens in a new tab)
- Certified Platform Developer II (opens in a new tab)
- ADM-211: Administration Essentials for Experienced Admin (opens in a new tab)
- Certified Platform App Builder (opens in a new tab)
- CRT-450: Salesforce Certified Platform Developer I (opens in a new tab)
Reviews
★★★★★
This platform is a lifesaver. The practice questions and explanations are so detailed. It’s the best study tool I’ve ever used.
Hannah Smith
USA
★★★★★
I highly recommend Exam Practice. The feedback after each test helped me improve significantly, and I passed my exams easily.
Oscar Nyström
Sweden
★★★★★
Exam Practice is worth every penny. The mock exams are realistic, and the feedback helped me focus on key areas.
Amit Sharma
India
FAQ
Learn More: https://trailhead.salesforce.com/en/credentials/administratoroverview/
- Q1: What are Salesforce Certification Exams?
- A: Salesforce Certification Exams validate your expertise in using and managing Salesforce’s customer relationship management (CRM) platform. These certifications demonstrate your proficiency in deploying, configuring, and optimizing Salesforce applications to drive business growth and customer engagement.
- Q2: Why should I pursue Salesforce Certification?
- A: Salesforce Certification enhances your professional credibility, showcasing your skills and knowledge in Salesforce solutions. This can lead to better job opportunities, higher salaries, and career advancement in CRM, cloud computing, and IT management roles.
- Q3: What are the benefits of Salesforce Certification?
- A: Benefits include recognition as a certified Salesforce professional, improved job performance, access to exclusive resources, continuing education opportunities, and staying current with the latest Salesforce technologies and best practices.
- Q4: Who should take Salesforce Certification Exams?
- A: CRM administrators, developers, consultants, sales and marketing professionals, and anyone involved in managing and implementing Salesforce solutions should consider these certifications to validate their expertise and advance their careers.
- Q5: What types of Salesforce Certification Exams are available?
- A: Salesforce offers various certification paths, including:
- Q6: How do I prepare for Salesforce Certification Exams?
- A: Preparation can include official Salesforce training courses, study guides, practice exams, online tutorials, and hands-on experience with Salesforce products and solutions.
- Q7: Where can I take Salesforce Certification Exams?
- A: Salesforce Certification Exams can be taken online with remote proctoring or at authorized testing centers worldwide, providing flexibility to fit your schedule and location.
- Q8: How do Salesforce Certifications impact my career?
- A: Salesforce Certifications significantly boost your career by demonstrating your expertise to employers, making you a more competitive candidate for advanced roles and promotions in CRM, cloud computing, and IT management.
- Q9: Are there any prerequisites for Salesforce Certification Exams?
- A: Some exams may have prerequisites, such as foundational knowledge or prior experience with Salesforce products. Check the specific requirements for each certification path on the Salesforce certification website.
- Q10: How often do I need to recertify for Salesforce Certifications?
- A: Salesforce Certifications typically require recertification annually to ensure that certified professionals stay updated with the latest Salesforce technologies and industry practices.