Identity-and-Access-Management-Architect: Salesforce Certified Identity and Access Management Architect (SU23) Login Practice Questions

Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?

• AA. Include client ID and client secret in the login header callout.
• BB. Set up a proxy server for the login service in the DMZ.
• CC. Require the use of Salesforce security Tokens on password.
• DD. Enforce mutual Authentication between systems using SSL.

A large consumer company is planning to create a community and will requ.re login through the customers social identity. The following requirements must be met: * 1. The customer should be able to login with any of their social identities, however salesforce should only have one user per customer. * 2. Once the customer has been identified with a social identity, they should not be required to authonze Salesforce. * 3. The customers personal details from the social sign on need to be captured when the customer logs into Salesforce using their social Identity. * 3. If the customer modifies their personal details in the social site, the changes should be updated in Salesforce. Which two options allow the Identity Architect to fulfill the requirements? Choose 2 answers

Select 2 answers.

• AA. Use Login Flows to call an authentication registration handler to provision the user before logging the user into the community.
• BB. Use authentication providers for social sign-on and use the custom registration handler to insert or update personal details.
• CC. Redirect the user to a custom page that allows the user to select an existing social identity for login.
• DD. Use the custom registration handler to link social identities to Salesforce identities.

A global company's Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) 'Replay Detected and Assertion Invalid' login errors. Which two issues would cause these errors? Choose 2 answers

Select 2 answers.

• AA. The subject element is missing from the assertion sent to salesforce.
• BB. The certificate loaded into SSO configuration does not match the certificate used by the IdP.
• CC. The current time setting of the company's identity provider (IdP) and Salesforce platform is out of sync by more than eight minutes.
• DD. The assertion sent to 5alesforce contains an assertion ID previously used.