Online Access Free Identity-and-Access-Management-Designer Practice Test

Universal Containers (UC) plans to use a SAML-based third-party IdP serving both of the Salesforce Partner Community and the corporate portal. UC partners will log in 65* to the corporate portal to access protected resources, including links to Salesforce resources. What would be the recommended way to configure the IdP so that seamless access can be achieved in this scenario?

• A.Set up the corporate portal as a Connected App in Salesforce and use the User Agent OAuth flow.
• B.Configure SP-initiated SSO that passes the SAML token upon Salesforce resource access request.
• C.Configure IdP-initiated SSO that passes the SAML token upon Salesforce resource access request.
• D.Set up the corporate portal as a Connected App in Salesforce and use the Web server OAuth flow.

An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenano?

• A.When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
• B.When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.
• C.Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.
• D.If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.

Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce?
Choose 2 answers

• A.Enable My Domain and select "Prevent login from https://login.salesforce.com".
• B.Assign user "is Single Sign-on Enabled" permission via profile or permission set.
• C.Request Salesforce Support to enable delegated authentication.
• D.Once SSO is enabled, users are only able to login using Salesforce credentials.

Universal Containers (UC) wants its closed Won opportunities to be synced to a Data Warehouse in near real time. UC has implemented Outbound Message to enable near real-time data sync. UC wants to ensure that communication between Salesforce and Target System is Secure. What Certificate is sent along with the Outbound Message?

• A.The CA-Signed Certificate from the Certificate and Key Management menu.
• B.The Self-Signed Certificates from the Certificate & Key Management menu.
• C.The default Client Certificate or a Certificate from Certificate and Key Management menu.
• D.The default Client Certificate from the Develop--> API Menu.

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

• A.use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.
• B.Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.
• C.Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.
• D.Configure an authentication provider to delegate authentication to the LDAP directory.