Pass Guaranteed Quiz 2026 Realistic Verified Free Identity-and-Access-Management-Architect Exam Dumps [Q96-Q112]

5/5 - (1 vote)

Pass Guaranteed Quiz 2026 Realistic Verified Free Identity-and-Access-Management-Architect Exam Dumps

Free Identity and Access Management Designer Identity-and-Access-Management-Architect Ultimate Study Guide (Updated 244 Questions)

To earn the Salesforce Certified Identity and Access Management Architect certification, candidates must have a thorough understanding of Salesforce’s identity and access management architecture, including authentication, authorization, and single sign-on (SSO) mechanisms. They must also be familiar with Salesforce’s user management and security features, as well as its integration capabilities with third-party identity providers.

NEW QUESTION 96
Universal Containers (UC) would like to enable self-registration for their Salesforce Partner Community Users. UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate Profile and Account values.
Which two actions should the Architect recommend to UC1
Choose 2 answers

Configure Registration for Communities to use a custom Visualforce Page.

Modify the SelfRegistration trigger to assign Profile and Account.

Modify the CommunitiesSelfRegController to assign the Profile and Account.

Configure Registration for Communitiesto use a custom Apex Controller.

NEW QUESTION 97
Which two capabilities does My Domain enable in the context of a SAML SSOconfiguration? Choose 2 answers

App Launcher

Resource deep linking

SSO from Salesforce Mobile App

NEW QUESTION 98
An architect needs to set up a Facebook Authentication provider as login option for a salesforce customer Community. What portion of the authentication provider setup associates a Facebook user with a salesforce user?

Consumer key and consumer secret

Federation ID

User info endpoint URL

Apex registration handler

NEW QUESTION 99
Under which scenario Web Server flow will be used?

Used for web applications when server-side code needs to interact with APIS.

Used for server-side components when page needs to be rendered.

Used for mobile applications and testing legacy Integrations.

Used for verifying Access protected resources.

NEW QUESTION 100
The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.
What should be used and considered before recommending it as a solution on the Salesforce Platform?

OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.

Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.

Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.

Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.

NEW QUESTION 101
Universal Containers (UC) uses Global Shipping (GS) as one of their shipping vendors. Regional leads of GS need access to UC’s Salesforce instance for reporting damage of goods using Cases. The regional leads also need access to dashboards to keep track of regional shipping KPIs. UC internally uses a third-party cloud analytics tool for capacity planning and UC decided to provide access to this tool to a subset of GS employees.
In addition to regional leads, the GS capacity planning team would benefit from access to this tool. To access the analytics tool, UC IT has set up Salesforce as the Identity provider for Internal users and would like to follow the same approach for the GS users as well. What are the most appropriate license types for GS Tregional Leads and the GS Capacity Planners? Choose 2 Answers

Customer Community Plus license for GS Regional Leads and External Identity for GS Capacity Planners.

Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.

Identity Licence for GS Regional Leads and External Identity license for GS capacity Planners.

Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.

NEW QUESTION 102
In an SP-Initiated SAML SSO setup where the user tries to access a resource on the Service Provider, What HTTP param should be used when submitting a SAML Request to the Idp to ensure the user is returned to the intended resourse after authentication?

RedirectURL

RelayState

DisplayState

StartURL

NEW QUESTION 103
Universal Containers (UC) wants to integrate a third-party Reward Calculation system with Salesforce to calculate Rewards. Rewards will be calculated on a schedule basis and update back into Salesforce. The integration between Salesforce and the Reward Calculation System needs to be secure. Which are two recommended practices for using OAuth flow in this scenario. choose 2 answers

OAuth Refresh Token FLow

OAuth Username-Password Flow

OAuth SAML Bearer Assertion FLow

OAuth JWT Bearer Token FLow

NEW QUESTION 104
Northern Trail Outfitters (NTO) is planning to build a new customer service portal and wants to use passwordlesslogin, allowing customers to login with a one-time passcode sent to them via email or SMS.
How should the quantity of required Identity Verification Credits be estimated?

Each community comes with 10,000 Identity Verification Credits per month and onlycustomers with more than 10,000 logins a month should estimate additional SMS verifications needed.

Identity Verification Credits are consumed with each SMS (text message) sent and should be estimated based on the number of login verification challengesfor SMS verification users.

Identity Verification Credits are consumed with each verification sent and should be estimated based on the number of loginsthat will incur a verification challenge.

Identity Verification Credits are a direct add-on license based on the number of existing member-based or login-based Community licenses.

NEW QUESTION 105
A group of userstry to access one of universal containers connected apps and receive the following error message: “Failed : Not approved for access”. what is most likely to cause of the issue?

The use of high assurance sections are required for the connected App.

The users do not have the correct permission set assigned to them.

The connected App setting “All users may self-authorize” is enabled.

The salesforce administrators gave revoked the Oauth authorization.

NEW QUESTION 106
Universal Containers (UC) is rolling out its new Customer Identity and Access Management Solution built on top of its existing Salesforce instance. UC wants to allow customers to login using Facebook, Google, and other social sign-on providers.
How should this functionality be enabled for UC, assuming ail social sign-on providers support OpenID Connect?

Configure an authentication provider and a registration handler for each social sign-on provider.

Configure a single sign-on setting and a registration handler for each social sign-on provider.

Configure an authentication provider and a Just-In-Time (JIT) handler for each social sign-on provider.

Configure a single sign-on setting and a JIT handler for each social sign-on provider.

NEW QUESTION 107
Universal Containers (UC) is building an integration between Salesforce and a legacy web application using the canvas framework. The security for UC has determined that asigned request from Salesforce is not an adequate authentication solution for the Third-Party app. Which two options should the Architect consider for authenticating the third-party app using the canvas framework? Choose 2 Answers

Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC’s IdP.

Utilize Authorization Providers to allow the third-party application to authenticate itself against Salesforce as the Idp.

Utilize Canvas OAuth flow to allow the third-party application to authenticate itself against Salesforce as the Idp.

Create a registration handler Apex class to allow the third-party application to authenticate itself against Salesforce as the Idp.

NEW QUESTION 108
Universal Containers is creating a web application that will be secured by Salesforce Identity using the OAuth
2.0 Web Server Flow uses the OAuth 2.0 authorization code grant type).
Which three OAuth concepts apply to this flow?
Choose 3 answers

Verification URL

Client Secret

Access Token

Scopes

NEW QUESTION 109
An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?

Users once logged In, can go to the Change Password screen in Salesforce.

Users can click on the “Forgot your Password” link on the Salesforce.com login page.

Users can request the Salesforce Admin to reset their password.

Users can change it on the enterprise LDAP authentication portal.

NEW QUESTION 110
Northern Trail Outfitters (NTO) uses Salesforce for Sales Opportunity Management. Okta was recently brought in to Just-in-Time (JIT) provision and authenticate NTO users to applications. Salesforce users also use Okta to authorize a Forecasting web application to access Salesforce records on their behalf.
Which two roles are being performed by Salesforce?
Choose 2 answers

SAML Identity Provider

OAuth Client

OAuth Resource Server

SAML Service Provider

NEW QUESTION 111
What item should an Architect consider when designing a Delegated Authentication implementation?

The Web service should be secured with TLS using Salesforce trusted certificates.

The Web service should be able to accept one to four input method parameters.

The web service should use the Salesforce Federation ID to identify the user.

The Web service should implement a custom password decryption method.

NEW QUESTION 112
Which three types of attacks would a 2-Factor Authentication solution help garden against?

Key logging attacks

Network perimeter attacks

Phishing attacks

Dictionary attacks

Man-in-the-middle attacks

Explanation
A 2-Factor Authentication (2FA) solution is a type of multi-factor authentication (MFA) that requires users to provide two verification factors to access a system or application. The verification factors can be something the user knows (e.g., password), something the user has (e.g., phone), or something the user is (e.g., fingerprint). A 2FA solution can help prevent common cyberattacks that rely on stealing or guessing passwords, such as:
Key logging attacks: These are attacks where a malicious program records the keystrokes of a user, including their passwords, and sends them to the attacker. A 2FA solution can prevent this attack by requiring an additional factor that is not typed by the user, such as a verification code sent to their phone or a biometric scan.
Phishing attacks: These are attacks where an attacker sends a fake email or website that looks like it came from a trusted source, and tricks the user into providing their credentials or other sensitive information. A 2FA solution can prevent this attack by requiring an additional factor that is not known by the attacker, such as a verification code generated by an authenticator app or a hardware token.
Dictionary attacks: These are attacks where an attacker tries to guess a user’s password by using a list of common or likely passwords, such as “password” or “123456”. A 2FA solution can prevent this attack by requiring an additional factor that is not based on a password, such as a fingerprint scan or a facial recognition.
A man-in-the-middle attack is when an attacker intercepts and alters the communication between two parties, such as a user and a website. A 2-Factor Authentication solution can help prevent this type of attack by requiring a second factor of authentication that the attacker cannot access or spoof, such as a code sent to the user’s phone or a hardware token References: 1: What Is Two-Factor Authentication (2FA)? | Microsoft Security 2: What type of attacks does Multi-Factor Authentication prevent?