Prepare for the Actual Identity and Access Management Designer Identity-and-Access-Management-Architect Exam Practice Materials Collection
Identity and Access Management Designer Certified Official Practice Test Identity-and-Access-Management-Architect - Mar-2026
Salesforce Certified Identity and Access Management Architect certification exam covers a broad range of topics related to identity and access management, including authentication, authorization, single sign-on, federation, password policies, and security protocols. Candidates are expected to have a deep understanding of the Salesforce platform, as well as experience working with complex enterprise environments. Identity-and-Access-Management-Architect exam also assesses a candidate's ability to design and implement identity and access management solutions that meet the unique needs of different types of organizations, such as healthcare, financial services, and government agencies.
NEW QUESTION # 128
A group of users try to access one of universal containers connected apps and receive the following error message : "Failed : Not approved for access". what is most likely to cause of the issue?
- A. The users do not have the correct permission set assigned to them.
- B. The salesforce administrators gave revoked the Oauth authorization.
- C. The use of high assurance sections are required for the connected App.
- D. The connected App setting "All users may self-authorize" is enabled.
Answer: A
NEW QUESTION # 129
A technology enterprise is setting up an identity solution with an external vendors wellness application for its employees. The user attributes need to be returned to the wellness application in an ID token.
Which authentication mechanism should an identity architect recommend to meet the requirements?
- A. JWT Bearer Token Flow
- B. Web Server Flow
- C. OpenID Connect
- D. User Agent Flow
Answer: B
NEW QUESTION # 130
In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?
- A. Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.
- B. Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.
- C. Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA
- D. Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.
Answer: A
NEW QUESTION # 131
Northern Trail Outfitters mar ages functional group permissions in a custom security application supported by a relational database and a REST service layer. Group permissions are mapped as permission sets in Salesforce.
Which action should an identity architect use to ensure functional group permissionsare reflected as permission set assignments?
- A. Use a Login Flow to query SAML attributes and set permission sets.
- B. Use the Apex JIT handler to callout to the security application and set permission sets
- C. Use a Login Flow with invocable Apex to callout to the security application and set permission sets.
- D. Use the Apex Just-in-Time (JIT) handler to query the Security Assertion markup Language (SAML) attributes and set permission sets.
Answer: C
Explanation:
Using a Login Flow with invocable Apex to callout to the security application and set permission sets allows the identity architect to dynamically assign or remove permission sets based on the functional group permissions in the custom security application. This ensures that the permission set assignments are consistent with the group permissions. References: Login Flows, Invocable Apex
NEW QUESTION # 132
The security team at Universal containers(UC) has identified exporting reports as a high-risk action and would like to require users to be logged into salesforce with their active directory (AD) credentialswhen doing so. For all other uses of Salesforce, Users should be allowed to use AD credentials or salesforce credentials.
What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with salesforce credentials?
- A. Use SAML Federated Authentication with a login flow to dynamically add or remove a permission set that grants the export reports permission.
- B. Use SAML Federated Authentication, treat SAML sessions as high assurance, and raise the session level required for exporting reports.
- C. Use SAML Federated Authentication and Custom SAML jit provisioning to dynamically add or remove a permission set that grants the Export Reports permission.
- D. Use SAML Federated Authentication and block access to reports when accesses through a standard assurance session.
Answer: B
Explanation:
Using SAML Federated Authentication, treating SAML sessions as high assurance, and raising the session level required for exporting reports is the solution that should be recommended. This solution ensures that users can only export reports when they log in using AD credentials, which provide a high level of identity verification. Users who log in using Salesforce credentials, which provide a standard level of security, can still view reports but not export them. To implement this solution, you need to configure SAML Federated Authentication withAD as the identity provider4, set the session security level for SAML assertions to high assurance5, and require high-assurance session security for exporting reports1. This solution also avoids the complexity and overhead of creating and managing custom permission sets or login flows.
NEW QUESTION # 133
After a recent audit, universal containers was advised to implement Two-factor Authentication for all of their critical systems, including salesforce. Which two actions should UC consider to meet this requirement?
Choose 2 answers
- A. Require users to provide their RSA token along with their credentials.
- B. Require users to supply their email and phone number, which gets validated.
- C. Require users to enter a second password after the first Authentication
- D. Require users to use a biometric reader as well as their password
Answer: A,D
Explanation:
Explanation
A is correct because requiring users to provide their RSA token along with their credentials is a form of two-factor authentication. An RSA token is a hardware device that generates a one-time password (OTP) that changes every few seconds. The user needs to enter both their password and the OTP to log in to Salesforce.
D is correct because requiring users to use a biometric reader as well as their password is another form of two-factor authentication. A biometric reader is a device that scans a user's fingerprint, face, iris, or other physical characteristics to verify their identity. The user needs to provide both their password and their biometric data to log in to Salesforce.
B is incorrect because requiring users to supply their email and phone number, which gets validated, is not a form of two-factor authentication. This is a form of identity verification, which is used to confirm that the user owns the email and phone number they provided. However, this does not add an extra layer of protection beyond their password when they log in to Salesforce.
C is incorrect because requiring users to enter a second password after the first authentication is not a form of two-factor authentication. This is a form of single-factor authentication, which only relies on something the user knows (their passwords). This does not increase security against unauthorized account access.
References: 4: Multi-Factor Authentication - Salesforce 5: Salesforce Multi-Factor Authentication 6: Two Factor Authentication - Salesforce India 7: Customer 360 | Increase Productivity - Salesforce UK 8: Secure Salesforce Login Using Two-Factor Authentication and Salesforce ...
NEW QUESTION # 134
Universal Containers (UC) is rolling out its new Customer Identity and Access Management Solution built on top of its existing Salesforce instance. UC wants to allow customers to login using Facebook, Google, and other social sign-on providers.
How should this functionality be enabled for UC, assuming ail social sign-on providers support OpenID Connect?
- A. Configure a single sign-on setting and a JIT handler for each social sign-on provider.
- B. Configure an authentication provider and a registration handler for each social sign-on provider.
- C. Configure a single sign-on setting and a registration handler for each social sign-on provider.
- D. Configure an authentication provider and a Just-In-Time (JIT) handler for each social sign-on provider.
Answer: B
Explanation:
Explanation
To allow customers to login using Facebook, Google, and other social sign-on providers, the identity architect should configure an authentication provider and a registration handler for each social sign-on provider.
Authentication providers are configurations that enable users to authenticate with an external identity provider and access Salesforce resources. OpenID Connect is a protocol that allows users to sign in with an external identity provider, such as Facebook or Google, and access Salesforce resources. To enable this, the identity architect needs to configure an OpenID Connect Authentication Provider in Salesforce and link it to a connected app. A registration handler is a class that implements the Auth.RegistrationHandler interface and defines how to create or update users in Salesforce based on the information from the external identity provider. The registration handler can also be used to link the user's social identity with their Salesforce identity and prevent duplicate accounts. References: OpenID Connect Authentication Providers, Social Sign-On with OpenID Connect, Create a Custom Registration Handler
NEW QUESTION # 135
A global company has built an external application that uses data from its Salesforce org via an OAuth 2.0 authorization flow. Upon logout, the existing Salesforce OAuth token must be invalidated.
Which action will accomplish this?
- A. Enable Single Logout with a secure logout URL.
- B. Use a HTTP POST to request the refresh token for the current user.
- C. Use a HTTP POST to make a call to the revoke token endpoint.
- D. Use a HTTP POST to the System for Cross-domain Identity Management (SCIM) endpoint, including the current OAuth token.
Answer: C
NEW QUESTION # 136
An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?
- A. Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to "User may self authorize".
- B. Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to 'Admin Pre-Approved".
- C. Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to "Admin Pre-Approved".
- D. Enable the Full Access Scope and then set the connected app access settings to "Admin Pre-Approved".
Answer: C
Explanation:
JWT Bearer Flow is an OAuth 2.0 flow that allows a client app to obtain an access token without user interaction. It requires a certificate to sign the JWT and the API and Offline Access scopes to access the Salesforce REST API and refresh the token. The connected app must also be pre-approved by the admin to avoid the OAuth approval page. References: OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration, Authorize an Org Using the JWT Flow
NEW QUESTION # 137
Universal Containers is creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow. Application users will authenticate using username and password. They should not be forced to approve API access in the mobile app or reauthenticate for 3 months.
Which two connected app options need to be configured to fulfill this use case?
Choose 2 answers
- A. Set Permitted Users to "Admin approved users are pre-authorized".
- B. Set the Session Timeout value to 3 months.
- C. Set the Refresh Token Policy to expire refresh token after 3 months.
- D. Set Permitted Users to "All users may self-authorize".
Answer: C,D
Explanation:
Explanation
To fulfill the use case of creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow, where users will authenticate using username and password and not be forced to approve API access or reauthenticate for 3 months, the identity architect should configure two connected app options:
Set Permitted Users to "All users may self-authorize". Permitted Users is a setting that controls how users can access a connected app. By setting it to "All users may self-authorize", the identity architect can allow users to access the connected app without requiring administrator approval or API access confirmation.
Set the Refresh Token Policy to expire refresh token after 3 months. Refresh Token Policy is a setting that controls how long a refresh token can be used to obtain a new access token without requiring user authentication. By setting it to expire refresh token after 3 months, the identity architect can allow users to access the connected app for 3 months without reauthenticating, as long as they use the app at least once every 90 days. References: Connected Apps, OAuth 2.0 User-Agent Flow
NEW QUESTION # 138
An administrator created a connected app for a custom wet) application in Salesforce which needs to be visible as a tile in App Launcher The tile for the custom web application is missing in the app launcher for all users in Salesforce. The administrator requested assistance from an identity architect to resolve the issue.
Which two reasons are the source of the issue?
Choose 2 answers
- A. OAuth scope does not include "openid*.
- B. StartURL for the connected app is not set in Connected App settings.
- C. The connected app is not set in the App menu as 'Visible in App Launcher".
- D. Session Policy is set as 'High Assurance Session required' for this connected app.
Answer: B,D
NEW QUESTION # 139
A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS . The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.
What is recommended to ensure these requirements are met ?
- A. Add a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.
- B. Use connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.
- C. Configure Each ADFSsystem under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-
- D. Implement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.
Answer: D
Explanation:
To have all of its user's access Salesforce using the ADFS, the multinational company should implement Identity Connect to provide single sign-on to Salesforce and federate across multiple ADFS systems. Identity Connect is a tool that synchronizes user data between Microsoft Active Directory and Salesforce. It allowssingle sign-on and federation between multiple Active Directory domains and a single Salesforce org.
Identity Connect can also handle user provisioning and deprovisioning based on the changes made in Active Directory. The other options are not recommended for this scenario, as they either require additional applications, do not support federation, or do not provide a seamless user experience. References: Identity Connect Implementation Guide, Identity Connect Overview
NEW QUESTION # 140
A client is planning to rollout multi-factor authentication (MFA) to its internal employees and wants to understand which authentication and verification methods meet the Salesforce criteria for secure authentication.
Which three functions meet the Salesforce criteria for secure mfa?
Choose 3 answers
- A. username and password + SMS passcode
- B. Lightning Login
- C. Username and password + secunty key
- D. Certificate-based Authentication
- E. Third-party single sign-on with Mobile Authenticator app
Answer: B,C,E
NEW QUESTION # 141
Universal Containers is implementing Salesforce Identity to broker authentication from its enterprise single sign-on (SSO) solution through Salesforce to third party applications using SAML.
What rote does Salesforce Identity play in its relationship with the enterprise SSO system?
- A. Client Application
- B. Resource Server
- C. Service Provider (SP)
- D. Identity Provider (IdP)
Answer: C
NEW QUESTION # 142
Universal containers (UC) would like to enable self - registration for their salesforce partner community users.
UC wants to capture some custom data elements from the partner user,and based on these data elements, wants to assign the appropriate profile and account values. Which two actions should the architect recommend to UC? Choose 2 answers
- A. Configure registration for communities to use a custom apex controller.
- B. Configure registration for communities to use a custom visualforce page.
- C. Modify the selfregistration trigger to assign profile and account.
- D. Modify the communitiesselfregcontroller to assign the profile and account.
Answer: B,D
Explanation:
To enable self-registration for their Salesforce partner community users, UC should modify the communities' self-registration controller to assign the profile andaccount based on the custom data elements from the partner user1. UC should also configure registration for communities touse a customVisualforce page to capture the custom data elements from the partner user2. Therefore, option A and C are the correct answers.
References: Salesforce Partner Community, Partner Community Registration Guide
NEW QUESTION # 143
IT security at Unversal Containers (UC) us concerned about recent phishing scams targeting its users and wants to add additional layers of login protection. What should an Architect recommend to address the issue?
- A. Implement Single Sign-on using a corporate Identity store.
- B. Lock sessions to the IP address from which they originated.
- C. Increase Password complexity requirements in Salesforce.
- D. Use the Salesforce Authenticator mobile app with two-step verification
Answer: D
NEW QUESTION # 144
Refer to the exhibit.
Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?
- A. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.
- B. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.
- C. Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.
- D. For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.
Answer: B
NEW QUESTION # 145
Universal containers (UC) is setting up their customer Community self-registration process. They are uncomfortable with the idea of assigning new users to a default account record. What will happen when customers self-register in the community?
- A. The self-registration page will ask user to select an account.
- B. The self-registration page will create a new account record.
- C. The self-registration process will produce an error to the user.
- D. The self-registration process will create a person Account record.
Answer: C
NEW QUESTION # 146
A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the Installed sensors. They have engaged a salesforce Architect to propose an appropriate way to generate sensor Information In Salesforce.
Which OAuth flow should the architect recommend?
- A. OAuth 2.0 Asset Token Flow
- B. OAuth 2.0 JWT Bearer Token Flow
- C. OAuth 2.0 Device Authentication Row
- D. OAuth 2.0 SAML Bearer Assertion Flow
Answer: A
Explanation:
Explanation
To generate sensor information in Salesforce, the architect should recommend OAuth 2.0 Asset Token Flow.
OAuth 2.0 Asset Token Flow is a protocol that allows devices, such as sensors, to obtain an access token from Salesforce by using a certificate instead of an authorization code. The access token can be used to access Salesforce APIs and send data to Salesforce. OAuth 2.0 Asset Token Flow is designed for devices that do not have a user interface or a web browser. References: OAuth 2.0 Asset Token Flow, Authorize Apps with OAuth
NEW QUESTION # 147
An identity architect is setting up an integration between Salesforce and a third-party system. The third-party system needs to authenticate to Salesforce and then make API calls against the REST API.
One of the requirements is that the solution needs to ensure the third party service providers connected app in Salesforce mini need for end user interaction and maximizes security.
Which OAuth flow should be used to fulfill the requirement?
- A. JWT Bearer Flow
- B. Username-Password Flow
- C. Web Server Flow
- D. User Agent Flow
Answer: A
Explanation:
Explanation
JWT Bearer Flow allows the third-party system to authenticate to Salesforce using a digital certificate and a JSON Web Token (JWT) without any user interaction. It also provides a high level of security as it does not require sharing credentials or storing tokens. References: OAuth 2.0 JWT Bearer Token Flow
NEW QUESTION # 148
......
Ace Salesforce Identity-and-Access-Management-Architect Certification with Actual Questions Mar 31, 2026 Updated: https://examboost.latestcram.com/Identity-and-Access-Management-Architect-exam-cram-questions.html
