Salesforce Certified Platform Identity and Access Management Architect Sample Questions:

1. A company wants to provide its employees with a custom mobile app that accesses Salesforce. Users are required to download the internal native IOS mobile app from corporate intranet on their mobile device. The app allows flexibility to access other Non Salesforce internal applications once users authenticate with Salesforce. The apps self-authorize, and users are permitted to use the apps once they have logged into Salesforce.
How should an identity architect meet the above requirements with the privately distributed mobile app?

A) Use Salesforce as an identity provider (IdP) to access the mobile app and use the external IdP for other non-Salesforce internal apps.
B) Configure Mobile App settings in connected app and Salesforce as identity provider for non-Salesforce internal apps.
C) Create a new hybrid mobile app and use the connected app with OAuth to authenticate users for Salesforce and non-Salesforce internal apps.
D) Use connected app with OAuth and Security Assertion Markup Language (SAML) to access other Non Salesforce internal apps.

2. Universal Containers (UC) uses Salesforce for its customer service agents. UC has a proprietary system for order tracking which supports Security Assertion Markup Language (SAML) based single sign-on. The VP of customer service wants to ensure only active Salesforce users should be able to access the order tracking system which is only visible within Salesforce.
What should be done to fulfill the requirement?
Choose 2 answers

A) Setup Order Tracking as a Canvas app in Salesforce to POST IdP initiated SAML assertion.
B) Setup Salesforce as an identity provider (IdP) for order Tracking.
C) Set up the Corporate Identity store as an identity provider (IdP) for Order Tracking,
D) Customize Order Tracking to initiate a REST call to validate users in Salesforce after login.

3. Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?

A) Use an appexchange product that does fingerprint scanning with native salesforce identity confirmation.
B) Use salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.
C) Use Delegated Authentication with callouts to a third-party fingerprint scanning application.
D) Use custom login flows with callouts to a third-party fingerprint scanning application.

4. Universal Containers (UC) has an Experience Cloud site (Customer Community) where customers can authenticate and place orders, view the status of orders, etc. UC allows guest checkout.
Mow can a guest register using data previously collected during order placement?

A) Enable Facebook as an authentication provider and use a registration handler to collect only order details to retrieve customer data.
B) Enable Security Assertion Markup Language Sign-On and use a login flow to collect only order details to retrieve customer data.
C) Enable self-registration and customize a self-registration page to collect only order details to retrieve customer data.
D) Use a Connected App Handler Apex Plugin class to collect only order details to retrieve customer data.

5. Containers (UC) uses an internal system for recruiting and would like to have the candidates' info available in the Salesforce automatically when they are selected. UC decides to use OAuth to connect to Salesforce from the recruiting system and would like to do the authentication using digital certificates. Which two OAuth flows should be considered to meet the requirement? Choose 2 answers

A) SAML Bearer Assertion flow
B) Web Service flow
C) JWT Bearer Token flow
D) Refresh Token flow

Solutions: