A company's external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?

• A.Select "Admin approved users are pre-authorized" and assign specific profiles.
• B.Create custom scopes and assign to the connected app.
• C.Define a permission set that grants access to the app and assign to authorized users.
• D.Leverage external objects and data classification policies.

Comment: *

Name: *

Email: *

Verification: *

How should an Architect force user to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

• A.Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.
• B.Add the list of company's network IP addresses to the Login Range list under 2FA Setup.
• C.Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.
• D.Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.

Comment: *

Name: *

Email: *

Verification: *

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory ActProtocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?

• A.Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled inLDAP.
• B.Configure an authentication provider to delegate authentication to the LDAP directory.
• C.use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.
• D.Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Comment: *

Name: *

Email: *

Verification: *

Northern Trail Outfitters wants to implement a partner community. Active community users will need to review and accept the community rules, and update key contact information for each community member before performing any further operation on the portal.
Which approach will meet this requirement?

• A.Create a custom landing page and email campaign asking all community members to login and verify their data.
• B.Add a banner to the community Home page asking users to update their profile and accept the new community rules.
• C.Create tasks for users who need to update their data or accept the new community rules.
• D.Create a login flow that conditionally prompts users who have not accepted the new community rules and who have missing or outdated information.

Comment: *

Name: *

Email: *

Verification: *

Which two capabilities does My Domain enable in the context of a SAML SSOconfiguration? Choose 2 answers

• A.App Launcher
• B.Resource deep linking
• C.SSO from Salesforce Mobile App
• D.Login Forensics

Comment: *

Name: *

Email: *

Verification: *