A security architect is rolling out a new multi-factor authentication (MFA) mandate, where all employees must go through a secure authentication process before accessing Salesforce. There are multiple Identity Providers (IdP) in place and the architect is considering how the "Authentication Method Reference" field (AMR) in the Login History can help.
Which two considerations should the architect keep in mind?
Choose 2 answers

• A.Both OIDC and Security Assertion Markup Language (SAML) are supported but AMR must be implemented at IdP.
• B.AMR field shows the authentication methods used at IdP.
• C.High-assurance sessions must be configured under Session Security Level Policies.
• D.Dependency on what is supported by OpenID Connect (OIDC) implementation at IdP.

Comment: *

Name: *

Email: *

Verification: *

Universal Containers (UC) has aclassified information system that its call center team uses only when they are working on a case with a record type "Classified". They are only allowed to access the system when they own an open "Classified" case, and their access to the system is removedat all other times. They would like to implement SAML SSO with Salesforce as the Idp, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "Classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying access to the classified information system based on the open "classified" case record criteria?

• A.Use Salesforce reports to identify users that currently own open "Classified" cases and should be granted access to the Classified information system.
• B.Use Apex trigger on case to dynamically assign permission Sets that Grant access when a user is assigned with an open "Classified" case, and remove it when the case is closed.
• C.Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.
• D.Use a Common Connected App Handler using Apex to dynamically allow access tothe system based on whether the staff owns any open "Classified" Cases.

Comment: *

Name: *

Email: *

Verification: *

An administrator created a connected app for a custom web application in Salesforce which needs to be visible as a tile in App Launcher. The tile for the custom web application is missing in the app launcher for all users in Salesforce. The administrator requested assistance from an identity architect to resolve the issue.
Which two reasons are the source of the issue?
Choose 2 answers

• A.Session Policy is set as "High Assurance Session required" for this connected app.
• B.The connected app is not set in the App menu as "Visible in App Launcher".
• C.Statutes, for the connected app is not set in Connected App settings.
• D.Obtain scope does not include "openid".

Comment: *

Name: *

Email: *

Verification: *

Northern Trail Outfitters (NTO) is setting up Salesforce to authenticate users with an external identity provider. The NTO Salesforce Administrator is having trouble getting things setup.
What should an identity architect use to show which part of the login assertion is fading?

• A.Security Assertion Markup Language Validator
• B.Identity Provider Metadata download
• C.SAML Metadata file importer
• D.Connected App Manager

Comment: *

Name: *

Email: *

Verification: *

Universal Containers (UC) operates in Asia, Europe and North America regions. There is one Salesforce org for each region. UC is implementing Customer 360 in Salesforce and has procured External Identity and Customer Community licenses in all orgs.
Customers of UC use Community to track orders and create inquiries. Customers also tend to move across regions frequently.
What should an identity architect recommend to optimize license usage and reduce maintenance overhead?

• A.Merge three orgs into one instance of Salesforce. This will no longer require maintaining three separate copies of the same customer.
• B.Delete contact/ account records and deactivate user if user moves from a specific region; Sync will no longer be required.
• C.Contacts are required since Community access needs to be enabled. Maintenance is a necessary overhead that must be handled via data integration.
• D.Enable Contactless User in all orgs and downgrade users from Experience Cloud license to External Identity license once users have moved out of that region.

Comment: *

Name: *

Email: *

Verification: *