Instant Access Salesforce.Identity-and-Access-Management-Architect.v2026-07-12.q101 Actual Practice Test Engine for Free (Page 20)

Question 91

Universal Containers uses Salesforce as an identity provider and Concur as the Employee Expense management system. The HR director wants to ensure Concur accounts for employees are created only after the apocopate approval in the Salesforce org.
Which three steps should the identity architect use to implement this requirement?
Choose 3 answers

A.Create an approval process for a custom object associated with the provisioning flow.
B.Create a connected app for Concur in Salesforce.
C.Enable User Provisioning for the connected app.
D.Create an approval process for user object associated with the provisioning flow.
E.Create an approval process for UserProvisionlngRequest object associated with the provisioning flow.

Correct Answer: B,C,E

Explanation
User provisioning is a feature that allows Salesforce to create, update, or deactivate user accounts on a third-party system, such as Concur, based on user assignments in Salesforce1. To implement user provisioning for Concur with an approval process, the identity architect should use the following steps2:
Create a connected app for Concur in Salesforce. A connected app is an application that integrates with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect3. To create a connected app for Concur, you need to provide the basic information, such as the app name, logo URL, contact email, and API name. You also need to enable SAML and configure the SAML settings, such as the entity ID, ACS URL, and subject type4.
Enable User Provisioning for the connected app. This step allows you to configure the user provisioning settings for the connected app, such as the provisioning API endpoint URL, the client ID and client secret, the mapping of user attributes, and the linkage rules5. You can also choose to require an approval process for user provisioning requests by selecting the Approval Required option6.
Create an approval process for UserProvisioningRequest object associated with the provisioning flow. A UserProvisioningRequest object represents a user provisioning request that is sent to or received from a third-party system7. An approval process specifies the steps necessary for a record to be approved and who must approve it at each step8. To create an approval process for UserProvisioningRequest object, you need to define the approval steps, assignees, actions, criteria, and email alerts9.
References:
User Provisioning for Connected Apps
Tutorial: Configure Salesforce for automatic user provisioning
Connected Apps
Create a Connected App
Enable User Provisioning for a Connected App
Require Approvals for User Provisioning Requests
UserProvisioningRequest
Approval Processes
Create an Approval Process

Question 92

Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post their ideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decides to use an API user using Oauth Username - password flow for the connection. How can the connection to salesforce be restricted only to the employee portal server?

A.Use a dedicated profile for the user the Employee portal uses.
B.Add the employee portals IP address to the login IP range on the user profile.
C.Use a digital certificate signed by the employee portal Server.
D.Add the Employee portals IP address to the Trusted IP range for the connected App

Question 93

Universal Containers (UC) has an existing web application that itwould like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?

A.Create a Canvas app and use Signed Requests to authenticate the users.
B.Rewrite the web application as a set of Visualforce pages and Apex code.
C.Configure the web application as an item in the Salesforce App Launcher.
D.Add the web application as a ConnectedApp using OAuth User-Agent flow.

Question 94

Universal containers (UC) has a mobile application that it wants to deploy to all of its salesforce users, including customer Community users. UC would like to minimize the administration overhead, which two items should an architect recommend? Choose 2 answers

A.Enable the "Refresh Tokens is valid until revoked " setting in the Connected App.
B.Enable the "Enforce Ip restrictions" settings in the connected App.
C.Enable the "All users may self-authorize" setting in the Connected App.
D.Enable the "High Assurance session required" setting in the Connected App.

Question 95

Universal Containers (UC) is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.
Which two page types are valid login page types for the site?
Choose 2 answers

A.Experience Builder Page
B.lightning Experience Page
C.Login Discovery Page
D.Embedded Login Page

Question 91

Question 92

Question 93

Question 94

Question 95

Download PDF File