Instant Access Salesforce.Identity-and-Access-Management-Architect.v2026-07-12.q101 Actual Practice Test Engine for Free (Page 21)

Question 96

An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:
1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioning in the integrated cloud applications.
2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).
Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

A.A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-Domain Identity Management) for provisioning and deprovisioning of users.
B.Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning and deprovisioning of users.
C.Configure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.
D.Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.

Question 97

Universal Containers wants to secure its Salesforce APIs by using an existing Security Assertion Markup Language (SAML) configuration supports the company's single sign-on process to Salesforce, Which Salesforce OAuth authorization flow should be used?

A.OAuth 2.0 SAML Bearer Assertion Flow
B.A SAML Assertion Row
C.OAuth 2.0 User-Agent Flow
D.OAuth 2.0 JWT Bearer Flow

Question 98

Universal Containers (UC) uses Global Shipping (GS) as one of their shipping vendors. Regional leads of GS need access to UC's Salesforce instance for reporting damage of goods using Cases. The regional leads also need access to dashboards to keep track of regional shipping KPIs. UC internally uses a third-party cloud analytics tool for capacity planning and UC decided to provide access to this tool to a subset of GS employees.
In addition to regional leads, the GS capacity planning team would benefit from access to this tool. To access the analytics tool, UC IT has set up Salesforce as the Identity provider for Internal users and would like to follow the same approach for the GS users as well. What are the most appropriate license types for GS Tregional Leads and the GS Capacity Planners? Choose 2 Answers

A.Identity Licence for GS Regional Leads and External Identity license for GS capacity Planners.
B.Customer Community Plus license for GS Regional Leads and External Identity for GS Capacity Planners.
C.Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.
D.Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.

Question 99

A manufacturer wants to provide registration for an Internet of Things (IoT) device with limited display input or capabilities.
WhichSalesforce OAuth authorization flow should be used?

A.OAuth 2.0 JWT Bearer How
B.OAuth 2.0 Device Flow
C.OAuth 2.0 User-Agent Flow
D.OAuth 2.0 Asset Token Flow

Question 100

What are three capabilities of Delegated Authentication? Choose 3 answers

A.It can be assigned by Custom Permissions.
B.It can connect to SOAP services.
C.It can be assigned by Permission Sets.
D.It can be assigned by Profiles.
E.It can connect to REST services.

Correct Answer: B,C,E

The three capabilities of delegatedauthentication are:
* It can connect to SOAP services. Delegated authentication is a feature that allows Salesforce to delegate the authentication process to an external service by making a SOAP callout to a web service that verifies the user's credentials.This feature enables Salesforce to integrate with existing identity stores or authentication methods that support SOAP services.
* It can be assigned by permission sets. Permission sets are collections of settings and permissions that give users access to various tools and functions in Salesforce. Permission sets can be used to assign delegated authentication to users by enabling the "Is Single Sign-on Enabled" permission. This permission allows users to log in with delegated authentication instead of their Salesforce username and password.
* It can connect to REST services. REST services are web services that use HTTP methods to access or manipulate resources on a server. REST services can be used for delegated authentication by creating a custom login page that makes a REST callout to an external service that verifies the user's credentials.
This approach requires custom code and configuration, but it provides more flexibility and control over the authentication process.
The other options are not capabilities of delegated authentication. Delegated authentication cannot be assigned by custom permissions or profiles. Custom permissions are settings that can be used in Apex code or validation rules to check whether a user has access to a custom feature or functionality. Custom permissions cannot be used to enable delegated authentication for users. Profiles are collections of settings and permissions that determine what users can do in Salesforce. Profiles cannot be used to enable delegated authentication for users,as this feature is controlled by permission sets. References: [Delegated Authentication], [Permission Sets], [Enable 'Delegated Authentication'], [REST Services], [Custom Login Page for Delegated Authentication], [Custom Permissions], [Profiles]

Question 96

Question 97

Question 98

Question 99

Question 100

Download PDF File