Question 1

What information does the 'Relaystate' parameter contain in sp-Initiated Single Sign-on?

Options :

A : Reference to a URL redirect parameter at the identity provider.

B : Reference to a URL redirect parameter at the service provider.

C : Reference to the login address URL of the service provider.

D : Reference to the login address URL of the identity Provider.

Answer: B

Question 2

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in

the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application

support teams to finish user deactivations. A terminated employee recently was able to login to NTO's

Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP

directory.

What should an identity architect recommend to prevent this from happening in the future?

Options :

A : Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

B : Configure an authentication provider to delegate authentication to the LDAP directory.

C : use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

D : Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Answer: B

Question 3

Universal Containers (UC) has a Customer Community that uses Facebook for Authentication. UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user: How can this requirement be met?

Options :

A : Use the updateUser method on the registration Handler Class.

B : Develop a scheduled job that calls out to Facebook on a nightly basis.

C : Use information in the signed Request that is received from facebook.

D : Use SAML Just-In-Time Provisioning between Facebook and Salesforce.

Answer: A

Question 4

Universal containers (UC) would like to enable self - registration for their salesforce partner community users.

UC wants to capture some custom data elements from the partner user, and based on these data elements,

wants to assign the appropriate profile and account values. Which two actions should the architect recommend

to UC? Choose 2 answers

Options :

A : Modify the communitiesselfregcontroller to assign the profile and account.

B : Modify the selfregistration trigger to assign profile and account.

C : Configure registration for communities to use a custom visualforce page.

D : Configure registration for communities to use a custom apex controller.

Answer: A,C

Question 5

Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has

implemented the Oauth web-server Authentication flow for authentication process. Which two considerations

should an architect point out to UC? Choose 2 answers

Options :

A : The web application should be hosted on a secure server.

B : The web server must be able to protect consumer privacy

C : The flow involves passing the user credentials back and forth.

D : The flow will not provide an Oauth refresh token back to the server.

Answer: A,B