Question 1

Containers (UC) has implemented SAML-based single Sign-on for their Salesforce application and is planning to provide access to Salesforce on mobile devices using the Salesforce1 mobile app. UC wants to ensure that Single Sign-on is used for accessing the Salesforce1 mobile App. Which two recommendations should the Architect make? Choose 2 Answers

Options :

A : Configure the Embedded Web Browser to use My Domain URL.

B : Configure the Salesforce1 App to use the MY Domain URL.

C : Use the existing SAML-SSO flow along with User Agent Flow.

D : Use the existing SAML SSO flow along with Web Server Flow.

Answer: B,C

Question 2

A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect(OIDC).When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC orSAML?

Options :

A : OIDC is more secure than SAML and therefore is the obvious choice.

B : The SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider.

C : If the user has a session on Salesforce, you do not want them to be prompted for a username and password when they login to the SP.

D : They are equivalent protocols and there is no real reason to choose one over the other.

Answer: B

Question 3

What item should an Architect consider when designing a Delegated Authentication implementation?

Options :

A : The Web service should be secured with TLS using Salesforce trusted certificates.

B : The Web service should be able to accept one to four input method parameters.

C : The web service should use the Salesforce Federation ID to identify the user.

D : The Web service should implement a custom password decryption method.

Answer: A

Question 4

Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would liketo restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used toachieve the goal?

Options :

A : Access Tokens

B : Mobile pins

C : Refresh Tokens

D : Scopes

Answer: D

Question 5

Identity-and-Access-Management-Architect-page101-image4 An organization has a central cloud-based Identity and Access Management (IAM) Service for authenticationand user management, which must be utilized by all applications as follows:1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioining in theintegrated cloud applications.2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for usersauthenticated at identity provider (Central IAM Service).Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

Options :

A : A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-DomainIdentity Management) for provisioning and deprovisioning of users.

B : Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning anddeprovisioning of users

C : Configure central IAM Service as an authentication provider and extend registration handler to manageprovisioning and deprovisioning of users.

D : Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, aswell as SAML-based SSO.

Answer: A