Question 1

Universal Containers (UC) operates in Asia, Europe and North America regions. There is one Salesforce orgfor each region. UC is implementing Customer 360 in Salesforce and has procured External Identity andCustomer Community licenses in all orgs.Customers of UC use Community to track orders and create inquiries. Customers also tend to move acrossregions frequently.What should an identity architect recommend to optimize license usage and reduce maintenance overhead?

Options :

A : Merge three orgs into one instance of Salesforce. This will no longer require maintaining three separate copies of the same customer.

B : Delete contact/ account records and deactivate user if user moves from a specific region; Sync will no longer be required.

C : Contacts are required since Community access needs to be enabled. Maintenance is a necessary overhead that must be handled via data integration.

D : Enable Contactless User in all orgs and downgrade users from Experience Cloud license to External Identity license once users have moved out of that region.

Answer: C

Question 2

Universal Containers is creating a mobile application that will be secured by Salesforce Identity using theOAuth 2.0 user-agent flow. Application users will authenticate using username and password. They should notbe forced to approve API access in the mobile app or reauthenticate for 3 months.Which two connected app options need to be configured to fulfill this use case?Choose 2 answers

Options :

A : Set Permitted Users to "Admin approved users are pre-authorized".

B : Set Permitted Users to "All users may self-authorize".

C : Set the Session Timeout value to 3 months.

D : Set the Refresh Token Policy to expire refresh token after 3 months.

Answer: B,D

Question 3

Universal Containers (UC) has implemented a multi-org architecture in their company. Many users havelicences across multiple orgs, and they are complaining about remembering which org and credentials are tiedto which business process. Which two recommendations should the Architect make to address the Complaints?Choose 2 answers

Options :

A : Activate My Domain to Brand each org to the specific business use case.

B : Implement SP-Initiated Single Sign-on flows to allow deep linking.

C : Implement IdP-Initiated Single Sign-on flows to allow deep linking.

D : Implement Delegated Authentication from each org to the LDAP provider.

Answer: A,B

Question 4

Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post theirideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning userson Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decidesto use an API user using Oauth Username - password flow for the connection. How can the connection tosalesforce be restricted only to the employee portal server?

Options :

A : Add the Employee portals IP address to the Trusted IP range for the connected App

B : Use a digital certificate signed by the employee portal Server.

C : Add the employee portals IP address to the login IP range on the user profile.

D : Use a dedicated profile for the user the Employee portal uses.

Answer: A

Question 5

Universal Containers (UC) has an existing web application that it would like to access from Salesforce withoutrequiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for itis willing to add new javascript code and/or libraries to the application. What implementation should anArchitect recommend to UC?

Options :

A : Create a Canvas app and use Signed Requests to authenticate the users.

B : Rewrite the web application as a set of Visualforce pages and Apex code.

C : Configure the web application as an item in the Salesforce App Launcher.

D : Add the web application as a ConnectedApp using OAuth User-Agent flow.

Answer: A