Question 1

Users logging into Salesforce are frequently prompted to verify their identity.The identity architect is required to provide recommendations so that frequency of prompt verification can bereduced.What should the identity architect recommend to meet the requirement?

Options :

A : Implement 2FA authentication for the Salesforce org.

B : Set trusted IP ranges for the organization.

C : Implement an single sign-on for Salesforce using an external identity provider.

D : Implement multi-factor authentication for the Salesforce org.

Answer: B

Question 2

Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce? Choose 2 answers

Options :

A : Users leaving laptops unattended and not logging out of Salesforce.

B : Users accessing Salesforce from a public Wi-Fi access point.

C : Users choosing passwords that are the same as their Facebook password.

D : Users creating simple-to-guess password reset questions.

Answer: B,C

Question 3

Identity-and-Access-Management-Architect-page101-image4 An organization has a central cloud-based Identity and Access Management (IAM) Service for authenticationand user management, which must be utilized by all applications as follows:1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioining in theintegrated cloud applications.2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for usersauthenticated at identity provider (Central IAM Service).Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

Options :

A : A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-DomainIdentity Management) for provisioning and deprovisioning of users.

B : Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning anddeprovisioning of users

C : Configure central IAM Service as an authentication provider and extend registration handler to manageprovisioning and deprovisioning of users.

D : Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, aswell as SAML-based SSO.

Answer: A

Question 4

Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post theirideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning userson Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decidesto use an API user using Oauth Username - password flow for the connection. How can the connection tosalesforce be restricted only to the employee portal server?

Options :

A : Add the Employee portals IP address to the Trusted IP range for the connected App

B : Use a digital certificate signed by the employee portal Server.

C : Add the employee portals IP address to the login IP range on the user profile.

D : Use a dedicated profile for the user the Employee portal uses.

Answer: A

Question 5

Universal Containers (UC) wants to implement SAML SSO for their internal of Salesforce users using a third-party IdP. After some evaluation, UC decides NOT to 65« set up My Domain for their Salesforce org. How does that decision impact their SSO implementation?

Options :

A : IdP-initiated SSO will NOT work.

B : Neither SP- nor IdP-initiated SSO will work.

C : Either SP- or IdP-initiated SSO will work.

D : SP-initiated SSO will NOT work

Answer: B