Question 1

Universal Containers (UC) is implementing Salesforce and would like to establish SAML SSO for its users tolog in. UC stores its corporate user identities in a Custom Database. The UC IT Manager has heard goodthings about Salesforce Identity Connect as an Idp, and would like to understand what limitations they mayface if they decided to use Identity Connect in their current environment. What limitation Should an Architectinform the IT Manager about?

Options :

A : Identity Connect will not support user provisioning in UC-s current environment.

B : Identity Connect will only support Idp-initiated SAML flows in UC-s current environment.

C : Identity Connect will only support SP-initiated SAML flows in UC-s current environment.

D : Identity connect is not compatible with UC-s current identity environment.

Answer: A

Question 2

Universal Containers (UC) has an existing web application that it would like to access from Salesforce withoutrequiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for itis willing to add new javascript code and/or libraries to the application. What implementation should anArchitect recommend to UC?

Options :

A : Create a Canvas app and use Signed Requests to authenticate the users.

B : Rewrite the web application as a set of Visualforce pages and Apex code.

C : Configure the web application as an item in the Salesforce App Launcher.

D : Add the web application as a ConnectedApp using OAuth User-Agent flow.

Answer: A

Question 3

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled inthe Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various applicationsupport teams to finish user deactivations. A terminated employee recently was able to login to NTO'sSalesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAPdirectory.What should an identity architect recommend to prevent this from happening in the future?

Options :

A : Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

B : Configure an authentication provider to delegate authentication to the LDAP directory.

C : use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

D : Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Answer: B

Question 4

Universal Containers (UC) operates in Asia, Europe and North America regions. There is one Salesforce orgfor each region. UC is implementing Customer 360 in Salesforce and has procured External Identity andCustomer Community licenses in all orgs.Customers of UC use Community to track orders and create inquiries. Customers also tend to move acrossregions frequently.What should an identity architect recommend to optimize license usage and reduce maintenance overhead?

Options :

A : Merge three orgs into one instance of Salesforce. This will no longer require maintaining three separate copies of the same customer.

B : Delete contact/ account records and deactivate user if user moves from a specific region; Sync will no longer be required.

C : Contacts are required since Community access needs to be enabled. Maintenance is a necessary overhead that must be handled via data integration.

D : Enable Contactless User in all orgs and downgrade users from Experience Cloud license to External Identity license once users have moved out of that region.

Answer: C

Question 5

Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post theirideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning userson Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decidesto use an API user using Oauth Username - password flow for the connection. How can the connection tosalesforce be restricted only to the employee portal server?

Options :

A : Add the Employee portals IP address to the Trusted IP range for the connected App

B : Use a digital certificate signed by the employee portal Server.

C : Add the employee portals IP address to the login IP range on the user profile.

D : Use a dedicated profile for the user the Employee portal uses.

Answer: A