Salesforce Certified Platform Identity and Access Management Architect Sample Questions:

1. In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?

A) Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA
B) Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.
C) Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.
D) Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.

2. Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?

A) Verify that the Callback URL is correctly pointing to the new URI Scheme.
B) Check the Refresh Token policy defined in the Salesforce Connected App.
C) Confirm that the access Token's Time-To-Live policy has been set appropriately.
D) Validate that the users are checking the box to remember their passwords.

3. Universal Containers is implementing Salesforce Identity to broker authentication from its enterprise single sign-on (SSO) solution through Salesforce to third party applications using SAML.
What rote does Salesforce Identity play in its relationship with the enterprise SSO system?

A) Resource Server
B) Service Provider (SP)
C) Client Application
D) Identity Provider (IdP)

4. An Identity architect works for a multinational, multi-brand organization. As they work with the organization to understand their Customer Identity and Access Management requirements, the identity architect learns that the brand experience is different for each of the customer's sub-brands and each of these branded experiences must be carried through the login experience depending on which sub-brand the user is logging into.
Which solution should the architect recommend to support scalability and reduce maintenance costs, if the organization has more than 150 sub-brands?

A) Use Audiences to customize the login experience for each sub-brand and pass an audience ID to the community during the OAuth and Security Assertion Markup Language (SAML) flows.
B) Create a community subdomain for each sub-brand and customize the look and feel of the Login page for each community subdomain to match the brand.
C) Create a separate Salesforce org for each sub-brand so that each sub-brand has complete control over the user experience.
D) Assign each sub-brand a unique Experience ID and use the Experience ID to dynamically brand the login experience.

5. A financial enterprise is planning to set up a user authentication mechanism to login to the Salesforce system. Due to regulatory requirements, the CIO of the company wants user administration, including passwords and authentication requests, to be managed by an external system that is only accessible via a SOAP webservice.
Which authentication mechanism should an identity architect recommend to meet the requirements?

A) OAuth Web-Server Flow
B) Identity Connect
C) Just-in-Time Provisioning
D) Delegated Authentication

Solutions: