The CIO of Universal Containers (UC) wants to begin using the refresh token capability for UC applications that use OAuth 2.0. UC has engaged an Architect to review all applications that use OAuth flows and identify where refresh tokens can be used.
Which two OAuth flows should the Architect consider in the evaluation?
Choose two
AJWT Bearer Token
BWeb Server
CUsername-Password
DUser-Agent
0
Community Discussion
No comments yet. Be the first to start the discussion!
Universal Containers (UC) uses middleware to integrate several systems with Salesforce. UC has a strict new requirement that usernames and passwords must not be stored in any UC system.
How can UC’s middleware authenticate to Salesforce while complying with this requirement?
ACreate a Connected App that supports the Refresh Token OAuth Flow.
BCreate a Connected App that supports the JWT Bearer Token OAuth Flow.
CCreate a Connected App that supports the User-Agent OAuth Flow.
DCreate a Connected App that supports the Web Server OAuth Flow.
0
Community Discussion
No comments yet. Be the first to start the discussion!
Universal Containers (UC) is creating a custom Innovation platform in its Salesforce instance. The Innovation platform will be developed entirely in Apex and Visualforce and will use custom objects to store data. UC wants every user to access the system without logging in with Salesforce credentials. UC will use a third-party IdP with SAML SSO.
What Salesforce license type is recommended for all UC employees?
ASalesforce Platform license
BExternal Identity license
CIdentity license
DSalesforce license
0
Community Discussion
No comments yet. Be the first to start the discussion!
That's the end of the preview
It's free
100% of the questions are free for all users. No strings attached.
Identity Management ConceptsAccepting 3rd Party Identity in SalesforceSalesforce as an Identity ProviderAccess Management Best PracticesSalesforce IdentityCommunity (Partner and Customer)
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Universal Containers plans to build a custom mobile app that connects to Salesforce through OAuth and wants to limit the types of resources that mobile users can access.
Which Salesforce OAuth feature should be used to accomplish this goal?
ARefresh Tokens
BScopes
CAccess Tokens
DMobile PINs
Universal Containers (UC) is developing an integration between Salesforce and a legacy web application by using the Canvas framework. UC’s security team has concluded that a signed request from Salesforce is not a sufficient authentication solution for the third-party app.
Which two options should the Architect consider to authenticate the third-party app using the Canvas framework?
Choose two
AUtilize Authorization Providers to allow the third-party application to authenticate itself against Salesforce as the IdP.
BUtilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC's IdP.
CCreate a registration handler Apex class to allow the third-party application to authenticate itself against Salesforce as the IdP.
DUtilize the Canvas OAuth flow to allow the third-party application to authenticate itself against Salesforce as the IdP.
Universal Containers (UC) implemented SSO to a third-party system so its Salesforce users can access the App Launcher. UC enabled User Provisioning on the Connected App so that user-account changes can be synchronized between Salesforce and the third-party system. However, UC soon notices that changes to Salesforce user roles are not being synchronized to the third-party system.
What is the likely reason for this behavior?
AThe Approval queue for User Provisioning Requests is unmonitored.
BUser Provisioning for Connected Apps does NOT support role sync.
CRequired operation(s) was NOT mapped in User Provisioning Settings.
DSalesforce roles have more than three levels in the role hierarchy.
Universal Containers (UC) wants to enable self-registration for its Salesforce Partner Community users. UC wants to capture custom data elements from each partner user and, based on those elements, assign the appropriate Profile and Account values.
Which two actions should the Architect recommend to UC?
Choose two
AConfigure Registration for Communities to use a custom Visualforce Page.
BConfigure Registration for Communities to use a custom Apex Controller.
CModify the CommunitiesSelfRegController to assign the Profile and Account.
DModify the SelfRegistration trigger to assign Profile and Account.
An Architect must configure a Facebook Authentication provider as a login option for a Salesforce Customer Community.
Which part of the authentication-provider configuration links a Facebook user to a Salesforce user?
AApex Registration Handler
BFederation ID
CConsumer Key and Consumer Secret
DUser Info Endpoint URL
Universal Containers (UC) has a Customer Community that uses Facebook for authentication. UC wants to ensure that Facebook profile changes are reflected on the corresponding Customer Community user.
How can this requirement be fulfilled?
ADevelop a scheduled job that calls out to Facebook on a nightly basis.
BUse the updateUser() method on the Registration Handler class.
CUse SAML Just-In-Time Provisioning between Facebook and Salesforce.
DUse information in the Signed Request that is received from Facebook.
Universal Containers has adopted a multi-org strategy and wants to centralize management of its Salesforce user profiles.
What should the Architect recommend to enable Salesforce profiles to be managed from a central system of record?
AImplement JIT provisioning on the SAML IdP that will pass the ProfileID in each assertion.
BImplement Delegated Authentication that will update the user profiles as necessary.
CCreate an Apex scheduled job in one org that will synchronize the other org's profiles.
DImplement an OAuth JWT flow to pass the profile credentials between systems.
Which two security risks can be mitigated by enabling Two-Factor Authentication in Salesforce?
Choose two
AUsers accessing Salesforce from a public Wi-Fi access point.
CUsers leaving laptops unattended and NOT logging out of Salesforce.
DUsers choosing passwords that are the same as their Facebook password.
Universal Containers (UC) has configured an SP-initiated SAML flow between an external IdP and Salesforce. When a UC user tries to log in to the Salesforce mobile app for the first time, they are prompted for Salesforce credentials rather than being taken to the IdP login page.
What is the most likely cause of this issue?
AThe "Redirect to Identity Provider” option has NOT been selected in the My Domain configuration.
BThe "Redirect to Identity Provider" option has NOT been selected on the SAML configuration.
CThe user has NOT been granted the “Enable Single Sign-on” permission.
DThe user has NOT configured the Salesforce mobile app to use My Domain for login.
Universal Containers (UC) has chosen to use Identity Connect as its Identity Provider. UC uses Active Directory (AD) and has a team that is highly familiar and comfortable with managing AD groups. UC wants to use AD groups to help configure Salesforce users.
Which three actions can AD groups control through Identity Connect?
Choose three
APublic Group Assignment
BRole Assignment
CCustom Permissions Assignment
DGranting Report Folder Access
EPermission Sets Assignment
How should an Architect require users to authenticate with Two-factor Authentication (2FA) for Salesforce only when they are not connected to an internal company network?
AApply the “Two-factor Authentication for User Interface Logins” permission and Login IP Ranges for all Profiles.
BAdd the company's list of network IP addresses to the Login Range list under 2FA Setup.
CUse Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.
DUse an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.
Universal Containers’ security team has identified report exports as a high-risk action and wants users to be signed in to Salesforce with their Active Directory (AD) credentials to perform them. For every other use of Salesforce, users must be able to use either AD credentials or Salesforce credentials.
Which solution should be recommended to prevent report exports unless the user is logged in with AD credentials, while preserving the ability to view reports when logged in with Salesforce credentials?
AUse SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically add or remove a Permission Set that grants the Export Reports permission.
BUse SAML Federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.
CUse SAML Federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports permission.
DUse SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.
What role does an Identity Provider perform in a SAML-based single sign-on setup?
AConsume assertion
BRevoke assertion
CValidate assertion
DCreate assertion
Universal Containers has created a custom token-based Two-Factor Authentication system for its existing on-premise applications. It is now implementing Salesforce and also wants to enable a Two-Factor login process for Salesforce.
What recommended solution should an Architect consider?
AReplace the custom 2FA system with an AppExchange App that supports on-premise applications and Salesforce.
BUse the custom 2FA system for on-premise applications and native 2FA for Salesforce.
CReplace the custom 2FA system with Salesforce 2FA for on-premise applications and Salesforce.
DUse Custom Login Flows to connect to the existing custom 2FA system for use in Salesforce.
Universal Containers (UC) has implemented SAML-based single sign-on for its Salesforce application. UC uses PingFederate as the identity provider. To access Salesforce, users typically go to a bookmarked My Domain URL.
What type of single sign-on flow is this?
AIdP-Initiated
BIdP-Initiated with Deep Linking
CSP-Initiated
DWeb Server Flow
Which item should an Architect consider when designing a Delegated Authentication implementation?
AThe web service should be secured with TLS using Salesforce trusted certificates.
BThe web service should be able to accept one to four input method parameters.
CThe web service should use the Salesforce Federation ID to identify the user.
DThe web service should implement a custom password decryption method.
Which two system roles apply when Salesforce users can access Google Apps from within Salesforce by using App Launcher and Connected App configuration?
Choose two
ASalesforce is the Service Provider.
BSalesforce is the Identity Provider.
CGoogle is the Identity Provider.
DGoogle is the Service Provider.
An Architect has successfully configured SAML-based SSO for Universal Containers. SSO has operated successfully for 3 months when Universal Containers manually adds a batch of new users to Salesforce. The new users receive an error from Salesforce when they attempt to use SSO. Existing users can still successfully use SSO to access Salesforce.
What is the likely cause of this behavior?
AThe new users do NOT have the SSO permission enabled on their profiles.
BThe Federation ID field on the new User records is NOT correctly set.
CThe administrator forgot to reset the new user's Salesforce password.
DThe My Domain capability is NOT enabled on the new user's profile.
How can an Architect automatically send users to the external Identity Provider’s login page when using an SP-initiated SAML flow with Salesforce acting as the Service Provider?
ARemove the Login Page from the list of Authentication Services on the My Domain configuration.
BSet the Identity Provider as default and enable the Redirect to the Identity Provider setting on the SAML Configuration.
CUse Visualforce as the landing page for My Domain to redirect users to the Identity Provider login page.
DEnable the Redirect to the Identity Provider setting under Authentication Services on the My Domain Configuration.
Community Discussion