Certified Platform Identity and Access Management… Practice Exam

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

58Practice Questions

3Study Modes

Free

TopicSort

Question 1

Authentication

Northern Trail Outfitters (NTO) wants its customers to use phone numbers to log in to their new digital portal, which was designed and built using Salesforce Experience Cloud. In order to access the portal, the user will need to do the following:

Enter a phone number and/or email address
Enter a verification code that is to be sent via email or text.
What is the recommended approach to fulfill this requirement?

A Create a Login Discovery page and provide a Login Discovery Handler Apex class.
B Create a custom login flow that uses an Apex controller to verify the phone numbers with the company’s verification service.
C Create a custom login page with an Apex controller. The controller has logic to send and verify the identity.
D Create an Authentication provider and implement a self-registration handler class.

Question 2

Single Sign-On and Identity Provider Configuration

Question 3

Authentication

Question 4

Authentication

Question 5

Single Sign-On and Identity Provider Configuration

Question 6

Authentication

Question 7

Single Sign-On and Identity Provider Configuration

Question 8

Single Sign-On and Identity Provider Configuration

Question 9

Single Sign-On and Identity Provider Configuration

Question 10

Single Sign-On and Identity Provider Configuration

Question 11

Single Sign-On and Identity Provider Configuration

Question 12

Authentication

Question 13

Authentication

Question 14

Single Sign-On and Identity Provider Configuration

Question 15

Single Sign-On and Identity Provider Configuration

Question 16

Single Sign-On and Identity Provider Configuration

Question 17

Authentication

Question 18

Authentication

Question 19

Single Sign-On and Identity Provider Configuration

Question 20

Authentication

Question 21

Authentication

Question 22

Authentication

Question 23

Authentication

Question 24

Authorization and Access Control

That's the end of the Preview

This exam has 58 community-verified practice questions. Create a free account to access all questions, comments, and explanations.

Topics covered:

Identity Management ConceptsAuthenticationAuthorization and Access ControlSingle Sign-On and Identity Provider Configuration

Log In / Sign Up

Page 1 of 3 • Questions 1-25 of 58

1 2 3

→

Know a question that should be here? Contribute to this exam

Universal Containers (UC) is using its production org as the identity provider for a new Experience Cloud site and the identity architect is deciding which login experience to use for the site.
Which two page types are valid login page types for the site? (Choose two.)

A Experience Builder Page
B Login Discovery Page
C Lightning Experience Page
D Embedded Login Page

Northern Trail Outfitters (NTO) is planning to build a new customer service portal and wants to use passwordless login, allowing customers to login with a one-time passcode sent to them via email or SMS.
How should the quantity of required Identity Verification Credits be estimated?

A Identity Verification Credits are a direct add-on license based on the number of existing member-based or login-based Community licenses.
B Identity Verification Credits are consumed with each SMS (text message) sent and should be estimated based on the number of login verification challenges for SMS verification users.
C Each community comes with 10,000 Identity Verification Credits per month and only customers with more than 10,000 logins a month should estimate additional SMS verifications needed.
D Identity Verification Credits are consumed with each verification sent and should be estimated based on the number of logins that will incur a verification challenge.

Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal should be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have been purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements? (Choose three.)

A Enable “Allow customers and partners to self-register”.
B Set up an external login page and call Salesforce APIs for user creation.
C Customize the self-registration Apex handler to create only the user record.
D Select the “Configurable Self-Reg Page” option under Login & Registration.

Question Image

A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user’s brand preference selected in Heroku before Authorization.
What should an identity architect do to fulfill the above requirements?

A Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.
B Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.
C Authorize third-party service by sending authorization requests to the community_url/services/oauth2/authorize/?expid=value.
D For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Question 6

Authentication

Question 7

Single Sign-On and Identity Provider Configuration

Question 8

Single Sign-On and Identity Provider Configuration

Question 9

Single Sign-On and Identity Provider Configuration

Question 10

Single Sign-On and Identity Provider Configuration

Question 11

Single Sign-On and Identity Provider Configuration

Question 12

Authentication

Question 13

Authentication

Question 14

Single Sign-On and Identity Provider Configuration

Question 15

Single Sign-On and Identity Provider Configuration

Question 16

Single Sign-On and Identity Provider Configuration

Question 17

Authentication

Question 18

Authentication

Question 19

Single Sign-On and Identity Provider Configuration

Question 20

Authentication

Question 21

Authentication

Question 22

Authentication

Question 23

Authentication

Question 24

Authorization and Access Control

An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM Architect do to fulfill this requirement?

A Create a default account for capturing all ecommerce contacts registered on the community because personAccount is not supported for this case.
B Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.
C Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.
D Confirm performance considerations with Salesforce Customer Support due to high peaks.

Northern Trail Outfitters (NTO) has an existing business-to-consumer (B2C) website that that does NOT support single sign-on standards, such as Security Assertion Markup Language (SAML) or OAuth. NTO wants to use Salesforce Identity to register and authenticate new customers on the website.
Which three Salesforce features should an Identity architect use in order to provide social sign-in capabilities for the website? (Choose three.)

A Delegated Authentication
B Connected Apps
C Identity Connect
D Authentication Providers
E Embedded Login

The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discuss Salesforce out-of-box capabilities for configuring the company’s login and registration experience on Salesforce Experience Cloud.
The CMO is looking to brand the login page with the company’s logo, background color, login button color, and dynamic right-frame from an external URL.
Which two solutions should the IAM specialist recommend? (Choose two.)

A Build custom site pages for reset and forgot password features.
B Login & Registration pages can be branded in the Community Administration settings.
C Use Experience Builder to build branded Reset and Forgot Password pages.
D Build custom pages for branding requirements in Experience Cloud.

Universal Containers is creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow. Application users will authenticate using username and password. They should not be forced to approve API access in the mobile app or reauthenticate for 3 months.
Which two connected app options need to be configured to fulfill this use case? (Choose two.)

A Set Permitted Users to “All users may self-authorize”.
B Set the Refresh Token Policy to expire refresh token after 3 months.
C Set the Session Timeout value to 3 months.
D Set Permitted Users to “Admin approved users are pre-authorized”.

An administrator created a connected app for a custom web application in Salesforce which needs to be visible as a tile in App Launcher. The tile for the custom web application is missing in the app launcher for all users in Salesforce. The administrator requested assistance from an identity architect to resolve the issue.
Which two reasons are the source of the issue? (Choose two.)

A StartURL for the connected app is not set in Connected App settings.
B The connected app is not set in the App menu as “Visible in App Launcher”.
C Session Policy is set as “High Assurance Session required” for this connected app.
D OAuth scope does not include “openid”.

A leading fitness tracker company is getting ready to launch a customer community. The company wants its customers to login to the community and connect their fitness device to their profile. Customers should be able to obtain exercise details and fitness recommendation in the community.
Which should be used to satisfy this requirement?

A Named Credentials
B Login Flows
C OAuth Device Flow
D OAuth Asset Token flow

Universal Containers is implementing a new Experience Cloud site and the identity architect wants to use dynamic branding features as part of the login process.
Which two options should the identity architect recommend to support dynamic branding for the site? (Choose two.)

A An external content management system (CMS) must be used for dynamic branding on Experience Cloud sites.
B An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand.
C To use dynamic branding, the community must be built with the Customer Account Portal template.
D To use dynamic branding, the community must be built with the Visualforce + Salesforce Tabs template.

A university is planning to set up an identity solution for its alumni. A third-party identity provider will be used for single sign-on and Salesforce will be the system of records. Users are getting error messages when logging in.
Which Salesforce feature should be used to debug the issue?

A Apex Exception Email
B Debug Logs
C Login History
D View Setup Audit Trail

A Salesforce Administrator is tasked with setting up Just-in-Time (JIT) provisioning for SAML to enable Single Sign-On (SSO) for your organization. They have already configured the SAML settings for SSO in Salesforce.
What should be their next steps to enable JIT provisioning?

A Create a new Apex class to handle JIT provisioning, implement the required methods, and assign the class to the appropriate user profiles.
B Modify the organization-wide sharing settings to allow JIT provisioning, update the sharing rules for the user object.
C Enable Just-in-Time User Provisioning in the SAML Single Sign-On Setting, configure the User Provisioning Type, and provide the SAML JIT Handler.
D Create a new permission set with JIT provisioning enabled, configure the necessary permissions, and assign the permission set to relevant users.

Universal Containers (UC) wants to provide single sign-on (SSO) for a business-to-consumer (B2C) application using Salesforce Identity.
Which Salesforce license should UC utilize to implement this use case?

A Salesforce Platform
B Partner Community
C External Identity
D Identity Only

An identity architect is setting up an integration between Salesforce and a third-party system. The third-party system needs to be able to authenticate to Salesforce and then make API calls against the REST API.
One of the requirements is that the solution needs to ensure the third party service providers connected app in Salesforce minimizes the need for end user interaction and maximizes security.
Which OAuth flow should be used to fulfill the requirement?

A Web Server Flow
B User Agent Flow
C JWT Bearer Flow
D Username-Password Flow

Universal Containers is creating a web application that will be secured by Salesforce Identity using the OAuth 2.0 Web Server Flow (this flow uses the OAuth 2.0 authorization code grant type).
Which three OAuth concepts apply to this flow? (Choose three.)

A Verification URL
B Scopes
C Client Secret
D Access Token
E Authentication Token

Universal Containers (UC) has built a custom time tracking app for its employees on a third party system. UC wants to leverage Salesforce Identity to control access to the custom app.
At a minimum, which Salesforce license is required to support this requirement?

A External Identity
B Identity Connect
C Identity Verification
D Identity Only

An identity architect is implementing a mobile-first Consumer Identity Access Management (CIAM) for external users.
User authentication is the only requirement. The users email or mobile phone number should be supported as a username.
Which two licenses are needed to meet this requirement? (Choose two.)

A Identity Connect Licenses
B Email Verification Credits
C External Identity Licenses
D SMS Verification Credits

A farming enterprise offers smart farming technology to its farmer customers, which includes a variety of sensors for livestock tracking, pest monitoring, climate monitoring etc. They plan to store all the data in Salesforce. They would also like to ensure timely maintenance of the installed sensors. They have engaged a Salesforce Architect to propose an appropriate way to send an alert when something goes wrong.
Which OAuth flow should the architect recommend?

A OAuth 2.0 Asset Token Flow
B OAuth 2.0 Device Authentication Flow
C OAuth 2.0 SAML Bearer Assertion Flow
D OAuth 2.0 JWT Bearer Token Flow

A global company has built an external application that uses data from its Salesforce org via an OAuth 2.0 authorization flow. Upon logout, the existing Salesforce OAuth token must be invalidated.
Which action will accomplish this?

A Use a HTTP POST to make a call to the revoke token endpoint.
B Enable Single Logout with a secure logout URL.
C Use a HTTP POST to the System for Cross-domain Identity Management (SCIM) endpoint, including the current OAuth token.
D Use a HTTP POST to request the refresh token for the current user.

A global fitness equipment manufacturer uses Salesforce to manage its sales cycle. The manufacturer has a custom order fulfillment app that needs to request order data from Salesforce. The order fulfillment app needs to integrate with the Salesforce API using OAuth 2.0 protocol.
What should an identity architect use to fulfill this requirement?

A Canvas App Integration
B Connected App and OAuth Scopes
C OAuth Tokens
D Authentication Providers

A company’s external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?

A Create custom scopes and assign to the connected app.
B Define a permission set that grants access to the app and assign to authorized users.
C Leverage external objects and data classification policies.
D Select “Admin approved users are pre-authorized” and assign specific profiles.

Universal Container’s (UC) is using Salesforce Experience Cloud site for its container wholesale business. The identity architect wants to use an authentication provider for the new site.
Which two options should be utilized in creating an authentication provider? (Choose two.)

A A custom registration handler can be set.
B The default authentication provider certificate can be set.
C A custom error URL can be set.
D The default login user can be set.

Join Us Among the Stars

Certified Platform Identity and Access Management ArchitectPreview

About the Certified Platform Identity and Access Management Architect Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

That's the end of the Preview

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24