Identity-and-Access-Management-Designer Questions PDF [2026] Use Valid New dump to Clear Exam [Q123-Q142]

4.3/5 - (3 votes)

Identity-and-Access-Management-Designer Questions PDF [2026] Use Valid New dump to Clear Exam

Passing Salesforce Identity-and-Access-Management-Designer Exam Using 2026 Practice Tests

Salesforce Identity and Access Management Designer certification exam comprises 60 multiple-choice questions and is timed at 105 minutes. Identity-and-Access-Management-Designer exam is proctored and can be taken either in-person or remotely. To pass the exam, candidates must score at least 65% or higher. Identity-and-Access-Management-Designer exam fee is $400, and candidates can register for the exam through the Salesforce certification portal.

NEW QUESTION 123
Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HANA.
UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs.
Which two Salesforce license types does UC need for its employees’
Choose 2 answers

Company Community and Identity licenses

Identity and Identity Connect licenses

Chatter Only and Identity licenses

Salesforce and Identity Connect licenses

NEW QUESTION 124
what item should an architect consider when designing a Delegated Authentication implementation?

The web service should be able to accept one to four input method parameters.

The web service should use the salesforce Federation ID to identify the user.

The web service should be secured with TLS using Salesforce trusted certificates.

The web service should implement a custom password decryption method.

NEW QUESTION 125
Universal Containers (UC) is building an integration between Salesforce and a legacy web application using the Canvas framework. The security team for UC has determined that a signed request from Salesforce is not an adequate authentication solution for the third-party app.
Which two options should the Architect consider for authenticating the third-party app using the Canvas framework? (Choose two.)

Utilize Authorization Providers to allow the third-party application to authenticate itself against Salesforce as the IdP.

Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC’s IdP.

Create a registration handler Apex class to allow the third-party application to authenticate itself against Salesforce as the IdP.

Utilize the Canvas OAuth flow to allow the third-party application to authenticate itself against Salesforce as the IdP.

NEW QUESTION 126
Refer to the exhibit.

Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user’s brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?

For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.

Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.

Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.

NEW QUESTION 127
Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.
What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.

Build an integration that queries LDAP periodically and creates new active users in Salesforce.

Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at

NEW QUESTION 128
An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenano?

When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user’s Salesforce session Is revoked Immediately.

If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.

Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.

When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.

NEW QUESTION 129
Universal Containers (UC) uses Salesforce as a CRM and identity provider (IdP) for their Sales Team to seamlessly login to intemaJ portals. The IT team at UC is now evaluating Salesforce to act as an IdP for its remaining employees.
Which Salesforce license is required to fulfill this requirement?

External Identity

Identity Verification

Identity Connect

Identity Only

NEW QUESTION 130
Universal Containers (UC) is planning to deploy a custom mobile app that will allow users to get e-signatures from its customers on their mobile devices. The mobile app connects to Salesforce to upload the e-signature as a file attachment and uses OAuth protocol for both authentication and authorization. What is the most recommended and secure OAuth scope setting that an Architect should recommend?

Web

Api

Custom_permissions

NEW QUESTION 131
universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would like to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to achieve the goal?

Access Tokens

Refresh Tokens

Mobile PINS

Scopes

NEW QUESTION 132
Universal Containers (UC) has implemented a multi-org architecture in their company. Many users have licences across multiple orgs, and they are complaining about remembering which org and credentials are tied to which business process. Which two recommendations should the Architect make to address the Complaints?
Choose 2 answers

Activate My Domain to Brand each org to the specific business use case.

Implement SP-Initiated Single Sign-on flows to allow deep linking.

Implement IdP-Initiated Single Sign-on flows to allow deep linking.

Implement Delegated Authentication from each org to the LDAP provider.

NEW QUESTION 133
Universal containers (UC) would like to enable self – registration for their salesforcepartner community users.
UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate profile and account values. Which two actions should the architect recommend to UC? Choose 2 answers

Modify the communitiesselfregcontroller to assign the profile and account.

Modify the selfregistration trigger to assign profile and account.

Configure registration for communities to use a custom visualforce page.

Configure registrationfor communities to use a custom apex controller.

NEW QUESTION 134
How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

Use Custom Login Flows with Apex to detect the user’s IP address and prompt for 2FA if needed.

Add the list of company’s network IP addresses to the Login Range list under 2FA Setup.

Use an Apex Trigger on the UserLogin object to detect the user’s IP address and prompt for 2FA if needed.

Apply the “Two-factor Authentication for User Interface Logins” permission and Login IP Ranges for all Profiles.

NEW QUESTION 135
Universal Containers is creating a web application that will be secured by Salesforce Identity using the OAuth 2.0 Web Server Flow uses the OAuth 2.0 authorization code grant type).
Which three OAuth concepts apply to this flow?
Choose 3 answers

Verification URL

Client Secret

Access Token

Scopes

NEW QUESTION 136
After a recent audit, universal containers was advised to implement Two-factor Authentication for all of their critical systems, including salesforce. Which two actions should UC consider to meet this requirement?
Choose 2 answers

Require users to provide their RSA token along with their credentials.

Require users to supply their email and phone number, which gets validated.

Require users to enter a second password after the first Authentication

Require users to use a biometric reader as well as their password

NEW QUESTION 137
Which two considerations should be made when implementing Delegated Authentication?
Choose 2 answers

The authentication web service can include custom attributes.

It can be used to authenticate API clients and mobile apps.

It requires trusted IP ranges at the User Profile level.

Salesforce servers receive but do not validate a user’s credentials.

Just-in-time Provisioning can be configured for new users.

NEW QUESTION 138
Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process. Which two considerations should an architect point out to UC? Choose 2 answers

The web application should be hosted on a secure server.

The web server must be able to protect consumer privacy

The flow involves passing the user credentials back and forth.

The flow will not provide an Oauth refresh token back to the server.

NEW QUESTION 139
A global fitness equipment manufacturer is planning to sell fitness tracking devices and has the following requirements:
1) Customer purchases the device.
2) Customer registers the device using their mobile app.
3) A case should automatically be created in Salesforce and associated with the customers account in cases where the device registers issues with tracking.
Which OAuth flow should be used to meet these requirements?

OAuth 2.0 Asset Token Flow

OAuth 2.0 Username-Password Flow

OAuth 2.0 User-Agent Flow

OAuth 2.0 SAML Bearer Assertion Flow

NEW QUESTION 140
Containers (UC) has implemented SAML-based single Sign-on for their Salesforce application and is planning to provide access to Salesforce on mobile devices using the Salesforce1 mobile app. UC wants to ensure that Single Sign-on is used for accessing the Salesforce1 mobile App. Which two recommendations should the Architect make? Choose 2 Answers

Configure the Embedded Web Browser to use My Domain URL.

Configure the Salesforce1 App to use the MY Domain URL.

Use the existing SAML-SSO flow along with User Agent Flow.

Use the existing SAML SSO flow along with Web Server Flow.

NEW QUESTION 141
Which two security risks can be mitigated by enabling Two-Factor Authentication (2FA) in Salesforce?
Choose 2 answers

Users leaving laptops unattended and not logging out of Salesforce.

Users accessing Salesforce from a public Wi-Fi access point.

Users choosing passwords that are the same as their Facebook password.

Users creating simple-to-guess password reset questions.

NEW QUESTION 142
Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose. Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication?
Choose 2 answers

Salesforce license for sales users and Identity license for Marketing users

Salesforce license for sales users and External Identity license for Marketing users

Identity license for sales users and Identity connect license for Marketing users

Salesforce license for sales users and platform license for Marketing users.

To prepare for the Salesforce Identity and Access Management Designer certification exam, candidates should have a solid understanding of the Salesforce platform’s identity and access management capabilities, as well as industry-standard protocols and best practices. Salesforce offers a range of training and certification resources, including study guides, online courses, and practice exams, to help candidates prepare for the exam. Additionally, candidates can join the Salesforce Trailblazer Community to network with other professionals and learn from experts in the field.

Identity-and-Access-Management-Designer Study Guide Brilliant Identity-and-Access-Management-Designer Exam Dumps PDF: https://www.dumpleader.com/Identity-and-Access-Management-Designer_exam.html

Leave a Reply Cancel reply