[Q96-Q120] Get up-to-date Real Exam Questions for Identity-and-Access-Management-Designer UPDATED [2026]

4.3/5 - (3 votes)

Get up-to-date Real Exam Questions for Identity-and-Access-Management-Designer UPDATED [2026]

Pass Salesforce Identity-and-Access-Management-Designer Exam in First Attempt Guaranteed

Salesforce Certified Identity-and-Access-Management-Designer certification is designed for professionals who want to demonstrate their expertise in designing and implementing identity and access management solutions using the Salesforce platform. Salesforce Certified Identity and Access Management Designer certification validates your knowledge and skills in areas such as user authentication, authorization, single sign-on, identity federation, and identity management.

QUESTION 96
Which two statements are capable of Identity Connect? Choose 2 answers

Synchronization of Salesforce Permission Set Licence Assignments.

Supports both Identity-Provider-Initiated and Service-Provider-Initiated SSO.

Support multiple orgs connecting to multiple Active Directory servers.

Automated user synchronization and de-activation.

QUESTION 97
Containers (UC) uses an internal system for recruiting and would like to have the candidates’ info available in the Salesforce automatically when they are selected. UC decides to use OAuth to connect to Salesforce from the recruiting system and would like to do the authentication using digital certificates. Which two OAuth flows should be considered to meet the requirement? Choose 2 answers

JWT Bearer Token flow

Refresh Token flow

SAML Bearer Assertion flow

Web Service flow

QUESTION 98
Universal Containers is budding a web application that will connect with the Salesforce API using JWT OAuth Flow.
Which two settings need to be configured in the connect app to support this requirement?
Choose 2 answers

The Use Digital Signature option in the connected app.

The “web” OAuth scope in the connected app,

The “api” OAuth scope in the connected app.

The “edair_api” OAuth scope m the connected app.

QUESTION 99
The security team at Universal Containers (UC) hasidentified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so.
For all other users of Salesforce, users should be allowed to use AD Credentials orSalesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?

Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session.

Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission.

Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports.

Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.

QUESTION 100
Northern Trail Outfitters want to allow its consumer to self-register on it business-to-consumer (B2C) portal that is built on Experience Cloud. The identity architect has recommended to use Person Accounts.
Which three steps need to be configured to enable self-registration using person accounts?
Choose 3 answers

Enable access to person and business account record types under Public Access Settings.

Contact Salesforce Support to enable business accounts.

Under Login and Registration settings, ensure that the default account field is empty.

Contact Salesforce Support to enable person accounts.

Set organization-wide default sharing for Contact to Public Read Only.

QUESTION 101
Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times and who logged in during non-business hours?

QUESTION 102
After a recent audit, universal containers was advised to implement Two-factor Authentication for all of their critical systems, including salesforce. Which two actions should UC consider to meet this requirement?
Choose 2 answers

Require users to provide their RSA token along with their credentials.

Require users to supply their email and phone number, which gets validated.

Require users to enter a second password after the first Authentication

Require users to use a biometric reader as well as their password

QUESTION 103
Universal Containers (UC) uses Salesforce to allow customers to keep track of the order status. The customers can log in to Salesforce using external authentication providers, such as Facebook and Google. UC is also leveraging the App Launcher to let customers access an of platform application for generating shipping labels. The label generator application uses OAuth to provide users access. What license type should an Architect recommend for the customers?

Customer Community license

Identity license

Customer Community Plus license

External Identity license

QUESTION 104
How should an Architect automatically redirect users to the login page of the external Identity provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login Page.

Enable the Redirect to the Identity Provider setting under Authentication Services on the My domain Configuration.

Remove the Login page from the list of Authentication Services on the My Domain configuration.

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the SAML Configuration.

QUESTION 105
Containers (UC) uses a legacy Employee portal for their employees to collaborate. Employees access the portal from their company’s internal website via SSO. It is set up to work with SiteMinder and Active Directory. The Employee portal has features to support posing ideas. UC decides to use Salesforce Ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to integrate Employee portal ideas with Salesforce idea through the API. What is the role of Salesforce in the context of SSO, based on this scenario?

Service Provider, because Salesforce is the application for managing ideas.

Connected App, because Salesforce is connected with Employee portal via API.

Identity Provider, because the API calls are authenticated by Salesforce.

An independent system, because Salesforce is not part of the SSO setup.

QUESTION 106
Universal containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use salesforce ideas and provide the ability for employees to post ideas from the company portal. They use SAML-BASED SSO to get into the company portal and would like to leverage it to access salesforce. Most of the users don’t exist in salesforce and they would like the user records created in salesforce communities the first time they try to access salesforce. What recommendation should an architect make to meet this requirement?

Use on-the-fly provisioning

Use just-in-time provisioning

Use salesforce APIs to create users on the fly

Use Identity connect to sync users

QUESTION 107
A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.
The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company’s on-premise application endpoint.
What should an Identity architect do to meet this requirement?

Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

Configure the company firewall to allow traffic from Salesforce IP ranges.

Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

Upload a third-party certificate from Salesforce into the on-premise server.

QUESTION 108
Universal Containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in Salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers

Disallow the use of Single Sign-on for any users of the mobile app.

Require High Assurance sessions in order to use the Connected App.

Set Login IP Ranges to the internal network for all of the app users Profiles.

Use Google Authenticator as an additional part of the login process

QUESTION 109
Which three types of attacks would a 2-Factor Authentication solution help garden against?

Key logging attacks

Network perimeter attacks

Phishing attacks

Dictionary attacks

Man-in-the-middle attacks

QUESTION 110
Universal containers (UC) employees have salesforce access from restricted ip ranges only, to protect against unauthorised access. UC wants to rollout the salesforce1 mobile app and make it accessible from any location.
Which two options should an architect recommend? Choose 2 answers

Relax the ip restriction in the connect app settings for the salesforce1 mobile app

Use login flow to bypass ip range restriction for the mobile app.

Relax the ip restriction with a second factor in the connect app settings for salesforce1 mobile app

Remove existing restrictions on ip ranges for all types of user access.

QUESTION 111
Northern Trail Outfitters (NTO) is planning to implement a community for its customers using Salesforce Experience Cloud . Customers are not able to self-register. NTO would like to have customers set their own passwords when provided access to the community.
Which two recommendations should an identity architect make to fulfill this requirement?
Choose 2 answers

Add customers as contacts and add them to Experience Cloud site.

Enable Welcome emails while configuring the Experience Cloud site.

Allow Password reset using the API to update Experience Cloud site membership.

Use Login Flows to allow users to reset password in Experience Cloud site.

QUESTION 112
Universal Containers (UC) has implemented SSO according to the diagram below. uses SAML while Salesforce Org 1 uses OAuth 2.0. Users usually start their day by first attempting to log into Salesforce Org 2 and then later in the day, they will log into either the Financial System or CPQ system depending upon their job position. Which two systems are acting as Identity Providers?

Financial System

Pingfederate

Salesforce Org 2

Salesforce Org 1

QUESTION 113
Universal Containers is creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow (this flow uses the OAuth 2.0 implicit grant type).
Which three OAuth concepts apply to this flow?
Choose 3 answers

Client ID

Refresh Token

Authorization Code

Verification Code

Scopes

QUESTION 114
Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were a part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app.
What should the Architect at UC first investigate?

Check the Refresh Token Policy defined in the Salesforce Connected App.

Confirm that the Access Token’s Time-To-Live policy has been set appropriately.

Verify that the Callback URL is correctly pointing to the new URI Scheme.

Validate that the users are checking the box to remember their passwords.

QUESTION 115
An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenano?

When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user’s Salesforce session Is revoked Immediately.

If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.

Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.

When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.

QUESTION 116
Universal Containers (UC) has five Salesforce orgs (UC1, UC2, UC3, UC4, UC5). of Every user that is in UC2, UC3, UC4, and UC5 is also in UC1, however not all users 65* have access to every org. Universal Containers would like to simplify the authentication process such that all Salesforce users need to remember one set of credentials. UC would like to achieve this with the least impact to cost and maintenance. What approach should an Architect recommend to UC?

Purchase a third-party Identity Provider for all five Salesforce orgs to use and set up JIT user provisioning on all other orgs.

Purchase a third-party Identity Provider for all five Salesforce orgs to use, but don’t set up JIT user provisioning for other orgs.

Configure UC1 as the Identity Provider to the other four Salesforce orgs and set up JIT user provisioning on all other orgs.

Configure UC1 as the Identity Provider to the other four Salesforce orgs, but don’t set up JIT user provisioning for other orgs.

QUESTION 117
Universal containers (UC) employees have salesforce access from restricted ip ranges only, to protect against unauthorised access. UC wants to rollout the salesforce1 mobile app and make it accessible from any location. Which two options should an architect recommend? Choose 2 answers

Relax the ip restriction in the connect app settings for the salesforce1 mobile app

Use login flow to bypass ip range restriction for the mobile app.

Relax the ip restriction with a second factor in the connect app settings for salesforce1 mobile app

Remove existing restrictions on ip ranges for all types of user access.

QUESTION 118
Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers

Delegated Authentication is enabled or disabled for the entire Salesforce org.

UC will be required to develop and support a custom SOAP web service.

Salesforce users will be locked out of Salesforce if the web service goes down.

The web service must reside on a public cloud service, such as Heroku.

QUESTION 119
Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financial system, and CPQ system. Below is the SSO implementation landscape.

What role combination is represented by the systems in this scenario”

Financial System and CPQ System are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are the only Service Providers.

Salesforce Org1 and Salesforce Org2 are acting as Identity Providers.

Salesforce Org1 and PingFederate are acting as Identity Providers.

QUESTION 120
Northern Trail Outfitters (NTO) believes a specific user account may have been compromised. NTO inactivated the user account and needs U perform a forensic analysis and identify signals that could Indicate a breach has occurred.
What should NTO’s first step be in gathering signals that could indicate account compromise?

Review the User record and evaluate the login and transaction history.

Download the Setup Audit Trail and review all recent activities performed by the user.

Download the Identity Provider Event Log and evaluate the details of activities performed by the user.

Download the Login History and evaluate the details of logins performed by the user.

Earning the Salesforce Certified Identity and Access Management Designer credential can help you stand out in a crowded job market. Salesforce Certified Identity and Access Management Designer certification is recognized globally and is highly valued by employers who require expertise in identity and access management. With this certification, you can demonstrate your commitment to professional development and your ability to create secure and efficient solutions that meet the unique needs of your organization or clients.

Salesforce Identity-and-Access-Management-Designer Study Guide Archives : https://www.dumpleader.com/Identity-and-Access-Management-Designer_exam.html

Leave a Reply Cancel reply