Identity & Access Managment Set 2

Northern Trail Outfitters (NTO) uses the Customer 360 Platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information. What is the potential impact to the architecture if NTO decides to implement this feature?

• Passwordless authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record.

• If contactless user is upgraded to Community license, the contact record is automatically created And linked to the user record, but not associated with an Account.

• Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.

• registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.

A multinational industrial products manufacturer is planning to implement Salesforce CRM to manage their business. They have the following requirements: 1. They plan to implement Partner communities to provide access to their partner network. 2. They have operations in multiple countries and are planning to implement multiple Salesforce orgs. 3. Some of their partners do business in multiple countries and will need information from multiple Salesforce Communities. 4. They would like to provide a single login for their partners. How should an Identity Architect solution this requirement with limited custom development?

• Register partners in one org and access information from other orgs using APIS.

• Allow partners to choose the Salesforce org they need information from and use login flows to authenticate access.

• Consolidate Partner related information in a single org and provide access through Salesforce community.

• Create a partner login for the country of their operation and use SAML federation to provide access To other orgs.

Universal Containers want users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN. Which two options should an identity architect recommend to meet the requirement? Choose 2 answers

• Active Directory Password Sync Plugin

• Configure Cloud Provider Load Balancer

• Salesforce Identity Connect

• Salesforce Trigger & Field on Contact Object

A security architect is rolling out a new multi-factor authentication (MFA) mandate, where all employees must go through a secure authentication process before accessing Salesforce. There are multiple Identity Providers (IdP) in place and the architect is considering how the “Authentication Method Reference” field (AMR) in the Login History can help. Which two considerations should the architect keep in mind? Choose 2 answers

• Both OIDC and Security Assertion Markup Language (SAML) are supported but AMR must be Implemented at IdP.

• High-assurance sessions must be configured under Session Security Level Policies.

• Dependency on what is supported by OpenID Connect (OIDC) implementation at IdP.

• AMR field shows the authentication methods used at IdP.

Northern Trail Outfitters (NTO) utilizes a third-party cloud solution for an employee portal. NTO also owns Salesforce Service Cloud and would like employees to be able to login to Salesforce with their third-party portal credentials for a seamless experience. The third-party employee portal only supports OAuth. What should an identity architect recommend to enable single sign-on (SSO) between the portal and Salesforce?

• Create a custom external authentication provider.

• Add the third-party portal as a connected app.

• Configure SSO to use the third party portal as an identity provider.

• Configure Salesforce for Delegated Authentication.

Universal Containers allows employees to use a mobile device to access Salesforce for daily operations using a hybrid mobile app. This app uses Mobile software development kits (SDK), leverages refresh token to regenerate access token when required and is distributed as a private app. The chief security officer is rolling out an org wide compliance policy to enforce re-verification of devices if an employee has not logged in from that device in the last week. Which connected app setting should be leveraged to comply with this policy change?

• Session Policy – Set timeout value of the connected app to 7 days.

• Permitted User – Ask admins to maintain a list of users who are permitted based on last login date.

• Refresh Token Policy – Expire the refresh token if it has not been used for 7 days.

• Scope Deny refresh_token scope for this connected app

Northern Trail Outfitters (NTO) wants to improve its engagement with existing customers to boost customer loyalty. To get a better understanding of its customers, NTO establishes a single customer view including their buying behaviors, channel preferences and purchasing history. All of this information exists but is spread across different systems and formats. NTO has decided to use Salesforce as the platform to build a 360 degree view. The company already uses Microsoft Active Directory (AD) to manage its users and company assets. What should an Identity Architect do to provision, deprovision and authenticate users?

• Salesforce Identity is not needed since NTO uses Microsoft AD.

• Salesforce Identity can be included but NTO will be required to build a custom integration with Microsoft AD.

• Salesforce Identity is included in the Salesforce licenses so it does not need to be considered separately.

• Salesforce dentity can be included but NTO will require Identity Connect

Northern Trail Outfitters (NTO) recently purchased Salesforce Identity Connect to streamline user provisioning across Microsoft Active Directory (AD) and Salesforce Sales Cloud. NTO has asked an identity architect to identify which Salesforce security configurations can map to AD permissions. Which three Salesforce permissions are available to map to AD permissions? Choose 3 answers

• Profiles and Permission Sets

• Roles

• Public Groups

• Field-Level Security

• Sharing Rules

Northern Trail Outfitters (NTO) employees use a custom on-premise helpdesk application to request, approve, notify, and track access granted to various onpremises and cloud applications, including Salesforce. Salesforce is currently used to authenticate users. How should NTO provision Salesforce users as soon as they are approved in the helpdesk application with the approved profiles and permission sets?

• Have the helpdesk initiate an IdP-initiated Just-in-Time provisioning Security Assertion Markup Language flow.

• Use a login flow to query the helpdesk to validate user status.

• Use Salesforce Connect to integrate with the helpdesk application

• Build an integration that performs a remote call-in to the Salesforce SOAP or REST API.

Northern Trail Outfitters recently acquired a company. Each company will retain its Identity Provider (IdP). Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce. How should the combined companys’ employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?

• Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.

• Have generated links append a querystring parameter indicating the IdP. The login service will redirect to the appropriate IdP.

• Configure unique MyDomains for each company and have generated links use the appropriate MyDomain in the URL.

• Have generated links be prefixed with the appropriate IdP URL to invoke an Idp-initiated Security Assertion Markup Language flow when clicked.