Identity & Access Managment Set 4

Northern Trail Outfitters is implementing a business-to-business (B2B) collaboration site using Salesforce Experience Cloud. The partners will authenticate with an existing identity provider and the solution will utilize Security Assertion Markup Language (SAML) to provide single sign-on to Salesforce. Delegated administration will be used in the Experience Cloud site to allow the partners to administer their users' access. How should a partner identity be provisioned in Salesforce for this solution?

• Create a contactless user.

• Create only a contact.

• Create a person account.

• Create a user and a related contact.

Northern Trail Outfitters (NTO) has a number of employees who do NOT need access Salesforce objects. The employees should sign in to a custom Benefits web app using their Salesforce credentials. Which license should the identity architect recommend to fulfill this requirement?

• Identity Connect License

• Identity Only License

• Identity Verification Credits Add-On License

• External Identity License

Northern Trail Outfitters (NTO) uses Salesforce Experience Cloud sites (previously known as Customer Community) to provide a digital portal where customers can login using their Google account. NTO would like to automatically create a case record for first time users logging into Salesforce Experience Cloud. What should an Identity architect do to fulfill the requirement?

• Implement a login flow with a record create component for Case.

• Create an authentication provider for Social Login using Google and leverage standard registration handler

• Implement a Just-in-Time handler class that has logic to create cases upon first login.

• Configure an authentication provider for Social Login using Google and a custom registration handler

A global company's Salesforce Identity Architect is reviewing its Salesforce production org login history and is seeing some intermittent Security Assertion Markup Language (SAML SSO) 'Replay Detected and Assertion Invalid' login errors. Which two issues would cause these errors? Choose 2 answers

• The certificate loaded into sso configuration does not match the certificate used by the IdP.

• The current time setting of the company's identity provider (IDP) and Salesforce platform is out of sync by more than eight minutes.

• The subject element is missing from the assertion sent to Salesforce

• The assertion sent to Salesforce contains an assertion ID previously used

A large consumer company is planning to create a community and will require login through the customers social identity. The following requirements must be met: 1. The customer should be able to login with any of their social identities, however Salesforce should only have one user per customer. 2. Once the customer has been identified with a social identity, they should not be required to authorize Salesforce. 3. The customers personal details from the social sign on need to be captured when the customer logs into Salesforce using their social identity. 3. If the customer modifies their personal details in the social site, the changes should be updated in Salesforce. Which two options allow the Identity Architect to fulfill the requirements? Choose 2 answers

• Redirect the user to a custom page that allows the user to select an existing social identity for login.

• Use the custom registration handler to link social identities to Salesforce identities.

• Use Login Flows to call an authentication registration handler to provision the user before logging the user into the community.

• Use authentication providers for social sign-on and use the custom registration handler to insert or update personal details.

Northern Trail Outfitters (NTO) uses the Customer 360 Platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information. What is the potential impact to the architecture if NTO decides to implement this feature?

• Custom registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.

• If contactless user is upgraded to Community license, the contact record is automatically created and linked to the user record, but not associated with an Account.

• Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.

• Passwordless authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record

Universal Containers uses Salesforce as an identity provider and Concur as the Employee Expense management system. The HR director wants to ensure Concur accounts for employees are created only after the appropriate approval in the Salesforce org. Which three steps should the identity architect use to implement this requirement? Choose 3 answers

• Create an approval process for a custom object associated with the provisioning flow

• Enable User Provisioning for the connected app

• Create an approval process for UserProvisioningRequest object associated with the provisioning flow.

• Create a connected app for Concur in Salesforce

• Create an approval process for User object associated with the provisioning flow

A company with 15,000 employees is using Salesforce and would like to take the necessary steps to highlight or curb fraudulent activity. Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times and who logged in during non-business hours?

• Login Report

• Login History

• Login Forensics

• Login Inspector

A manufacturer wants to provide registration for an Internet of Things (IoT) device with limited display input or capabilities. Which Salesforce OAuth authorization flow should be used?

• OAuth 2.0 Device Flow

• OAuth 2.0 JWT Bearer Flow

• OAuth 2.0 User-Agent Flow

• OAuth 2.0 Asset Token Flow

Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce? Choose 2 answers

• Request Salesforce Support to enable delegated authentication.

• Assign user "Is Single Sign-On Enabled" permission via profile or permission set.

• Once SSO is enabled, users are only able to login using Salesforce credentials.

• Enable My Domain and select "Prevent login from https://login.salesforce.com"