Northern Trail Outfitters recently acquired a company. Each company will retain its Identity Provider (IdP). Both companies rely extensively on Salesforce processes that send emails to users to take specific actions in Salesforce.

How should the combined companys' employees collaborate in a single Salesforce org, yet authenticate to the appropriate IdP?

A. Configure unique MyDomains for each company and have generated links use the appropriate MyDomam in the URL.

B. Have generated links append a querystnng parameter indicating the IdP. The login service will redirect to the appropriate IdP.

C. Have generated links be prefixed with the appropriate IdP URL to invoke an IdP-initiated Security Assertion Markup Language flow when clicked.

D. Enable each IdP as a login option in the MyDomain Authentication Service settings. Users will then click on the appropriate IdP button.

Universal containers (UC) has multiple salesforce orgs and would like to use a single identity provider to access all of their orgs. How should UC'S architect enable this behavior?

A. Ensure that users have the same email value in their user records in all of UC's salesforce orgs.

B. Ensure the same username is allowed in multiple orgs by contacting salesforce support.

C. Ensure that users have the same Federation ID value in their user records in all of UC's salesforce orgs.

D. Ensure that users have the same alias value in their user records in all of UC's salesforce orgs.

Universal Containers (UC) is rolling out its new Customer Identity and Access Management Solution built on top of its existing Salesforce instance. UC wants to allow customers to login using Facebook, Google, and other social sign-on providers.

How should this functionality be enabled for UC, assuming ail social sign-on providers support OpenID Connect?

A. Configure an authentication provider and a registration handler for each social sign-on provider.

B. Configure a single sign-on setting and a registration handler for each social sign-on provider.

C. Configure an authentication provider and a Just-In-Time (JIT) handler for each social sign-on provider.

D. Configure a single sign-on setting and a JIT handler for each social sign-on provider.

Universal containers (UC) uses a home-grown employee portal for their employees to collaborate. UC decides to use salesforce ideas to allow the employees to post ideas from the employee portal. When clicking some links in the employee portal, the users should be redirected to salesforce, authenticated, and presented with relevant pages. What scope should be requested when using the Oauth token to meet this requirement?

A. Web

B. Full

C. API

D. Visualforce

Universal Containers (UC) has implemented SAML-based SSO solution for use with their multi-org Salesforce implementation, utilizing one of the the orgs as the Identity Provider. One user is reporting that they can log in to the Identity Provider org but get a generic SAML error message when accessing the other orgs. Which two considerations should the architect review to troubleshoot the issue? Choose 2 answers

A. The Federation ID must be a valid Salesforce Username

B. The Federation ID must is case sensitive

C. The Federation ID must be in the form of an email address.

D. The Federation ID must be populated on the user record.

universal container plans to develop a custom mobile app for the sales team that will use salesforce for authentication and access management. The mobile app access needs to be restricted to only the sales team. What would be the recommended solution to grant mobile app access to sales users?

A. Use a custom attribute on the user object to control access to the mobile app

B. Use connected apps Oauth policies to restrict mobile app access to authorized users.

C. Use the permission set license to assign the mobile app permission to sales users

D. Add a new identity provider to authenticate and authorize mobile users.

In a typical SSL setup involving a trusted party and trusting party, what consideration should an Architect take into account when using digital certificates?

A. Use of self-signed certificate leads to lower maintenance for trusted party because multiple self-signed certs need to be maintained.

B. Use of self-signed certificate leads to higher maintenance for trusted party because they have to act as the trusted CA

C. Use of self-signed certificate leads to lower maintenance for trusting party because there is no trusted CA cert to maintain.

D. Use of self-signed certificate leads to higher maintenance for trusting party because the cert needs to be added to their truststore.

Universal Containers (UC) implemented SSO to a third-party system for their Salesforce users to access the App Launcher. UC enabled "User Provisioning" on the Connected App so that changes to user accounts can be synched between Salesforce and the third party system. However, UC quickly notices that changes to user roles in Salesforce are not getting synched to the third-party system. What is the most likely reason for this behaviour?

A. User Provisioning for Connected Apps does not support role sync.

B. Required operation(s) was not mapped in User Provisioning Settings.

C. The Approval queue for User Provisioning Requests is unmonitored.

D. Salesforce roles have more than three levels in the role hierarchy.

A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.

The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.

What should an Identity architect do to meet this requirement?

A. Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

B. Configure the company firewall to allow traffic from Salesforce IP ranges.

C. Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

D. Upload a third-party certificate from Salesforce into the on-premise server.

The CMO of an advertising company has invited an Identity and Access Management (IAM) specialist to discuss Salesforce out-of-box capabilities for configuring the company*s login and registration experience on Salesforce Experience Cloud.

The CMO is looking to brand the login page with the company's logo, background color, login button color, and dynamic right-frame from an external URL.

Which two solutions should the IAM specialist recommend?

Choose 2 answers

A. Use Experience Builder to build branded Reset and Forgot Password pages.

B. Build custom pages for branding requirements in Experience Cloud.

C. Build custom site pages for reset and forgot password features.

D. Login and Registration pages can be branded in the Community Administration settings.