Salesforce Identity-and-Access-Management-Designer Actual Free Exam Questions & Community Discussion

Exam Code/Number: Identity-and-Access-Management-Designer
Exam Name/Title: Salesforce Certified Identity and Access Management Designer
Certification Provider: Salesforce
Corresponding Certification: Salesforce Identity and Access Management Designer

Exam Questions: 245
Updated On: Jun 03, 2026

Question #12

universal container plans to develop a custom mobile app for the sales team that will use salesforce for authentication and access management. The mobile app access needs to be restricted to only the sales team. What would be the recommended solution to grant mobile app access to sales users?

A. Add a new identity provider to authenticate and authorize mobile users.

B. Use the permission set license to assign the mobile app permission to sales users

C. Use connected apps Oauth policies to restrict mobile app access to authorized users.

D. Use a custom attribute on the user object to control access to the mobile app

Discussion 0

Correct Answer: C Vote an answer

Question #13

A global company has built an external application that uses data from its Salesforce org via an OAuth 2.0 authorization flow. Upon logout, the existing Salesforce OAuth token must be invalidated.
Which action will accomplish this?

A. Use a HTTP POST to make a call to the revoke token endpoint.

B. Use a HTTP POST to request the refresh token for the current user.

C. Use a HTTP POST to the System for Cross-domain Identity Management (SCIM) endpoint, including the current OAuth token.

D. Enable Single Logout with a secure logout URL.

Discussion 0

Correct Answer: A Vote an answer

Question #14

Universal Containers allows employees to use a mobile device to access Salesforce for daily operations using a hybrid mobile app. This app uses Mobile software development kits (SDK), leverages refresh token to regenerate access token when required and is distributed as a private app.
The chief security officer is rolling out an org wide compliance policy to enforce re-venfication of devices if an employee has not logged in from that device in the last week.
Which connected app setting should be leveraged to comply with this policy change?

A. Refresh Token Policy - Expire the refresh token if it has not been used for 7 days.

B. Session Policy - Set timeout value of the connected app to 7 days.

C. Permitted User - Ask admins to maintain a list of users who are permitted based on last login date.

D. Scope - Deny refresh_token scope for this connected app.

Discussion 0

Correct Answer: A Vote an answer

Question #15

Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?

A. Verify that the Callback URL is correctly pointing to the new URI Scheme.

B. Confirm that the access Token's Time-To-Live policy has been set appropriately.

C. Validate that the users are checking the box to remember their passwords.

D. Check the Refresh Token policy defined in the Salesforce Connected App.

Discussion 0

Correct Answer: D Vote an answer

Question #16

An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM do to fulfill this requirement?

A. Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.

B. Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.

C. Confirm performance considerations with Salesforce Customer Support due to high peaks.

D. Create a default account for capturing all ecommerce contacts registered on the community because personAccount is not supported for this case.

Discussion 0

Correct Answer: C Vote an answer

Question #17

architect is troubleshooting some SAML-based SSO errors during testing. The Architect confirmed that all of the Salesforce SSO settings are correct. Which two issues outside of the Salesforce SSO settings are most likely contributing to the SSO errors the Architect is encountering? Choose 2 Answers

A. The clock on the Identity Provider server is twenty minutes behind Salesforce.

B. The Identity Provider is also used to SSO into five other applications.

C. The default language for the Identity Provider and Salesforce are Different.

D. The Issuer Certificate from the Identity Provider expired two weeks ago.

Discussion 0

Correct Answer: A,D Vote an answer

Question #18

Universal Containers (UC) wants to provide single sign-on (SSO) for a business-to-consumer (B2C) application using Salesforce Identity.
Which Salesforce license should UC utilize to implement this use case?

A. External Identity

B. Salesforce Platform

C. Identity Only

D. Partner Community

Discussion 0

Correct Answer: A Vote an answer

Question #19

What information does the 'Relaystate' parameter contain in sp-Initiated Single Sign-on?

A. Reference to a URL redirect parameter at the identity provider.

B. Reference to a URL redirect parameter at the service provider.

C. Reference to the login address URL of the identity Provider.

D. Reference to the login address URL of the service provider.

Discussion 0

Correct Answer: B Vote an answer

Question #20

Universal Containers (UC) plans to use a SAML-based third-party IdP serving both of the Salesforce Partner Community and the corporate portal. UC partners will log in 65* to the corporate portal to access protected resources, including links to Salesforce resources. What would be the recommended way to configure the IdP so that seamless access can be achieved in this scenario?

A. Configure IdP-initiated SSO that passes the SAML token upon Salesforce resource access request.

B. Configure SP-initiated SSO that passes the SAML token upon Salesforce resource access request.

C. Set up the corporate portal as a Connected App in Salesforce and use the User Agent OAuth flow.

D. Set up the corporate portal as a Connected App in Salesforce and use the Web server OAuth flow.

Discussion 0

Correct Answer: A Vote an answer

Question #21

Northern Trail Outfitters (NTO) uses Salesforce Experience Cloud sites (previously known as Customer Community) to provide a digital portal where customers can login using their Google account.
NTO would like to automatically create a case record for first time users logging into Salesforce Experience Cloud.
What should an Identity architect do to fulfill the requirement?

A. Configure an authentication provider for Social Login using Google and a custom registration handler.

B. Create an authentication provider for Social Login using Google and leverage standard registration handler.

C. Implement a login flow with a record create component for Case.

D. Implement a Just-in-Time handler class that has logic to create cases upon first login.

Discussion 0

Correct Answer: C Vote an answer

Question #22

Universal containers (UC) has built a custom based Two-factor Authentication (2fa) system for their existing on-premise applications. Thru are now implementing salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution an architect should consider?

A. Use custom login flows to connect to the existing custom 2fa system for use in salesforce.

B. Use the custom 2fa system for on-premise applications and native 2fa for salesforce.

C. Replace the custom 2fa system with salesforce 2fa for on-premise application and salesforce.

D. Replace the custom 2fa system with an app exchange app that supports on-premise applications and salesforce.

Discussion 0

Correct Answer: A Vote an answer

Download Free Salesforce Identity-and-Access-Management-Designer Demo

Simply submit your e-mail address below to get started with our free demo of your Salesforce Identity-and-Access-Management-Designer exam.