Salesforce Identity-and-Access-Management-Designer Actual Free Exam Questions & Community Discussion

Exam Code/Number: Identity-and-Access-Management-Designer
Exam Name/Title: Salesforce Certified Identity and Access Management Designer
Certification Provider: Salesforce
Corresponding Certification: Salesforce Identity and Access Management Designer

Exam Questions: 245
Updated On: Jun 03, 2026

Question #23

Which three types of attacks would a 2-Factor Authentication solution help garden against?

A. Key logging attacks

B. Dictionary attacks

C. Man-in-the-middle attacks

D. Network perimeter attacks

E. Phishing attacks

Discussion 0

Correct Answer: A,B,D Vote an answer

Question #24

How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

A. Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.

B. Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.

C. Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.

D. Add the list of company's network IP addresses to the Login Range list under 2FA Setup.

Discussion 0

Correct Answer: C Vote an answer

Question #25

The security team at Universal containers(UC) has identified exporting reports as a high-risk action and would like to require users to be logged into salesforce with their active directory (AD) credentials when doing so. For all other uses of Salesforce, Users should be allowed to use AD credentials or salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with salesforce credentials?

A. Use SAML Federated Authentication, treat SAML sessions as high assurance, and raise the session level required for exporting reports.

B. Use SAML Federated Authentication with a login flow to dynamically add or remove a permission set that grants the export reports permission.

C. Use SAML Federated Authentication and block access to reports when accesses through a standard assurance session.

D. Use SAML Federated Authentication and Custom SAML jit provisioning to dynamically add or remove a permission set that grants the Export Reports permission.

Discussion 0

Correct Answer: C Vote an answer

Question #26

Universal containers wants to set up SSO for a selected group of users to access external applications from salesforce through App launcher. Which three steps must be completed in salesforce to accomplish the goal?

A. Create connected apps for the external applications.

B. Complete single Sign-on settings in security controls.

C. Associate user profiles with the connected Apps.

D. Complete my domain and Identity provider setup.

E. Create named credentials for each external system.

Discussion 0

Correct Answer: A,C,D Vote an answer

Question #27

An insurance company has a connected app in its Salesforce environment that is used to integrate with a Google Workspace (formerly knot as G Suite).
An identity and access management (IAM) architect has been asked to implement automation to enable users, freeze/suspend users, disable users, and reactivate existing users in Google Workspace upon similar actions in Salesforce.
Which solution is recommended to meet this requirement?

A. Build an Apex trigger on the useriogin object to make asynchronous callouts to Google APIs.

B. Build a custom REST endpoint in Salesforce that Google Workspace can poll against.

C. Update the Security Assertion Markup Language Just-in-Time (SAML JIt; handler in Salesforce for user provisioning and de-provisioning.

D. Configure user Provisioning for Connected Apps.

Discussion 0

Correct Answer: D Vote an answer

Question #28

Universal Containers (UC) has a strict requirement to authenticate users to Salesforce using their mainframe credentials. The mainframe user store cannot be accessed from a SAML provider. UC would also like to have users in Salesforce created on the fly if they provide accurate mainframe credentials.
How can the Architect meet these requirements?

A. Implement OAuth User-Agent Flow on the mainframe; use a Registration Handler to create the user on the fly.

B. Use the SOAP API to create the user when created on the mainframe; implement Delegated Authentication.

C. Implement Just-In-Time Provisioning on the mainframe to create the user on the fly.

D. Use a Salesforce Login Flow to call out to a web service and create the user on the fly.

Discussion 0

Correct Answer: C Vote an answer

Question #29

Which three are features of federated Single sign-on solutions? Choose 3 Answers

A. It solves all identity and access management problems.

B. It federates credentials control to authorized applications.

C. It improves affiliated applications adoption rates.

D. It enables quick and easy provisioning and deactivating of users.

E. It establishes trust between Identity Store and Service Provider.

Discussion 0

Correct Answer: C,D,E Vote an answer

Question #30

Universal Containers (UC) wants its closed Won opportunities to be synced to a Data warehouse in near real time. UC has implemented Outbound Message to enable near real-time data sync. UC wants to ensure that communication between Salesforce and Target System is secure. What certificate is sent along with the Outbound Message?

A. The default client Certificate from the Develop--> API menu.

B. The CA-signed Certificate from the Certificate and Key Management Menu.

C. The Self-signed Certificates from the Certificate & Key Management menu.

D. The default client Certificate or the Certificate and Key Management menu.

Discussion 0

Correct Answer: A Vote an answer

Question #31

Universal Containers (UC) wants to build a few applications that leverage the Salesforce REST API. UC has asked its Architect to describe how the API calls will be authenticated to a specific user. Which two mechanisms can the Architect provide? Choose 2 Answers

A. Access Token

B. Refresh Token

C. Session ID

D. Authentication Token

Discussion 0

Correct Answer: A,B Vote an answer

Question #32

The CIO of universal containers(UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize Oauth 2.0. UC has listed an architect to analyze all of the applications that use Oauth flows to. See where refresh Tokens can be applied. Which two OAuth flows should the architect consider in their evaluation? Choose 2 answers

A. Jwt bearer token

B. Web server

C. Username-password

D. User-Agent

Discussion 0

Correct Answer: B,D Vote an answer

Question #33

An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?

A. Enable the Full Access Scope and then set the connected app access settings to "Admin Pre-Approved".

B. Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to 'Admin Pre-Approved".

C. Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to "User may self authorize".

D. Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to "Admin Pre-Approved".

Discussion 0

Correct Answer: D Vote an answer

Download Free Salesforce Identity-and-Access-Management-Designer Demo

Simply submit your e-mail address below to get started with our free demo of your Salesforce Identity-and-Access-Management-Designer exam.