Jun-2026 Free Identity-and-Access-Management-Architect Test Questions Real Practice Test Questions
Identity-and-Access-Management-Architect Dumps Updated Jun 24, 2026 WIith 244 Questions
Salesforce Certified Identity and Access Management Architect certification exam covers a wide range of topics including identity and access management concepts, Salesforce security architecture, user management, authentication and authorization, external identity providers, and more. Identity-and-Access-Management-Architect exam is designed to test the candidate's knowledge and understanding of these topics and their ability to apply them in real-world scenarios.
Salesforce Identity-and-Access-Management-Architect Certification Exam is a highly sought-after certification for professionals in the field of Identity and Access Management. Salesforce Certified Identity and Access Management Architect certification is offered by Salesforce, a leading customer relationship management (CRM) company that provides cloud-based applications for sales, service, and marketing. Salesforce Certified Identity and Access Management Architect certification exam is designed to test a candidate's knowledge and skills in designing and implementing secure identity and access management solutions using Salesforce products.
NEW QUESTION # 116
Northern Trail Outfitters (NTO) is planning to implement a community for its customers using Salesforce Experience Cloud. Customers are not able to self-register. NTO would like to have customers set their own passwords when provided access to the community.
Which two recommendations should an identity architect make to fulfill this requirement?
Choose 2 answers
- A. Use Login Flows to allow users to reset password in Experience Cloud site.
- B. Enable Welcome emails while configuring the Experience Cloud site.
- C. Add customers as contacts and add them to Experience Cloud site.
- D. Allow Password reset using the API to update Experience Cloud site membership.
Answer: A,D
Explanation:
Explanation
Allowing password reset using the API and using login flows are two possible ways to enable customers to set their own passwords in Experience Cloud. The other options are not relevant for this requirement, as they do not address the password issue. References: Allow Password Reset Using the API, Use Login Flows to Allow Users to Reset Passwords in Experience Cloud Sites
NEW QUESTION # 117
Universal Containers (UC) is setting up delegated authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risks of exposing the corporate login service on the internet and has asked that a reliable trust mechanism be put in place between the login service and Salesforce.
What mechanism should an Architect put in place to enable a trusted connection between the login service and Salesforce?
- A. Enforce mutual authentication between systems using SSL.
- B. Set up a proxy service for the login service in the DMZ.
- C. Require the use of Salesforce security tokens on passwords.
- D. Include Client Id and Client Secret in the login header callout.
Answer: C
NEW QUESTION # 118
An Architect has configured a SAML-based SSO integration between Salesforce and an external Identity provider and is ready to test it. When the Architect attempts to log in toSalesforce using SSO, the Architect receives a SAML error. Which two optimal actions should the Architect take to troubleshoot the issue?
- A. Ensure the Callback URL is correctly set in the Connected Apps settings.
- B. Paste the SAML Assertion Validator in Salesforce.
- C. Use the browser's Development tools to view the Salesforce page's markup.
- D. Use a browser that hasan add-on/extension that can inspect SAML.
Answer: B,D
Explanation:
these are the optimal actions to troubleshoot a SAML error. According to the Salesforce documentation1, you can use the following methods to debug a SAML error:
* Use a browser that has an add-on/extension that can inspect SAML. This will allow you to see the SAML request and response messages and identify any issues with the SAML assertion or the SAML response2.
* Paste the SAML Assertion Validator in Salesforce. This is a tool that helps you validate the last SAML operation on your organization and shows you any errors or warnings with the SAML assertion or the SAML response1.
Option A is incorrect because the Callback URL is not related to SAML SSO. The Callback URL is used for OAuth SSO, which is a different protocol3. Option D is incorrect because using the browser's Development tools to view the Salesforce page's markup will not help you debug a SAML error. The page's markup doesnot contain any information about the SAML request or response4.
References: 1: SAML Login Errors - Salesforce 2: How to Troubleshoota Single Sign-On Error | Salesforce Ben 3: Identity Providers and Service Providers - Salesforce 4: Single Sign-On - Salesforce
NEW QUESTION # 119
How should an Architect force user to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?
- A. Add the list of company's network IP addresses to the Login Range list under 2FA Setup.
- B. Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.
- C. Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.
- D. Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.
Answer: D
Explanation:
Using Custom Login Flows with Apex is the best option to force users to authenticatewith 2FA for Salesforce only when not connected to an internal company network. Custom Login Flows allow admins to customize the login process for different scenarios and user types2. Apex code can be used to detect the user'sIP address and prompt for 2FA if it is not within the company's network range3. The other options are not suitable because they either do not support 2FA or do not allow conditional logic based on the user's IP address.
NEW QUESTION # 120
Universal Containers wants to allow its customers to log in to its Experience Cloud via a third-party authentication provider that supports only the OAuth protocol.
What should an identity architect do to fulfill this requirement?
- A. Create a custom external authentication provider.
- B. Configure OpenID Connect authentication provider.
- C. Use certificate-based authentication.
- D. Contact Salesforce Support and enable delegate single sign-on.
Answer: A
Explanation:
If the third-party authentication provider supports only the OAuth protocol and not OpenID Connect,then an identity architect needs to create a custom external authentication provider for it. A custom external authentication provider is a configuration that allows users to log in to Salesforce using an external identity provider that is not predefined by Salesforce. It requires implementing the Auth.AuthProviderPlugin interface and defining the OAuth endpoints and parameters.
References: Custom External Authentication Providers, Create a Custom Authentication Provider
NEW QUESTION # 121
A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect (OIDC).
When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC or SAML?
- A. The SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider.
- B. They are equivalent protocols and there is no real reason to choose one over the other.
- C. If the user has a session on Salesforce, you do not want them to be prompted for a username and password when they login to the SP.
- D. OIDC is more secure than SAML and therefore is the obvious choice.
Answer: A
Explanation:
Explanation
When integrating a SP that supports both SAML and OIDC with Salesforce, the use case that is the determining factor when choosing OIDC or SAML is whether the SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider. OIDC is a protocol that allows users to authorize an external application to access Salesforce resources on their behalf. OIDC provides an access token that can be used to call Salesforce APIs. SAML is a protocol that allows users to authenticate and authorize with an external identity provider and access Salesforce resources. SAML does not provide an access token, but only a session ID that can be used for web-based access. Therefore, if the SP needs to perform API calls back to Salesforce, OIDC is the preferred choice over SAML. References: OpenID Connect, SAML, Authorize Apps with OAuth
NEW QUESTION # 122
Universal containers (UC) is setting up their customer Community self-registration process. They are uncomfortable with the idea of assigning new users to a default account record. What will happen when customers self-register in the community?
- A. The self-registration page will ask user to select an account.
- B. The self-registration page will create a new account record.
- C. The self-registration process will create a person Account record.
- D. The self-registration process will produce an error to the user.
Answer: C
Explanation:
When customers self-register in the community, the self-registration process will create a person account record. A person account is a special type of account that combines both account and contact information in one record. This allows customers to have their own individual accounts without being associated with a default account. Option A is not a good choice because the self-registration process will not produce an error to the user, unless there is some configuration or validation issue. Option B is not a good choice because the self-registration page will not ask user to select an account, unless it is customized to do so. Option D is not a good choice because the self-registration page will not create a new account record,unless it is customized to do so.
References: [How to Provision Salesforce Communities Users], [Salesforce Licensing]
NEW QUESTION # 123
An Identity and Access Management (IAM) architect is tasked with unifying multiple B2C Commerce sites and an Experience Cloud community with a single identity. The solution needs to support more than 1,000 logins per minute.
What should the IAM do to fulfill this requirement?
- A. Confirm performance considerations with Salesforce Customer Support due to high peaks.
- B. Configure both the community and the commerce sites as OAuth2 RPs (relying party) with an external identity provider.
- C. Create a default account for capturing all ecommerce contacts registered on the community because person Account is not supported for this case.
- D. Configure community as a Security Assertion Markup Language (SAML) identity provider and enable Just-in-Time Provisioning to B2C Commerce.
Answer: B
Explanation:
Explanation
According to the Salesforce documentation2, OAuth2 RPs (relying parties) are applications that use OAuth 2.0 for authentication and authorization with an external identity provider. This allows users to log in to multiple applications with a single identity provider account. The identity provider issues an access token to the relying party, which can be used to access protected resources on behalf of the user. This solution can support high volumes of logins per minute and unify multiple B2C Commerce sites and an Experience Cloud community with a single identity.
NEW QUESTION # 124
Universal Containers (UC) is both a Salesforce and Google Apps customer. The UC IT team would like to manage the users for both systems in a single place to reduce administrative burden. Which two optimal ways can the IT team provision users and allow Single Sign-on between Salesforce and Google Apps ? Choose 2 answers
- A. Use Identity Connect as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.
- B. Use a third-party product as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.
- C. Build a custom app running on Heroku as the Identity Provider that can sync user information between Salesforce and Google Apps.
- D. Use Salesforce as the Identity Provider and Google Apps as a Service Provider and configure User Provisioning for Connected Apps.
Answer: B,D
Explanation:
Explanation
B is correct because a third-party product can act as an Identity Provider (IdP) for both Salesforce and Google Apps and manage the user provisioning from a single place12. This reduces the administrative burden and provides a consistent user experience.
D is correct because Salesforce can act as an IdP and Google Apps can act as a Service Provider (SP) and they can use SAML or OpenID Connect for Single Sign-on (SSO)34. Salesforce also supports User Provisioning for Connected Apps, which allows the creation, update, and deactivation of users in Google Apps based on changes in Salesforce.
A is incorrect because building a custom app on Heroku as an IdP is not an optimal way to provision users and allow SSO. It would require more development and maintenance effort than using a third-party product or Salesforce as an IdP.
C is incorrect because Identity Connect is a tool that synchronizes users between Active Directory and Salesforce. It does not support Google Apps as a target system for user provisioning or SSO.
References: 1: Architect Journey: Identity and Access Management Trailmix - Trailhead 2: Free Salesforce Identity-and-Access-Management-Architect Questions ... 3: [Single Sign-On Implementation Guide Developer Documentation] 4: [Social Single Sign-On with OpenID Connect Salesforce Developer YouTube] :
[Authorize Apps with OAuth Trailblazer Community Documentation] : Identity Connect Implementation Guide Developer Documentation
NEW QUESTION # 125
The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.
What should be used and considered before recommending it as a solution on the Salesforce Platform?
- A. Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.
- B. Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.
- C. Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.
- D. OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.
Answer: C
Explanation:
Explanation
Embedded Login is a feature that allows Salesforce to embed a login widget into any web page, such as a service provider's site, to enable users to log in with their Salesforce credentials. However, Embedded Login relies on third-party cookies, which can cause browser compatibility issues and require users to adjust their browser settings. Therefore, this should be considered before recommending it as a solution on the Salesforce Platform. References: Embedded Login, Embedded Login Implementation Guide
NEW QUESTION # 126
Universal Containers (UC) has decided touse Salesforce as an Identity Provider for multiple external applications. UC wants to use the salesforce App Launcher to control the Apps that are available to individual users. Which three steps are required to make this happen?
- A. Set up Identity Connect to Synchronize user data.
- B. Add each connected Appto the App Launcher with a Start URL.
- C. Create a Connected App for each external application.
- D. Set up an Auth Provider for each External Application.
- E. Set up Salesforce as a SAML Idp with My Domain.
Answer: B,C,E
Explanation:
These are the steps required to enable Salesforce as a SAML Identity Provider and use the App Launcher to access external applications. According to the Salesforce documentation1, you need to:
* Enable Salesforce as a SAML Identity Provider with My Domain2.
* Create aConnected App for each external application that you want to integrate with Salesforce3.
* Add each Connected App to the App Launcher with a Start URL that points to the external application1.
Option B is incorrect because setting up an Auth Provider is not necessary for SAML SSO. Auth Providers are used for OAuth SSO, which isa different protocol4. Option D is incorrect because Identity Connect is a tool for synchronizing user data between Active Directory and Salesforce, which is not related to SSO or App Launcher5.
References: 1: App Launcher - Salesforce 2: Enable Salesforce as a SAML Identity Provider 3: Connected Apps Overview 4: Identity Providers and Service Providers - Salesforce 5: Identity Connect Overview
NEW QUESTION # 127
Universal Containers (UC) has aclassified information system that its call center team uses only when they are working on a case with a record type "Classified". They are only allowed to access the system when they own an open "Classified" case, and their access to the system is removedat all other times. They would like to implement SAML SSO with Salesforce as the Idp, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "Classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying access to the classified information system based on the open "classified" case record criteria?
- A. Use Apex trigger on case to dynamically assign permission Sets that Grant access when a user is assigned with an open "Classified" case, and remove it when the case is closed.
- B. Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.
- C. Use Salesforce reports to identify users that currently own open "Classified" cases and should be granted access to the Classified information system.
- D. Use a Common Connected App Handler using Apex to dynamically allow access tothe system based on whether the staff owns any open "Classified" Cases.
Answer: B
Explanation:
Custom SAML JIT Provisioning allows Salesforce to dynamically create or update user records in the classified information system based on the SAML assertion sent by Salesforce as the IdP. This way, the staff can access the system only when they have an open "Classified" case, and their access is revoked when they don't. Option A is incorrect because Salesforce reports are not a reliable way to grant or revoke access to the system, as they are not updated in real time and may not reflect the current status of the cases. Option B is incorrect because Apex triggers can only assign or remove permission sets within Salesforce, not in an external system. Option D is incorrect becausea Common Connected App Handler using Apex is used to customize the behavior of a connected app, not to control access to an external system based on user attributes. References: Custom SAML JIT Provisioning, Create a Custom Connected App Handler
NEW QUESTION # 128
Universal Containers (UC) wants its closed Won opportunities to be synced to a Data warehouse in near real time.UC has implemented Outbound Message to enable near real-time data sync. UC wants to ensure that communication between Salesforce and Target System is secure. What certificate is sent along with the Outbound Message?
- A. The Self-signed Certificates from the Certificate & Key Management menu.
- B. The CA-signed Certificate from the Certificate and Key Management Menu.
- C. The default client Certificate from the Develop--> API menu.
- D. The default client Certificate or the Certificate and Key Management menu.
Answer: D
Explanation:
The default client certificate or the certificate from the Certificate and Key Management menu is sent along with the outbound message. When sending outbound messages, Salesforce will present the CA-signed or self- signed certificate configured underSetup | Security Controls | Certificate and KeyManagement | API Client Certificate1. The default client certificate is a self-signed certificate that Salesforce generates for you when you enable outbound messages2. You can also create your own self-signed or CA-signed certificates and upload themto the Certificate and Key Management menu3. The certificate from the Develop | API menu is not usedfor outbound messages, but for SOAP API clients that need to authenticate with Salesforce4.
References: 1: Know more about all the SSL certificates that are supported by Salesforce 2: Setting Up Outbound Messaging 3: Create a Self-Signed Certificate 4: [Generate or Regenerate a Client Certificate]
NEW QUESTION # 129 
A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.
The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.
What should an Identity architect do to meet this requirement?
- A. Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.
- B. Configure the company firewall to allow traffic from Salesforce IP ranges.
- C. Upload a third-party certificate from Salesforce into the on-premise server.
- D. Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.
Answer: B
NEW QUESTION # 130
Universal containers (UC) is setting up their customer Community self-registration process. They are uncomfortable with the idea of assigning new users to a default account record. What will happen when customers self-register in the community?
- A. The self-registration page will ask user to select an account.
- B. The self-registration page will create a new account record.
- C. The self-registration process will create a person Account record.
- D. The self-registration process will produce an error to the user.
Answer: C
Explanation:
Explanation
When customers self-register in the community, the self-registration process will create a person account record. A person account is a special type of account that combines both account and contact information in one record. This allows customers to have their own individual accounts without being associated with a default account. Option A is not a good choice because the self-registration process will not produce an error to the user, unless there is some configuration or validation issue. Option B is not a good choice because the self-registration page will not ask user to select an account, unless it is customized to do so. Option D is not a good choice because the self-registration page will not create a new account record, unless it is customized to do so.
References: [How to Provision Salesforce Communities Users], [Salesforce Licensing]
NEW QUESTION # 131
Northern Trail Outfitters mar ages functional group permissions in a custom security application supported by a relational database and a REST service layer. Group permissions are mapped as permission sets in Salesforce.
Which action should an identity architect use to ensure functional group permissions are reflected as permission set assignments?
- A. Use a Login Flow to query SAML attributes and set permission sets.
- B. Use the Apex JIT handler to callout to the security application and set permission sets
- C. Use a Login Flow with invocable Apex to callout to the security application and set permission sets.
- D. Use the Apex Just-in-Time (JIT) handler to query the Security Assertion markup Language (SAML) attributes and set permission sets.
Answer: C
Explanation:
Explanation
Using a Login Flow with invocable Apex to callout to the security application and set permission sets allows the identity architect to dynamically assign or remove permission sets based on the functional group permissions in the custom security application. This ensures that the permission set assignments are consistent with the group permissions. References: Login Flows, Invocable Apex
NEW QUESTION # 132
Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose. Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication?
Choose 2 answers
- A. Salesforce license for sales users and Identity license for Marketing users
- B. Identity license for sales users and Identity connect license for Marketing users
- C. Salesforce license for sales users and platform license for Marketing users.
- D. Salesforce license for sales users and External Identity license for Marketing users
Answer: A,C
Explanation:
Explanation
The appropriate license type choices for sales and marketing users, given that Salesforce is using delegated authentication, are:
Salesforce license for sales users. This license type allows internal users, such as employees, to access standard and custom Salesforce objects and features, such as opportunities and reports. This license type also supports delegated authentication, which is a feature that allows Salesforce to delegate the authentication process to an external service by making a SOAP callout to a web service that verifies the user's credentials. This license type is suitable for sales users who use Salesforce for opportunity management and need to log in with delegated authentication.
Platform license for marketing users. This license type allows internal users to access custom Salesforce objects and features, such as custom apps and tabs. This license type also supports delegated authentication and single sign-on (SSO), which are features that allow users to log in with an external identity provider (IdP) or service provider (SP). This license type is suitable for marketing users who use a third-party application called Nest for lead nurturing and need to log in with SSO using Salesforce as the IdP or SP.
The other options are not appropriate license types for this scenario. Identity license for sales or marketing users would not allow them to access standard or custom Salesforce objects and features, as this license type only supports identity features, such as SSO and social sign-on. External Identity license for marketing users would not allow them to access custom Salesforce objects and features, as this license type is designed for external users, such as customers or partners, who access a limited set of standard and custom objects in a community. Identity Connect license for marketing users is not a valid license type, as Identity Connect is a desktop application that integrates Salesforce with Microsoft Active Directory (AD) and enables SSO between the two systems. References: [Salesforce Licenses], [Delegated Authentication], [Platform Licenses], [Single Sign-On], [External Identity Licenses], [Identity Connect]
NEW QUESTION # 133
......
Salesforce is a company that provides Customer Relationship Management (CRM) solutions to businesses of all sizes. One of the key features of Salesforce is its Identity and Access Management (IAM) system, which allows businesses to control who has access to their data and applications. To ensure that their IAM system is properly implemented, Salesforce has developed the Identity and Access Management Architect certification. Salesforce Certified Identity and Access Management Architect certification is designed for experienced architects who are responsible for designing and implementing IAM solutions that meet the needs of their organizations.
View All Identity-and-Access-Management-Architect Actual Free Exam Questions Updated: https://www.examsreviews.com/Identity-and-Access-Management-Architect-pass4sure-exam-review.html
Pass Authentic Salesforce Identity-and-Access-Management-Architect with Free Practice Tests and Exam Dumps: https://drive.google.com/open?id=109l1u_BfkaL8wtilSPw3V2_4X5tNb_2D