Free Practice Salesforce Identity-and-Access-Management-Architect Exam Questions 2025

Stay ahead with 100% Free Salesforce Certified Identity and Access Management Architect (WI25) Identity-and-Access-Management-Architect Dumps Practice Questions

Page: 1 / 50

Total 250 Questions | Updated On: Jun 03, 2025

Add To Cart

Question 1

Universal Containers (UC) has an existing e-commerce platform and is implementing a new customer community. They do not want to force customers to register on both applications due to concern over the customers experience. It is expected that 25% of the e-commerce customers will utilize the customer community . The e-commerce platform is capable of generating SAML responses and has an existing REST-ful API capable of managing users. How should UC create the identities of its e-commerce users with the customer community?

A : Use SAML JIT in the Customer Community to create users when a user tries to login to the community from the e-commerce site.

B : Use the e-commerce REST API to create users when a user self-register on the customer community and use SAML to allow SSO.

C : Use a nightly batch ETL job to sync users between the Customer Community and the e-commerce platform and use SAML to allow SSO.

D : Use the standard Salesforce API to create users in the Community When a User is Created in the e-Commerce platform and use SAML to allow SSO.

Answer: A

Question 2

Northern Trail Outfitters would like to automatically create new employee users in Salesforce with an

appropriate profile that maps to its Active Directory Department.

How should an identity architect implement this requirement?

A : Use the createUser method in the Just-in-Time (JIT) provisioning registration handler to assign theappropriate profile.

B : Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign theappropriate profile.

C : Use a login flow to collect Security Assertion Markup Language attributes and assign the appropriateprofile during Just-In-Time(JIT) provisioning.

D : Make a callout during the login flow to query department from Active Directory to assign theappropriate profile.

Answer: B

Question 3

An Architect has configured a SAML-based SSO integration between Salesforce and an external Identity provider and is ready to test it. When the Architect attempts to log in to Salesforce using SSO, the Architect receives a SAML error. Which two optimal actions should the Architect take to troubleshoot the issue?

A : Ensure the Callback URL is correctly set in the Connected Apps settings.

B : Use a browser that has an add-on/extension that can inspect SAML.

C : Paste the SAML Assertion Validator in Salesforce.

D : Use the browser's Development tools to view the Salesforce page's markup.

Answer: B,C

Question 4

Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HANA. UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs. Which two Salesforce license types does UC need for its employees' Choose 2 answers

A : Company Community and Identity licenses

B : Identity and Identity Connect licenses

C : Chatter Only and Identity licenses

D : Salesforce and Identity Connect licenses

Answer: B,D

Question 5

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in

the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application

support teams to finish user deactivations. A terminated employee recently was able to login to NTO's

Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP

directory.

What should an identity architect recommend to prevent this from happening in the future?

A : Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

B : Configure an authentication provider to delegate authentication to the LDAP directory.

C : use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

D : Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Answer: B

Page: 1 / 50

Total 250 Questions | Updated On: Jun 03, 2025

Add To Cart