Salesforce Identity-and-Access-Management-Architect - Salesforce Certified Identity and Access Management Architect

A Salesforce Administrator is tasked with setting up Just-in-Time (JIT) provisioning for SAML to enable Single Sign-On (SSO) for your organization. They have already configured the SAML settings for SSO in Salesforce.
What should be their next steps to enable JIT provisioning?

• A. Create a new permission set with JIT provisioning enabled, configure the necessary permissions, and assign the permission set to relevant users.
• B. Enable Just-in-Time User Provisioning in the SAML Single Sign-On Setting, configure the User Provisioning Type, and provide the SAML JIT Handler.
• C. Modify the organization-wide sharing settings to allow JIT provisioning, update the sharing rules for the user object.
• D. Create a new Apex class to handle JIT provisioning, implement the required methods, and assign the class to the appropriate user profiles.

An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:
1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioning in the integrated cloud applications.
2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).
Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

• A. Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.
• B. Configure Salesforce as a SAML service provider, and enable Just-In Time (JIT) provisioning and deprovisioning of users.
• C. Configure Salesforce as a SAML Service Provider, and enable SCIM (System for CrossDomain Identity Management) for provisioning and deprovisioning of users.
• D. Configure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.

Northern Trail Outfitters (NTO) is planning to implement a community for its customers using Salesforce Experience Cloud. Customers are not able to self-register. NTO would like to have customers set their own passwords when provided access to the community.
Which two recommendations should an identity architect make to fulfill this requirement?
Choose 2 answers

• A. Use Login Flows to allow users to reset password in Experience Cloud site.
• B. Allow Password reset using the API to update Experience Cloud site membership.
• C. Enable Welcome emails while configuring the Experience Cloud site.
• D. Add customers as contacts and add them to Experience Cloud site.

An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:
1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioning in the integrated cloud applications.
2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).
Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

• A. Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.
• B. Configure Salesforce as a SAML service provider, and enable Just-In Time (JIT) provisioning and deprovisioning of users.
• C. Configure Salesforce as a SAML Service Provider, and enable SCIM (System for CrossDomain Identity Management) for provisioning and deprovisioning of users.
• D. Configure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.

Universal Containers (UC) rolling out a new Customer Identity and Access Management Solution will be built on top of their existing Salesforce instance. Several service providers have been setup and integrated with Salesforce using OpenID Connect to allow for a seamless single sign-on experience. UC has a requirement to limit users to sign on directly from the Salesforce org to the external Service provider app that accepts OpenID Connect.
Which two steps should be done on the platform to satisfy the requirement?
Choose 2 answers

• A. Assign the connected app to the customer community, and enable the users profile in the Community settings.
• B. Manage which connected apps a user has access to by assigning authentication providers to the users profile.
• C. Use Profiles and Permission Sets to assign user access to Admin Pre-Approved Connected Apps.
• D. Set each of the Connected App access settings to Admin Pre-Approved.