リアルなIdentity-and-Access-Management-Architectは100%カバー試験問題をゲット [2026年01月]
問題集まとめ概要はIdentity-and-Access-Management-Architect試験問題集はここ
Salesforce Identity-and-Access-Management-Architect試験は、Salesforceエコシステム内のIDおよびアクセス管理（IAM）の分野における専門家の知識とスキルをテストするように設計されています。この試験では、候補者がSalesforceの顧客向けに安全でスケーラブルで、準拠したIAMソリューションを設計および実装する能力を測定します。この認定は、IAMで豊富な経験を持ち、Salesforce IAMアーキテクチャの専門知識を検証しようとしている専門家向けです。
質問 # 102
Universal containers(UC) has implemented SAML-BASED single Sign-on for their salesforce application and is planning to provide access to salesforce on mobile devices using the salesforce1 mobile app. UC wants to ensure that single Sign-on is used for accessing the salesforce1 mobile app. Which two recommendations should the architect make? Choose 2 answers
- A. Configure the salesforce1 app to use the my domain URL
- B. Use the existing SAML SSO flow along with Web server flow
- C. Use the existing SAML SSO flow along with user agent flow.
- D. Configure the embedded Web browser to use my domain URL.
正解：A、C
質問 # 103
A division of a Northern Trail Outfitters (NTO) purchased Salesforce. NTO uses a third party identity provider (IdP) to validate user credentials against Its corporate Lightweight Directory Access Protocol (LDAP) directory. NTO wants to help employees remember as passwords as possible.
What should an identity architect recommend?
- A. Setup Salesforce as an Authentication Provider to the existing IdP.
- B. Use Salesforce connect to synchronize LDAP passwords to Salesforce.
- C. Setup Salesforce as an IdP to authenticate against the LDAP directory.
- D. Setup Salesforce as a Service Provider to the existing IdP.
正解：D
質問 # 104
Universal Containers (UC) has an existing web application that it would like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?
- A. Configure the web application as an item in the Salesforce App Launcher.
- B. Add the web application as a ConnectedApp using OAuth User-Agent flow.
- C. Rewrite the web application as a set of Visualforce pages and Apex code.
- D. Create a Canvas app and use Signed Requests to authenticate the users.
正解：D
解説：
Explanation
A Canvas app is a web application that can be embedded within Salesforce and access Salesforce data using the signed request authentication method. This method allows the Canvas app to receive a signed request that contains the context and OAuth token when it is loaded. The Canvas app can use the SDK to request a new or refreshed signed request on demand2. This way, the users do not need to re-authenticate when accessing the web application from Salesforce. References: Requesting a Signed Request, SAML Single Sign-On for Canvas Apps, Mastering Salesforce Canvas Apps
質問 # 105
Universal Containers wants to implement SAML SSO for their internal Salesforce users using a third-party IdP. After some evaluation, UC decides not to set up My Domain for their Salesforce org. How does that decision impact their SSO implementation?
- A. IdP-initiated SSO will not work.
- B. Either SP- or IdP-initiated SSO will work.
- C. Neither SP- nor IdP-initiated SSO will work.
- D. SP-initiated SSO will not work.
正解：C
質問 # 106
Universal Containers (UC) wants to build a mobile application that twill be making calls to the Salesforce REST API. UC's Salesforce implementation relies heavily on custom objects and custom Apex code. UC does not want its users to have to enter credentials every time they use the app. Which two scope values should an Architect recommend to UC? Choose 2 answers.
- A. Full
- B. Refresh_token
- C. Api
- D. Custom_permissions
正解：B、C
解説：
Explanation
The two scope values that an architect should recommend to UC are api and refresh_token. The api scope allows the app to access the Salesforce REST API and use custom objects and custom Apex code. The refresh_token scope allows the app to obtain a refresh token that can be used to get new access tokens without requiring the user to re-enter credentials. Option A is not a good choice because the custom_permissions scope allows the app to access custom permissions in Salesforce, but it does not affect how the app can access the REST API or avoid user re-authentication. Option D is not a good choice because the full scope allows the app to access all data accessible by the user, including the web UI and the API, but it may be unnecessary or insecure for UC's requirement. References: OAuth 2.0 Web Server Authentication Flow, Digging Deeper into OAuth 2.0 on Force.com
質問 # 107
Universal containers want to build a custom mobile app connecting to salesforce using Oauth, and would like to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to achieve the goal?
- A. Access Tokens
- B. Mobile pins
- C. Scopes
- D. Refresh Tokens
正解：C
解説：
Explanation
The OAuth feature of Salesforce that should be used to restrict the types of resources mobile users can access is scopes. Scopes are parameters that specify the level of access that the mobile app requests from Salesforce when it obtains an OAuth token. Scopes can be used to limit the access to certain resources or actions, such as API calls, full access, web access, or refresh token. By configuring scopes in the connected app settings, Universal Containers can control what the mobile app can do with the OAuth token and protect against unauthorized or excessive access.
References: [OAuth Scopes], [Connected Apps], [OAuth Authorization Flows]
質問 # 108
Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?
- A. Use salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.
- B. Use an appexchange product that does fingerprint scanning with native salesforce identity confirmation.
- C. Use custom login flows with callouts to a third-party fingerprint scanning application.
- D. Use Delegated Authentication with callouts to a third-party fingerprint scanning application.
正解：C
質問 # 109
Universal Containers wants to secure its Salesforce APIs by using an existing Security Assertion Markup Language (SAML) configuration supports the company's single sign-on process to Salesforce, Which Salesforce OAuth authorization flow should be used?
- A. OAuth 2.0 SAML Bearer Assertion Flow
- B. A SAML Assertion Row
- C. OAuth 2.0 User-Agent Flow
- D. OAuth 2.0 JWT Bearer Flow
正解：B
質問 # 110
Universal Containers is implementing a new Experience Cloud site and the identity architect wants to use dynamic branding features as of the login process.
Which two options should the identity architect recommend to support dynamic branding for the site?
Choose 2 answers
- A. To use dynamic branding, the community must be built with the Visuaiforce + Salesforce Tabs template.
- B. An external content management system (CMS) must be used for dynamic branding on Experience Cloud sites.
- C. To use dynamic branding, the community must be built with the Customer Account Portal template.
- D. An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand.
正解：C、D
質問 # 111
Refer to the exhibit.
Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts.
A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site.
NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization.
what should an identity architect do to fulfill the above requirements?
- A. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.
- B. For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.
- C. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.
- D. Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.
正解：C
質問 # 112
Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Amazon credentials.
What should an identity architect recommend to meet these requirements?
- A. Configure a predefined authentication provider for Amazon.
- B. Configure Amazon as a connected app.
- C. Configure an OpenID Connect Authentication Provider for Amazon.
- D. Create a custom external authentication provider for Amazon.
正解：C
質問 # 113
A web service is developed that allows secure access to customer order status on the Salesforce Platform. The service connects to Salesforce through a connected app with the web server flow. The following are the required actions for the authorization flow:
1. User Authenticates and Authorizes Access
2. Request an Access Token
3. Salesforce Grantsan Access Token
4. Request an Authorization Code
5. Salesforce Grants Authorization Code
What is the correct sequence for the authorization flow?
- A. 2, 1, 3, 4, 5
- B. 1, 4, 5, 2, 3
- C. 4,5,2, 3, 1
- D. 4, 1, 5, 2, 3
正解：D
解説：
The web server flow is an OAuth2.0 authorization code grant type, which follows this sequence of steps:
* The client app requests an authorization code from Salesforce by redirecting the user to the authorization endpoint.
* The user authenticates and authorizes access to the client app.
* Salesforce grants an authorization code and redirects the user back to the client app.
* The client app requests an access token from Salesforce by sending the authorization code to the token endpoint.
* Salesforce grants an access token and a refresh token tothe client app.
References: OAuth Authorization Flows, Authorize Apps with OAuth
質問 # 114
A group of users try to access one of Universal Containers' Connected Apps and receive the following error message: " Failed: Not approved for access." What is the most likely cause of this issue?
- A. The User of High Assurance sessions are required for the Connected App.
- B. The Salesforce Administrators have revoked the OAuth authorization.
- C. The Connected App settings "All users may self-authorize" is enabled.
- D. The Users do not have the correct permission set assigned to them.
正解：D
解説：
Explanation
The underlying mechanisms that the UC Architect must ensure are part of the product are Just-in-Time (JIT) provisioning and deprovisioning. JIT provisioning is a process that creates or updates user accounts in Salesforce when users log in with SAML single sign-on (SSO)6. JIT deprovisioning is a process that disables or deletes user accounts in Salesforce when users are removed from the identity provider (IdP). Both of these processes enable automated provisioning and deprovisioning of users without requiring manual intervention or synchronization. The other options are not valid mechanisms for provisioning and deprovisioning. SOAP API is an application programming interface that allows developers to create, retrieve, update, or delete records in Salesforce. However, SOAP API does not support JIT provisioning or deprovisioning, and requires custom code to implement. Provisioning API is not a standard term for Salesforce, and there is no such API that supports both provisioning and deprovisioning.
References: Just-in-Time Provisioning for SAML, [Just-in-Time Deprovisioning], [SOAP API Developer Guide]
質問 # 115
A company's external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?
- A. Define a permission set that grants access to the app and assign to authorized users.
- B. Leverage external objects and data classification policies.
- C. Select "Admin approved users are pre-authonzed" and assign specific profiles.
- D. Create custom scopes and assign to the connected app.
正解：D
質問 # 116
Universal Containers would like its customers to register and log in to a portal built on Salesforce Experience Cloud. Customers should be able to use their Facebook or Linkedln credentials for ease of use.
Which three steps should an identity architect take to implement social sign-on?
Choose 3 answers
- A. Update the default registration handlers to create and update users.
- B. Check "Facebook" and "Linkedln" under Login Page Setup.
- C. Enable "Federated Single Sign-On Using SAML".
- D. Create authentication providers for both Facebook and Linkedln.
- E. Register both Facebook and Linkedln as connected apps.
正解：A、B、D
解説：
To implement social sign-on for customers to register and log in to a portal built on Salesforce Experience Cloud using their Facebook or LinkedIn credentials, the identity architect should take three steps:
* Create authentication providers for both Facebook and LinkedIn. Authentication providers are configurations that enable users to authenticatewith an external identity provider and access Salesforce resources. Salesforce provides predefined authentication providers for some common identity providers, such as Facebook and LinkedIn, which can be easily configured with minimal customization.
* Check"Facebook" and "LinkedIn" under Login Page Setup. Login Page Setup is a setting that allows administrators to customize the login page for Experience Cloud sites. By checking "Facebook" and
"LinkedIn", the identity architect can enable social sign-on buttons for these identity providers on the login page.
* Update the default registration handlers to create and update users. Registration handlers are classes that implement the Auth.RegistrationHandler interface and define how to create or update users in Salesforce based on the information from the external identity provider. The identity architect can update the default registration handlers to link the user's social identity with their Salesforce identity and prevent duplicate accounts. References: Authentication Providers, Social Sign-On with Authentication Providers, Login Page Setup, Create a Custom Registration Handler
質問 # 117
Universal Containers (UC) has a Customer Community that uses Facebook for Authentication. UC would like to ensure that Changes in the Facebook profile are reflected on the appropriate Customer Community user:
How can this requirement be met?
- A. Use the updateUser method on the registration Handler Class.
- B. Use information in the signed Request that is received from facebook.
- C. Develop a scheduled job that calls out to Facebook on anightly basis.
- D. Use SAML Just-In-Time Provisioning between Facebook and Salesforce.
正解：A
解説：
The best option for UC to ensure that changes in the Facebook profile are reflected onthe appropriate customer community user is to use the updateUser method on the registration handler class. A registration handler class is an Apex class that implements the Auth.RegistrationHandler interface and defines the logic for creating or updating auser account when a user logs in with an external authentication provider, such as Facebook. The updateUser method is a method in the registration handler class that takes a user ID and a JSON string as parameters and updates the user record with the information from the JSON string. This method can be used to update the user's profile, email, name, or other attributes based on the changes in the Facebook profile. The other options are not optimal for this scenario. Developing a scheduled job that calls out to Facebook on a nightly basis would introduce a delay in updating the user information and require custom code and API integration. Using information in the signed request that is received from Facebook would only provide limited information about the user, such as name, email, and locale, and not reflect any changes made after the initial login. Using SAML Just-in-Time provisioning between Facebook and Salesforce would require UC to configure Facebook as a SAML identity provider, which is not supportedby Facebook. References: [Create a Registration Handler Class], [Auth.RegistrationHandler Interface],
[Facebook Signed Request], [Facebook as SAML Identity Provider]
質問 # 118
A security architect is rolling out a new multi-factor authentication (MFA) mandate, where all employees must go through a secure authentication process before accessing Salesforce. There are multiple Identity Providers (IdP) in place and the architect is considering how the "Authentication Method Reference" field (AMR) in the Login History can help.
Which two considerations should the architect keep in mind?
Choose 2 answers
- A. AMR field shows the authentication methods used at IdP.
- B. Both OIDC and Security Assertion Markup Language (SAML) are supported but AMR must be implemented at IdP.
- C. Dependency on what is supported by OpenID Connect (OIDC) implementation at IdP.
- D. High-assurance sessions must be configured under Session Security Level Policies.
正解：A、B
解説：
Explanation
The AMR field in the Login History shows the authentication methods used at the IdP level, such as password, MFA, or SSO. Both OIDC and SAML are supported protocols for SSO, but the IdP must implement the AMR attribute and pass it to Salesforce. References: Secure Your Users' Identity, Salesforce Multi-Factor Authentication (MFA) and Single Sign-on (SSO)
質問 # 119
Which two capabilities does My Domain enable in the context of a SAML SSOconfiguration? Choose 2 answers
- A. App Launcher
- B. Login Forensics
- C. SSO from Salesforce Mobile App
- D. Resource deep linking
正解：C、D
解説：
These are two capabilities that My Domain enables in the context of a SAML SSO configuration. My Domain is a feature that lets you customize your Salesforce domain name and login page1. Resource deep linking is the ability to access a specific page or resource within Salesforce directly from a link, without having to navigate through the app2. SSO from Salesforce Mobile App is the ability to log in to the Salesforce Mobile App using your SSO credentials, without having to enter your username and password3. My Domain enables these capabilities by allowing you to specify your identity provider (IdP) and SSO settings for your unique domain name, and by providing a custom login URL that can be used for deep linking and mobile app login1.
The other options are notcorrect for this question because:
* App Launcher is a feature that lets you access all your connected apps from one place in Salesforce. It does not require My Domain or SAML SSO to work, although it can be enhanced by using them.
* Login Forensics is a feature that analyzes login behavior and identifies anomalous or suspicious logins.
It does not require My Domain or SAML SSO to work, although it can be used with them.
References: MyDomain, Deep Linking into Salesforce, Salesforce Mobile AppBasics, [App Launcher],
[Login Forensics]
質問 # 120
Universal Containers (UC) would like to enable self-registration for their Salesforce Partner Community Users. UC wants to capture some custom data elements from the partner user, and based on these data elements, wants to assign the appropriate Profile and Account values.
Which two actions should the Architect recommend to UC1
Choose 2 answers
- A. Modify the SelfRegistration trigger to assign Profile and Account.
- B. Modify the CommunitiesSelfRegController to assign the Profile and Account.
- C. Configure Registration for Communities to use a custom Visualforce Page.
- D. Configure Registration for Communitiesto use a custom Apex Controller.
正解：B、D
解説：
To enable self-registration for partner community users, UC should modify the CommunitiesSelfRegController class to assign the Profile and Account values based on the custom data elements captured from the partner user. UC should also configure Registration for Communities to use a custom Apex controller that extends the CommunitiesSelfRegController class and overrides the default registration logic3.
References:
Customize Self-Registration
質問 # 121
......
Salesforceの認定アイデンティティアンドアクセスマネジメントアーキテクトの認定資格は、アイデンティティとアクセス管理で専門知識を構築し、組織がセキュアでスケーラブルなシステムを構築するのを支援したいと考える専門家にとって優れた選択肢です。適切な準備と献身をすれば、候補者はこの試験に合格してこの貴重な認定資格を取得することができます。
Salesforce Identity-and-Access-Management-Architect認定は、Salesforceエコシステム内のアクセスとアイデンティティの管理に関する専門知識を実証したい専門家にとって貴重な資格です。認定試験は、アイデンティティ管理、アクセス管理、シングルサインオン、セキュリティプロトコルなど、幅広いトピックで候補者をテストするように設計されています。試験に合格した人は、Salesforce認定IDおよびアクセス管理アーキテクトのタイトルを獲得します。これは、業界全体で専門知識とプロフェッショナリズムの印として認識されています。
認定トレーニングはIdentity-and-Access-Management-Architect試験問題集テストエンジン：https://www.passtest.jp/Salesforce/Identity-and-Access-Management-Architect-shiken.html
Identity-and-Access-Management-Architectトレーニングと認定最新のIdentity and Access Management Designer問題をゲットせよ：https://drive.google.com/open?id=1SpAvVpqiPrMSP8PILPfO4lHl1Kc17LJ5