Identity-and-Access-Management-designer Salesforce Identity and Access Management Designer Free Demo Questions – Try Before You Buy

Question 1

How should an Architect automatically redirect users to the login page of the external Identity
provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

A

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login
Page.

B

Enable the Redirect to the Identity Provider setting under Authentication Services on the My
domain Configuration.

C

Remove the Login page from the list of Authentication Services on the My Domain configuration.

D

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the
SAML Configuration

Correct Answer: C

Explanation:

In an SP-initiated SAML SSO flow in Salesforce, when a user tries to access Salesforce (Service Provider), the system must automatically redirect the user to the external Identity Provider for authentication. This behavior is enabled through the My Domain authentication configuration, specifically by turning on the “Redirect to the Identity Provider” setting under Authentication Services. This ensures that instead of showing the Salesforce login page, users are seamlessly redirected to the IdP login page. Option A is incorrect because Visualforce pages are not required for SSO routing. Option C is incorrect because removing the login page does not control IdP redirection behavior. Option D is incorrect because marking an IdP as default is not what triggers automatic redirection in SP-initiated flows.

Question 2

How should an Architect automatically redirect users to the login page of the external Identity
provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

A

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login
Page.

B

Enable the Redirect to the Identity Provider setting under Authentication Services on the My
domain Configuration.

C

Remove the Login page from the list of Authentication Services on the My Domain configuration.

D

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the
SAML Configuration

Correct Answer: C

Explanation:

In an SP-initiated SAML SSO flow in Salesforce, when a user tries to access Salesforce (Service Provider), the system must automatically redirect the user to the external Identity Provider for authentication. This behavior is enabled through the My Domain authentication configuration, specifically by turning on the “Redirect to the Identity Provider” setting under Authentication Services. This ensures that instead of showing the Salesforce login page, users are seamlessly redirected to the IdP login page. Option A is incorrect because Visualforce pages are not required for SSO routing. Option C is incorrect because removing the login page does not control IdP redirection behavior. Option D is incorrect because marking an IdP as default is not what triggers automatic redirection in SP-initiated flows.

Question 3

Universal Containers (UC) has a classified information system that its call center team uses only
when they are working on a case with a record type "Classified"
. They are only allowed to access
the system when they own an open "Classified" case, and their access to the system is removed
at all other times. They would like to implement SAML SSO eith Salesforce as the Idp, and
automatically allow or deny the staff's access to the classified information system based on
whether they currently own an open "Classified" case record when they try to access the system
using SSO. What is the recommended solution for automatically allowing or denying the access to
the classified information system based on the open "classified" case record criteria?

A

Use Salesforce reports to identify users that currently own open "Classified" cases and should be granted access to the Classified information system.

B

Use Apex trigger on case to dynamically assign permission sets that grant access when a user is assigned an open "Classified" case, and remove it when the case is closed.

C

Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.

D

Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases.

Correct Answer: D

Explanation:

C is correct because Custom SAML Just-In-Time (JIT) provisioning allows Salesforce (as the Identity Provider) to make real-time decisions during the SSO login process by evaluating user attributes and business logic at authentication time. In this scenario, it can dynamically check whether the user currently owns an open “Classified” case and then include that logic in the SAML assertion to either grant or deny access to the external system immediately during login, which makes it the only option capable of enforcing access based on live record data at the moment of authentication.

Demo Salesforce Identity-and-Access-Management-designer Exam Questions

How should an Architect automatically redirect users to the login page of the external Identity
provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login
Page.

Enable the Redirect to the Identity Provider setting under Authentication Services on the My
domain Configuration.

Remove the Login page from the list of Authentication Services on the My Domain configuration.

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the
SAML Configuration

Correct Answer: C

How should an Architect automatically redirect users to the login page of the external Identity
provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login
Page.

Enable the Redirect to the Identity Provider setting under Authentication Services on the My
domain Configuration.

Remove the Login page from the list of Authentication Services on the My Domain configuration.

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the
SAML Configuration

Correct Answer: C

Use Salesforce reports to identify users that currently own open "Classified" cases and should be granted access to the Classified information system.

Use Apex trigger on case to dynamically assign permission sets that grant access when a user is assigned an open "Classified" case, and remove it when the case is closed.

Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.

Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases.

Correct Answer: D

Demo Practice Mode

Demo Salesforce Identity-and-Access-Management-designer Exam Questions

How should an Architect automatically redirect users to the login page of the external Identityprovider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider loginPage.

Enable the Redirect to the Identity Provider setting under Authentication Services on the Mydomain Configuration.

Remove the Login page from the list of Authentication Services on the My Domain configuration.

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on theSAML Configuration

Correct Answer: C

How should an Architect automatically redirect users to the login page of the external Identityprovider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider loginPage.

Enable the Redirect to the Identity Provider setting under Authentication Services on the Mydomain Configuration.

Remove the Login page from the list of Authentication Services on the My Domain configuration.

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on theSAML Configuration

Correct Answer: C

Use Salesforce reports to identify users that currently own open "Classified" cases and should be granted access to the Classified information system.

Use Apex trigger on case to dynamically assign permission sets that grant access when a user is assigned an open "Classified" case, and remove it when the case is closed.

Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.

Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases.

Correct Answer: D

Demo Practice Mode

How should an Architect automatically redirect users to the login page of the external Identity
provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login
Page.

Enable the Redirect to the Identity Provider setting under Authentication Services on the My
domain Configuration.

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the
SAML Configuration

How should an Architect automatically redirect users to the login page of the external Identity
provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?

Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login
Page.

Enable the Redirect to the Identity Provider setting under Authentication Services on the My
domain Configuration.

Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the
SAML Configuration