PASS Identity-and-Access-Management-Architect exam with Salesforce Real Exam Questions - 100% Valid!
Actual Identity-and-Access-Management-Architect Exam Recently Updated Questions with Free Demo
Achieving the Salesforce Certified Identity and Access Management Architect certification is a significant accomplishment in the career of a Salesforce professional. Salesforce Certified Identity and Access Management Architect certification demonstrates that the candidate has the skills and knowledge required to design and implement secure and scalable identity and access management solutions for complex enterprise environments. It also helps professionals stand out in a competitive job market and opens up new career opportunities. By pursuing this certification, professionals can gain valuable skills and knowledge that can help them advance in their careers and make a meaningful impact in their organizations.
To obtain the Salesforce Certified Identity and Access Management Architect certification, candidates must pass the Identity-and-Access-Management-Architect exam. Identity-and-Access-Management-Architect exam consists of 60 multiple-choice questions, and candidates are given two hours to complete it. Identity-and-Access-Management-Architect exam is proctored, and candidates can take it online or at a testing center. Salesforce Certified Identity and Access Management Architect certification is valid for two years, and candidates must complete the maintenance requirements to keep their certification current. The Salesforce Certified Identity and Access Management Architect certification is a valuable credential for professionals who want to advance their careers in identity and access management.
To become a Salesforce Certified Identity and Access Management Architect, candidates must pass the Identity-and-Access-Management-Architect Exam. Salesforce Certified Identity and Access Management Architect certification is best suited for experienced IT professionals who have a deep understanding of Salesforce identity and access management concepts and principles. Identity-and-Access-Management-Architect exam consists of multiple-choice questions and takes approximately three hours to complete. Candidates must score at least 65% to pass the exam.
NEW QUESTION # 19
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have been purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers
- A. Set jp an external login page and call Salesforce APIs for user creation.
- B. Select the "Configurable Self-Reg Page" option under Login & Registration.
- C. Customize me self-registration Apex handler to create only the user record.
- D. Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.
- E. Enable "Allow customers and partners to self-register".
Answer: B,C,E
Explanation:
Explanation
Enabling "Allow customers and partners to self-register" allows guests to create their own user accounts in the portal. Selecting the "Configurable Self-Reg Page" option allows the administrator to customize the self-registration page to capture the required fields. Customizing the self-registration Apex handler to create only the user record prevents the automatic creation of a contact record until verification. References: Enable Self-Registration, Customize Self-Registration
NEW QUESTION # 20
Containers (UC) uses a legacy Employee portal for their employees to collaborate. Employees access theportal from their company's internal website via SSO. It is set up to work with SiteMinder and Active Directory. The Employee portal has features to support posing ideas. UC decides to use Salesforce Ideas for voting and better tracking purposes. To avoidprovisioning users on Salesforce, UC decides to integrate Employee portal ideas with Salesforce idea through the API. What is the role of Salesforce in the context of SSO, based on this scenario?
- A. Service Provider, because Salesforce is the applicationfor managing ideas.
- B. Connected App, because Salesforce is connected with Employee portal via API.
- C. An independent system, because Salesforce is not part of the SSO setup.
- D. Identity Provider, because the API calls are authenticated by Salesforce.
Answer: C
Explanation:
D is correct because Salesforce is an independent system that is not part of the SSO setup between the Employee portal and Active Directory. Salesforce does not act as an IdP or an SP for the SSO, nor does it use a connected app to integrate withthe Employee portal. Salesforce only exposes its API to allow the Employee portal to access its ideas feature.
A is incorrect because Salesforce is not a service provider for the SSO. The SSO is between the Employee portal and Active Directory, not between the Employee portal and Salesforce.
B is incorrect because Salesforce is not a connected app for the SSO. A connected app is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect1. The Employee portal does not use any of these protocols to integrate with Salesforce, but only uses its API.
C is incorrect because Salesforce is not an identity provider for the SSO. The IdP is the system that authenticates users and issues tokens or assertions to allow access to other systems. In this scenario, theIdP is Active Directory, not Salesforce.
References: 1: Oauth Authorization flows in Salesforce - Apex Hours
NEW QUESTION # 21
Universal Containers (UC) has built a custom time tracking app for its employee. UC wants to leverage Salesforce Identity to control access to the custom app.
At a minimum, which Salesforce license is required to support this requirement?
- A. Identity Connect
- B. External Identity
- C. Identity Verification
- D. Identity Only
Answer: D
NEW QUESTION # 22
A global fitness equipment manufacturer uses Salesforce to manage its sales cycle. The manufacturer has a custom order fulfillment app that needs to request order data from Salesforce. The order fulfillment app needs to integrate with the Salesforce API using OAuth 2.0 protocol.
What should an identity architect use to fulfill this requirement?
- A. OAuth Tokens
- B. Canvas App Integration
- C. Connected App and OAuth scopes
- D. Authentication Providers
Answer: C
Explanation:
Explanation
To integrate the order fulfillment app with the Salesforce API using OAuth 2.0 protocol, the identity architect should use a Connected App and OAuth scopes. A Connected App is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as OAuth 2.0. OAuth scopes are permissions that define the specific data that an external application can access or modify in Salesforce. To use OAuth 2.0 protocol, the identity architect needs to configure a Connected App in Salesforce and assign the appropriate OAuth scopes to it, such as "api" or "full". References: Connected Apps, OAuth Scopes
NEW QUESTION # 23
A division of a Northern Trail Outfitters (NTO) purchased Salesforce. NTO uses a third party identity provider (IdP) to validate user credentials against Its corporate Lightweight Directory Access Protocol (LDAP) directory. NTO wants to help employees remember as passwords as possible.
What should an identity architect recommend?
- A. Setup Salesforce as an Authentication Provider to the existing IdP.
- B. Setup Salesforce as a Service Provider to the existing IdP.
- C. SetupSalesforce as an IdP to authenticate against the LDAP directory.
- D. Use Salesforce connect to synchronize LDAP passwords to Salesforce.
Answer: B
Explanation:
To help employees remember fewer passwords, an identity architect should recommend setting up Salesforce as a service provider (SP) to the existing IdP. A SP is the system that relies on the IdP for authentication and provides access to its services based on the SAML assertions from the IdP. Toset up Salesforce as a SP, you need to create a connected app for Salesforce in the IdP, enable SAML and configure the SAML settings, such as the entity ID, ACS URL, and subject type. You also need to enable SSO for your Salesforce org, upload the IdP certificate, and configure the SSO settings, such as the issuer, identity type, and service provider initiated request binding.
References:
[SAML Single Sign-On]
[Set Up Salesforce as a Service Provider]
[Enable Single Sign-On for Your Org]
NEW QUESTION # 24
Universal Containers (UC) has Active Directory (AD) as their enterprise identity store and would like to use it for Salesforce user authentication. UC expects to synchronize user data between Salesforce and AD and Assign the appropriate Profile and Permission Sets based on AD group membership. What would be the optimal way to implement SSO?
- A. Use Salesforce Identity Connect as the Identity Provider.
- B. Use Active Directory with Reverse Proxy as the Identity Provider.
- C. Use Active Directory Federation Service (ADFS) as the Identity Provider.
- D. Use Microsoft Access control Service as the Authentication provider.
Answer: A
Explanation:
Explanation
The optimal way to implement SSO with Active Directory as the enterprise identity store is to use Salesforce Identity Connect as the identity provider. Salesforce Identity Connect is a software that integrates Microsoft Active Directory with Salesforce and enables single sign-on (SSO) using SAML. It also allows user data synchronization between Active Directory and Salesforce and profile and permission set assignment based on Active Directory group membership. Option A is not a good choice because using Active Directory with reverse proxy as the identity provider may not be supported by Salesforce or may require additional configuration and customization. Option B is not a good choice because using Microsoft Access Control Service as the authentication provider may not be available, as Microsoft has retired this service in 2018.
Option C is not a good choice because using Active Directory Federation Service (ADFS) as the identity provider may not allow user data synchronization or profile and permission set assignment based on Active Directory group membership, unless it is combined with another tool such as Salesforce Identity Connect.
References: Salesforce Identity Connect Implementation Guide, Single Sign-On Implementation Guide
NEW QUESTION # 25
An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?
- A. Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to " Admin Pre-Approved " .
- B. Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to " Admin Pre-Approved " .
- C. Enable the Full Access Scope and then set the connected app access settings to " Admin Pre-Approved
" . - D. Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to " User may self authorize " .
Answer: A
Explanation:
A native mobile app that must call Salesforce APIs, keep users signed in, and avoid the approval screen needs two things from the connected app configuration: the right scopes and administrator-controlled authorization.
The API scope allows REST access, and the offline_access scope allows the app to obtain a refresh token so it can continue working without repeated interactive sign-in. To suppress the approval page for end users, the connected app should be set to Admin Pre-Approved rather than allowing self-authorization. JWT bearer flow is not necessary when the scenario already states a native app user flow. Salesforce guidance for mobile apps consistently focuses on choosing the appropriate OAuth scopes first and then pairing them with the correct connected app access policy. This is why option C is the best answer in Salesforce terms.
NEW QUESTION # 26
Universal containers (UC) built a customer Community for customers to buy products, review orders, and manage their accounts. UC has provided three different options for customers to log in to the customer Community: salesforce, Google, and Facebook. Which two role combinations are represented by the systems in the scenario? Choose 2 answers
- A. Salesforce is the service provider and Facebook is the identity provider
- B. Facebook is the service provider and salesforce is the identity provider
- C. Google is the service provider and Facebook is the identity provider
- D. Salesforce is the service provider and Google is the identity provider
Answer: A,D
Explanation:
Explanation
The two role combinations that are represented by the systems in the scenario are Salesforce as the service provider and Google as the identity provider, and Salesforce as the service provider and Facebook as the identity provider. This means that Salesforce hosts the customer community app and relies on Google or Facebook to authenticate the users who log in with those options4. Therefore, option B and D are the correct answers.
References: Salesforce as Service Provider and Identity Provider for SSO
NEW QUESTION # 27
The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.
What should be used and considered before recommending it as a solution on the Salesforce Platform?
- A. Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.
- B. Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.
- C. OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.
- D. Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.
Answer: B
Explanation:
Explanation
Embedded Login is a feature that allows Salesforce to embed a login widget into any web page, such as a service provider's site, to enable users to log in with their Salesforce credentials. However, Embedded Login relies on third-party cookies, which can cause browser compatibility issues and require users to adjust their browser settings. Therefore, this should be considered before recommending it as a solution on the Salesforce Platform. References: Embedded Login, Embedded Login Implementation Guide
NEW QUESTION # 28
Universal containers (UC) uses a legacy Employee portal for their employees to collaborate and post their ideas. UC decides to use salesforce ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to push ideas posted on the Employee portal to salesforce through API. UC decides to use an API user using Oauth Username - password flow for the connection. How can the connection to salesforce be restricted only to the employee portal server?
- A. Add the employee portals IP address to the login IP range on the user profile.
- B. Use a dedicated profile for the user the Employee portal uses.
- C. Add the Employee portals IP address to the Trusted IP range for the connected App
- D. Use a digital certificate signed by the employee portal Server.
Answer: C
Explanation:
Explanation
Adding the employee portal's IP address to the trusted IP range for the connected app is the best way to restrict the connection to Salesforce only to the employee portal server. This will ensure that only requests from the specified IP range will be accepted by Salesforce for that connected app. Option B is not a good choice because using a digital certificate signed by the employee portal server may not be supported by Salesforce for OAuth username-password flow. Option C is not a good choice because adding the employee portal's IP address to the login IP range on the user profile may not be sufficient, as it will still allow other users with the same profile to log in from that IP range. Option D is not a good choice because using a dedicated profile for the user that the employee portal uses may not be effective, as it will still allow other users with that profile to log in from any IP address. References: [Connected Apps], [OAuth 2.0 Username-Password Flow]
NEW QUESTION # 29
Containers (UC) uses an internal system for recruiting and would like to have the candidates' info available in the Salesforce automatically when they are selected. UC decides to use OAuth to connect to Salesforce from the recruiting system and would like to do the authentication using digital certificates. Which two OAuth flows should be considered to meet the requirement? Choose 2 answers
- A. Web Service flow
- B. SAML Bearer Assertion flow
- C. JWT Bearer Token flow
- D. Refresh Token flow
Answer: B,C
Explanation:
Explanation
JWT Bearer Token flow and SAML Bearer Assertion flow are two OAuth flows that can be used to authenticate to Salesforce using digital certificates. JWT Bearer Token flow allows a connected app to request an access token from Salesforce by using a JSON Web Token (JWT) that is signed with a digital certificate.
SAML Bearer Assertion flow allows a connected app to request an access token from Salesforce by using a SAML assertion that is signed with a digital certificate. These two flows can meet the requirement of UC to use OAuth and digital certificates to connect to Salesforce from the recruiting system.
NEW QUESTION # 30
Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Facebook and Twitter credentials.
What should an identity architect recommend to meet these requirements?
- A. obtain login icon for Facebook and Twitter.
- B. create a custom external authentication provider for Twitter.
- C. configure a predefined authentication provider for Facebook and Twitter.
- D. create a custom external authentication provider for Facebook.
Answer: C
Explanation:
When Salesforce already provides built-in authentication provider support for the social networks required by the business, the simplest architecture is to use those predefined authentication providers. That avoids building custom provider logic for well-known services such as Facebook and, in many exam scenarios, Twitter. The point of the predefined provider is to reduce custom work, accelerate setup, and stay within the Salesforce-supported social sign-in pattern. A custom provider would only be necessary when the external source is not supported through the standard templates or protocols available. The architecture principle is to use standard provider support first and reserve custom provider work for gaps. That keeps the implementation easier to manage and easier to troubleshoot. This is why option C is the best answer in Salesforce terms.
NEW QUESTION # 31
Universal containers (UC) wants to implement a partner community. As part of their implementation, UC would like to modify both the Forgot password and change password experience with custom branding for their partner community users. Which 2 actions should an architect recommend to UC? Choose 2 answers
- A. Build a community builder page for both the change password and Forgot password experiences.
- B. Build acustom visualforce page for both the change password and Forgot password experiences.
- C. Build a community builder page for the change password experience and Custom Visualforce page for the Forgot password experience.
- D. Build a custom visualforce page for the change password experience and a community builder page for the Forgot password experience.
Answer: B,D
Explanation:
The two actions that an architect should recommend to UC are to build a custom Visualforce page for both the change password and forgot password experiences and to build a custom Visualforce page for the change password experience and a community builder page for the forgot password experience. A custom Visualforce page is a page that uses Visualforce markup and Apex code to create a custom user interface. A community builder page isa page that uses the Community Builder tool to create a custom user interface with drag-and-drop components. Both types of pages can be used to modify the look and feel of the password management features for partner community users. However, using a custom Visualforce page for both features requires more coding and customization, while using a community builder page for the forgot password feature allows more flexibility and configuration options.
References: [Visualforce Pages], [Community Builder Pages], [Customize Password Management Features]
NEW QUESTION # 32
Universal Containers uses Salesforce as an identity provider and Concur as the Employee Expense management system. The HR director wants to ensure Concur accounts for employees are created only after the apocopate approval in the Salesforce org.
Which three steps should theidentity architect use to implement this requirement?
Choose 3 answers
- A. Create an approval process for a custom object associated with the provisioning flow.
- B. Create an approval process for UserProvisionlngRequest object associated with the provisioning flow.
- C. Create a connected app for Concur in Salesforce.
- D. Enable User Provisioning for theconnected app.
- E. Create an approval process for user object associated with the provisioning flow.
Answer: B,C,D
Explanation:
User provisioning is a feature that allows Salesforce to create, update, or deactivate user accounts on a third- party system, such as Concur, based on user assignments in Salesforce1. To implementuser provisioning for Concur with an approval process, the identity architect should use the following steps2:
* Create a connected app for Concur in Salesforce. A connected app is an application that integrates with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect3. To create a connected app for Concur, you need to provide the basic information, such as the app name, logo URL, contact email, and API name. You also need to enable SAML and configure the SAML settings, such as the entity ID, ACS URL, and subject type4.
* Enable User Provisioning for the connected app. This step allows you to configure the user provisioning settings for the connected app, such as theprovisioning API endpoint URL, the client ID and client secret, the mapping of user attributes, and the linkage rules5. You can also choose to require an approval process for user provisioning requests by selecting the Approval Required option6.
* Create an approval process for UserProvisioningRequest object associated with the provisioning flow. A UserProvisioningRequest object represents a user provisioning request that is sent to or received from a third-party system7. An approval process specifies the steps necessary for a record to beapproved and whomust approve it at each step8. To create an approval process for UserProvisioningRequest object, you need to define theapproval steps, assignees, actions, criteria, and email alerts9.
References:
User Provisioning for Connected Apps
Tutorial: Configure Salesforce for automatic user provisioning
Connected Apps
Create a Connected App
Enable User Provisioning for a Connected App
Require Approvals for User Provisioning Requests
UserProvisioningRequest
Approval Processes
Create an Approval Process
NEW QUESTION # 33
Northern Trail Outfitters (NTO) is planning to implement a community for its customers using Salesforce Experience Cloud . Customers are not able to self-register. NTO would like to have customers set their own passwords when provided access to the community.
Which two recommendations should an identity architect make to fulfill this requirement?
Choose 2 answers
- A. Add customers as contacts and add them to Experience Cloud site.
- B. Use Login Flows to allow users to reset password in Experience Cloud site.
- C. Allow Password reset using the API to update Experience Cloud site membership.
- D. Enable Welcome emails while configuring the Experience Cloud site.
Answer: B,C
NEW QUESTION # 34
Universal containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use salesforce ideas and provide the ability for employees to post ideas from the company portal. They use SAML-BASED SSO to get into the company portal and would like to leverage it to access salesforce. Most of the users don't exist in salesforce and they would like the user records created in salesforce communities the first time they try to access salesforce. What recommendation should an architect make to meet this requirement?
- A. Use Identity connect to sync users
- B. Use just-in-time provisioning
- C. Use salesforce APIs to create users on the fly
- D. Use on-the-fly provisioning
Answer: B
NEW QUESTION # 35
A company wantsto provide its employees with a custom mobile app that accesses Salesforce. Users are required to download the internal native IOS mobile app from corporate intranet on their mobile device. The app allows flexibility to access other non-Salesforce internalapplications once users authenticate with Salesforce. The apps self-authorize, and users are permitted to use the apps once they have logged into Salesforce.
How should an identity architect meet the above requirements with the privately distributed mobile app?
- A. Use connected app with OAuth and Security Assertion Markup Language (SAML) to access other non- Salesforce internal apps.
- B. Create a new hybrid mobile app and use the connected app with OAuth to authenticate users for Salesforce and non-Salesforce internal apps.
- C. Configure Mobile App settings in connected app and Salesforce as identity provider for non-Salesforce internal apps.
- D. Use Salesforce as an identity provider (IdP) to access the mobile app and use the external IdP for other non-Salesforce internal apps.
Answer: C
Explanation:
Configuring Mobile App settings in connected app and Salesforce as identity provider for non-Salesforce internal apps is the best way to meet the requirements with the privately distributed mobile app. The Mobile App settings allow users to download the app from a private URL and use it with Salesforce credentials. The identity provider settings allow users to access other internal apps with SSO using Salesforce as the IdP. The other options are either not feasible or not optimal for this use case. References: Mobile App Settings, Single Sign-On for Desktop and Mobile Applications using SAML and OAuth
NEW QUESTION # 36
Universal containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use salesforce ideas and provide the ability for employees to post ideas from the company portal. They use SAML-BASED SSO to get into the company portal and would like to leverage it to access salesforce. Most of the users don't exist in salesforce and they would like the user records created in salesforce communities the first time they try to access salesforce. What recommendation should an architect make to meet this requirement?
- A. Use Identity connect to sync users
- B. Use just-in-time provisioning
- C. Use salesforce APIs to create users on the fly
- D. Use on-the-fly provisioning
Answer: B
Explanation:
Just-in-time provisioning is a feature thatallows Salesforce to create user accounts automatically when users log in for the first time via an external identity provider. This way, UC can avoid creating user records manually or synchronizing them with another system. On-the-fly provisioning is nota valid term in Salesforce.
Salesforce APIs can be used to create users programmatically, but they are not related to SSO. Identity Connect is a tool that can sync users between Salesforce and Active Directory, but it is not required for SSO.
References: Certification - Identity and Access Management Architect - Trailhead, [Just-in-Time Provisioning for SAML and OpenID Connect]
NEW QUESTION # 37
Universal Containers (UC) is building an integration between Salesforce and a legacy web application using the canvas framework. The security for UC has determined that a signed request from Salesforce is not an adequate authentication solution for the Third-Party app. Which two options should the Architect consider for authenticating the third-party app using the canvas framework? Choose 2 Answers
- A. Utilize Canvas OAuth flow to allow the third-party application to authenticate itself against Salesforce as the Idp.
- B. Create a registration handler Apex class to allow the third-party application to authenticate itself against Salesforce as the Idp.
- C. Utilize Authorization Providers to allow the third-party application to authenticate itself against Salesforce as the Idp.
- D. Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC's IdP.
Answer: A,D
Explanation:
Explanation
The Canvas framework supports OAuth 2.0 for authorization1. There are two OAuth flows that can be used to authenticate the third-party app using the canvas framework: User-Agent OAuth Flow and Web Server OAuth Flow2. The User-Agent OAuth Flow uses the Canvas JavaScript SDK to obtain an OAuth token by using the login function in the SDK2. The Web Server OAuth Flow redirects the user to the Salesforce OAuth authorization endpoint and then obtains an OAuth access token by making a POST request to the Salesforce OAuth token endpoint2. Both of these flows allow the third-party app to authenticate itself against Salesforce as the IdP. The SAML Single Sign-on flow can also be used to allow the third-party app to authenticate itself against UC's IdP, which is another option for authentication3.
References: OAuth Authorization, Mastering Salesforce Canvas Apps, Integrate third-party applications via Canvas App
NEW QUESTION # 38
Universal containers (UC) has decided to use identity connect as it's identity provider. UC uses active directory(AD) and has a team that is very familiar and comfortable with managing ad groups. UC would like to use AD groups to help configure salesforce users. Which three actions can AD groups control through identity connect? Choose 3 answers
- A. Role Assignment
- B. Custom permission assignment
- C. Granting report folder access
- D. Permission sets assignment
- E. Public Group Assignment
Answer: A,D,E
NEW QUESTION # 39
Northern Trail Outfitters (NTO) uses the Customer 360 Platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information.
What is the potential impact to the architecture if NTO decides to implement this feature?
- A. Custom registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.
- B. Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.
- C. If contactless user is upgraded to Community license, the contact record is automatically created and linked to the user record, but not associated with an Account.
- D. Passwordless authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record.
Answer: B
NEW QUESTION # 40
......
Identity-and-Access-Management-Architect Free Sample Questions to Practice One Year Update: https://torrentvce.certkingdompdf.com/Identity-and-Access-Management-Architect-latest-certkingdom-dumps.html