Salesforce Certified Identity and Access Management Designer - Identity-and-Access-Management-Designer Exam Questions [2026]

QUESTION NO: 1
A group of users try to access one of Universal Containers' Connected Apps and receive the following error message: " Failed: Not approved for access." What is the most likely cause of this issue?

A. The Connected App settings "All users may self-authorize" is enabled. B. The User of High Assurance sessions are required for the Connected App. C. The Users do not have the correct permission set assigned to them. D. The Salesforce Administrators have revoked the OAuth authorization.

Correct Answer: C

QUESTION NO: 2
Uwversal Containers (UC) is building a custom employee hut) application on Amazon Web Services (AWS) and would like to store their users' credentials there. Users will also need access to Salesforce for internal operations. UC has tasked an identity architect with evaluating Afferent solutions for authentication and authorization between AWS and Salesforce.
How should an identity architect configure AWS to authenticate and authorize Salesforce users?

A. Configure AWS as an OpenID Connect Provider. B. Create a custom external authentication provider. C. Develop a custom Auth server in AWS. D. Configure the custom employee app as a connected app.

Correct Answer: A

QUESTION NO: 3
Universal containers (UC) has a classified information system that it's call centre team uses only when they are working on a case with a record type of "classified". They are only allowed to access the system when they own an open "classified" case, and their access to the system is removed at all other times. They would like to implement SAML SSO with salesforce as the IDP, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying access to the classified information system based on the open "classified" case record criteria?

A. Use custom SAML jit provisioning to dynamically query the user's open "classified" cases when attempting to access the classified information system B. Use salesforce reports to identify users that currently owns open "classified" cases and should be granted access to the classified information system. C. Use a custom connected App handler using apex to dynamically allow access to the system based on whether the staff owns any open "classified" cases. D. Use apex trigger on case to dynamically assign permission sets that grant access when a user is assigned with an open "classified" case, and remove it when the case is closed.

Correct Answer: C

QUESTION NO: 4
The security team at Universal Containers (UC) has identified exporting reports as a high-risk action and would like to require users to be logged into Salesforce with their Active Directory (AD) credentials when doing so. For all other users of Salesforce, users should be allowed to use AD Credentials or Salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with Salesforce credentials?

A. Use SAML Federated Authentication and block access to reports when accessed through a Standard Assurance session. B. Use SAML federated Authentication, treat SAML Sessions as High Assurance, and raise the session level required for exporting reports. C. Use SAML Federated Authentication and Custom SAML JIT Provisioning to dynamically and or remove a permission set that grants the Export Reports Permission. D. Use SAML federated Authentication with a Login Flow to dynamically add or remove a Permission Set that grants the Export Reports Permission.

Correct Answer: B

QUESTION NO: 5
Northern Trail Outfitters (NTO) has an existing custom business-to-consumer (B2C) website that does NOT support single sign-on standards, such as Security Assertion Markup Language (SAMi) or OAuth. NTO wants to use Salesforce Identity to register and authenticate new customers on the website.
Which two Salesforce features should an identity architect use in order to provide username/password authentication for the website?
Choose 2 answers

A. Connected Apps B. Delegated Authentication C. Identity Connect D. Embedded Login

Correct Answer: B,D

QUESTION NO: 6
Northern Trail Outfitters (NTO) is setting up Salesforce to authenticate users with an external identity provider. The NTO Salesforce Administrator is having trouble getting things setup.
What should an identity architect use to show which part of the login assertion is fading?

A. Connected App Manager B. Security Assertion Markup Language Validator C. SAML Metadata file importer D. Identity Provider Metadata download

Correct Answer: B

QUESTION NO: 7
Northern Trail Outfitters (NTO) is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable NTO-branded page.
The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.
Which approach should the identity architect recommend?

A. Use Heroku to build the new brand site and embedded login to reuse identities. B. Create a full sandbox to replicate the portal site and update the branding accordingly. C. Implement Experience ID in the code and extend the URLs and endpomts, as required. D. Configure an additional community site on the same org that is dedicated for the new brand.

Correct Answer: C

QUESTION NO: 8
Northern Trail Outfitters (NTO) has a requirement to ensure all user logins include a single multi-factor authentication (MFA) prompt. Currently, users are allowed the choice to login with a username and password or via single sign-on against NTO's corporate Identity Provider, which includes built-in MFA.
Which configuration will meet this requirement?

A. Enable "MFA for User Interface Logins" for your organization from Setup -> Identity Verification. B. Create a custom login flow that enforces MFA and assign it to a permission set. Then assign the permission set to all employees. C. For all employee profiles, set the Session Level Required at Login to High Assurance and add the corporate identity provider to the High Assurance list for the org's Session Security Levels. D. Create and assign a permission set to all employees that includes "MFA for User Interface Logins."

Correct Answer: A

QUESTION NO: 9
Northern Trail Outfitters (NTO) wants its customers to use phone numbers to log in to their new digital portal, which was designed and built using Salesforce Experience Cloud. In order to access the portal, the user will need to do the following:
1. Enter a phone number and/or email address
2. Enter a verification code that is to be sent via email or text.
What is the recommended approach to fulfill this requirement?

A. Create a custom login page with an Apex controller. The controller has logic to send and verify the identity. B. Create a custom login flow that uses an Apex controller to verify the phone numbers with the company's verification service. C. Create a Login Discovery page and provide a Login Discovery Handler Apex class. D. Create an Authentication provider and implement a self-registration handler class.

Correct Answer: C

QUESTION NO: 10
Universal Containers (UC) is setting up delegated authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risks of exposing the corporate login service on the internet and has asked that a reliable trust mechanism be put in place between the login service and Salesforce.
What mechanism should an Architect put in place to enable a trusted connection between the login service and Salesforce?

A. Set up a proxy service for the login service in the DMZ. B. Include Client Id and Client Secret in the login header callout. C. Enforce mutual authentication between systems using SSL. D. Require the use of Salesforce security tokens on passwords.

Correct Answer: D

QUESTION NO: 11
A leading fitness tracker company is getting ready to launch a customer community. The company wants its customers to login to the community and connect their fitness device to their profile. Customers should be able to obtain exercise details and fitness recommendation in the community.
Which should be used to satisfy this requirement?

A. Single Sign-On Settings B. OAuth Device Flow C. Login Flows D. Named Credentials

Correct Answer: B