Identity-and-Access-Management-Architect Dumps with Practice Exam Questions Answers

The requirements call for two distinct capabilities: federation for sign-in and standards-based lifecycle management for provisioning. In Salesforce terms, that means Salesforce should act as a SAML service provider for authentication while SCIM handles create, update, and deactivate operations from the central IAM system. Just-in-Time provisioning alone is not enough here because the requirement includes provisioning and deprovisioning triggered by user status changes in the central identity service, not just first-login user creation. Identity Connect is aimed at Active Directory synchronization and is not the general answer for cloud IAM-to-Salesforce lifecycle management. Pairing SAML for SSO with SCIM for provisioning is the clean standards-based architecture when identity governance happens outside Salesforce. This is why option C is the best answer in Salesforce terms.

When users must be allowed to launch an external service provider from Salesforce only if the organization has explicitly authorized them, the connected app should use the Admin Pre-Approved access policy. That setting moves app access out of end-user consent and into administrator control. Profiles or permission sets then determine exactly which users can use the app. This is the standard Salesforce pattern for governed OAuth access in enterprise environments. Assigning authentication providers to profiles or simply exposing the app to a community does not replace the approval and entitlement model of the connected app itself. The architectural point is that app access and user authorization should be centrally controlled, auditable, and limited to approved users. This is why options C, D work together as the correct solution.

Login Discovery is the Salesforce feature built for identifier-first sign-in experiences that start with an email address or phone number and then route the user into the next authentication step. It is especially relevant for passwordless designs because the user can enter an email address or mobile number and then receive a verification code through the configured handler and verification service. That matches the stated requirement much more closely than social sign-on or a generic external IdP recommendation. The key platform point is that Login Discovery separates “who are you?” from “how do we authenticate you?” and allows Salesforce to branch appropriately. For citizen or customer portals, it is the standard entry point for phone-or-email-based identification before code verification. This is why option B is the best answer in Salesforce terms.

In Experience Cloud B2B patterns, a partner identity in Salesforce is represented by a User that is related to a Contact, which in turn belongs to an Account. Delegated administration for partners assumes that account-contact-user relationship because partner users operate within a business account structure. A contact by itself is not a login identity, and a contactless user is associated with different external identity patterns. A Person Account is generally a B2C model rather than the normal B2B partner representation. The architect should therefore provision both the contact and the user record. This is consistent with how Salesforce partner communities model business relationships, sharing, delegated administration, and partner account ownership. This is why option A is the best answer in Salesforce terms.

Once SAML SSO is already configured, enabling Just-in-Time provisioning in Salesforce is done on the SAML Single Sign-On setting itself. The architect turns on JIT user provisioning, selects the provisioning type, and supplies the SAML JIT handler if custom logic is needed. That is the expected configuration path because JIT is part of the federation handshake, not a sharing model or permission-set feature. Creating a random Apex class without wiring it into the SAML setting would not enable JIT on its own. The architectural distinction is that JIT rides inside the SAML login process. Therefore it must be enabled and configured where Salesforce processes the incoming assertion. This is why option A is the best answer in Salesforce terms.