Given a Set of Requirements, Design and Justify an End-To-End Identity Management Solution. TECHNICAL-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has 20,000 employees and uses Workday as the HR system. They are implementing Salesforce and need to provision users automatically. The company also has a large number of contractors who are managed in a separate system. The architect must design a provisioning solution that handles both employee and contractor lifecycles, including timely deprovisioning. Which approach is most appropriate?

   • AUse a single identity management platform that connects to both Workday and the contractor system, and provisions users to Salesforce with a scheduled sync.
   • BUse Salesforce's built-in user provisioning feature to connect directly to Workday.
   • CCreate a custom Apex trigger that provisions users when a record is created in a custom object.
   • DUse Workday as the only source of truth and manually create contractor accounts in Salesforce.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A healthcare company stores patient identity data in Salesforce. They are subject to HIPAA and need to protect sensitive data. The architect must design a solution that encrypts identity data at rest and in transit, and also masks data for users who do not need to see it. Which approach should be used?

   • AEnable Salesforce's platform encryption for sensitive fields and use field-level security to mask data for unauthorized users.
   • BUse Salesforce's built-in 'Mask' feature to hide data from all users.
   • CUse a custom encryption algorithm in Apex to encrypt identity data before storing it.
   • DStore identity data in a separate external database and only store a reference in Salesforce.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which authorization model grants or denies access based on attributes such as user department, resource classification, and environmental conditions like time of day?

   • ARole-based access control (RBAC)
   • BDiscretionary access control (DAC)
   • CPermission-based access control
   • DAttribute-based access control (ABAC)
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company with 5,000 employees uses Active Directory (AD) as its authoritative HR system. When an employee leaves, the HR system deactivates the account, but the Salesforce user remains active for up to 30 days because the nightly sync only runs once. The security team requires that terminated employees lose access to Salesforce within 2 hours. What should the architect recommend?

   • AIncrease the sync frequency to every 2 hours and enable a validation rule that blocks login for inactive AD users.
   • BSet up a scheduled job in Salesforce that runs every hour and deactivates users whose AD account is disabled, using a custom API call to AD.
   • CUse a real-time identity provider that deactivates the Salesforce user immediately when the AD account is disabled, and run a nightly sync as a fallback.
   • DConfigure Salesforce to automatically deactivate users who have not logged in for 24 hours.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A large enterprise needs to ensure that user access to Salesforce is reviewed quarterly by managers. The compliance team wants to automate the review process and track who has approved access. Which governance control should the architect implement?

   • AImplement a third-party identity governance tool that integrates with Salesforce to schedule access reviews and track approvals.
   • BUse Salesforce's built-in 'Access Certification' feature to create a quarterly review campaign.
   • CSet up a workflow rule that sends an email to managers when a user's access is changed.
   • DCreate a custom report that lists all users and their permissions, and email it to managers to review manually.
   Reveal Solution Discussion Select an answer first