Given a Set of Requirements, Design and Justify an End-To-End Identity Management Solution. TECHNICAL-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of integrating Salesforce with an enterprise directory service like Active Directory?

   • ATo synchronize user identities and enable centralized management of access
   • BTo enable direct SQL queries against Salesforce data
   • CTo replace Salesforce's built-in security features
   • DTo provide a backup for Salesforce data
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which protocol is specifically designed for accessing and modifying information in a directory service, such as querying user attributes?

   • ASAML
   • BOpenID Connect
   • CLDAP
   • DOAuth 2.0
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A hospital network uses Salesforce to manage patient records. They have multiple roles: doctors, nurses, and administrative staff. The compliance team requires that access to patient records be restricted based on the patient's location (e.g., only doctors in the same state can view records). The architect must design an authorization model that enforces this requirement while allowing for role-based access. Which approach should be used?

   • AUse attribute-based access control (ABAC) that evaluates both the user's role and the patient's state attribute to determine access.
   • BUse permission-based access control where each doctor is manually assigned access to patient records in their state.
   • CUse role-based access control (RBAC) with roles for each job function, and use sharing rules to grant access based on the patient's state.
   • DUse a custom Apex trigger that shares patient records with doctors based on their profile.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which privacy regulation gives individuals the right to request the deletion of their personal data held by an organization?

   • APCI DSS
   • BISO 27001
   • CSOC 2
   • DGDPR
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A global company wants to provide single sign-on (SSO) to Salesforce for its 10,000 employees. They already use Okta as their identity provider. The security team requires MFA for all users, but the sales team complains about the extra step. The architect must balance security and user experience. Which approach best meets the requirements?

   • AUse social login for all employees to simplify access.
   • BImplement SSO with Okta but disable MFA to satisfy the sales team.
   • CConfigure Salesforce to use Okta as the identity provider via SAML, and enforce MFA in Okta with a policy that requires MFA only for users outside the corporate network.
   • DConfigure Salesforce as the identity provider and use its built-in MFA for all users.
   Reveal Solution Discussion Select an answer first