CertsPoint
Sign In Get Started
See all results for ""
Exams About Us
Sign In Get Started
Exam Overview
Exam Code Identity-and-Access-Management-designer
Exam Name Salesforce Identity and Access Management Designer
Vendor Salesforce
Total Questions 234
Last Updated 26-Oct, 2026
Free Identity-and-Access-Management-designer Questions Get Premium Access
Why CertsPoint?
  • Latest & Verified Questions
  • Detailed Explanations
  • Regular Updates
  • Full-Length Practice Tests
  • Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent
4.6 (398 Up Votes)
Secure Payment Privacy Protected Money Back Guarantee

Free Identity-and-Access-Management-designer Practice Questions

Explore 5 free practice questions for the Salesforce Identity-and-Access-Management-designer exam and review the answers and explanations to support your preparation.

  1. Question 1

    Single answer

    What information does the 'Relaystate' parameter contain in sp-Initiated Single Sign-on?


    • Option A:
      Reference to a URL redirect parameter at the identity provider.


      Correct
    • Option B:
      Reference to a URL redirect parameter at the service provider.


      Correct
    • Option C:
      Reference to the login address URL of the service provider.


      Correct
    • Option D:
      Reference to the login address URL of the identity Provider.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    In SP-initiated Single Sign-On (SSO), the RelayState parameter is used by the Identity Provider (IdP) to redirect the user back to a specific page at the Service Provider (SP) after successful authentication. It essentially stores the target URL or state information from the Service Provider side, so that once login is complete, the user is returned to the correct destination within the SP application. It does not represent the login URL of either provider, nor does it originate from the IdP redirect logic. Therefore, the correct understanding is that RelayState is tied to the Service Provider’s redirect destination URL or state information.

  2. Question 2

    Multiple answers

    Universal Containers (UC) has a custom, internal-only, mobile billing application for users who are
    commonly out of the office. The app is configured as a connected App in Salesforce. Due to the
    nature of this app, UC would like to take the appropriate measures to properly secure access to the
    app. Which two are recommendations to make the UC? Choose 2 answers 

    • Option A:
      Disallow the use of
      Single Sign-on for any users of the mobile app. 
      Correct
    • Option B:
      Require High Assurance sessions in order to use
      the Connected App. 
      Correct
    • Option C:
      Set Login IP Ranges to the internal network for all of the app users Profiles.


      Correct
    • Option D:
      Use Google Authenticator as an additional part of the login process
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B, D

    Explanation

    In SP-initiated Single Sign-On (SSO), the RelayState parameter is used by the Identity Provider (IdP) to redirect the user back to a specific page at the Service Provider (SP) after successful authentication. It essentially stores the target URL or state information from the Service Provider side, so that once login is complete, the user is returned to the correct destination within the SP application. It does not represent the login URL of either provider, nor does it originate from the IdP redirect logic. Therefore, the correct understanding is that RelayState is tied to the Service Provider’s redirect destination URL or state information.

  3. Question 3

    Multiple answers

    Universal Containers (UC) has an e-commerce website where customers can buy products, make
    payments and manage their accounts. UC decides to build a Customer Community on Salesforce
    and wants to allow the customers to access the community from their accounts without logging in
    again. UC decides to implement an SP-initiated SSO using a SAML-compliant Idp. In this scenario
    where Salesforce is the Service Provider, which two activities must be performed in Salesforce to
    make SP- initiated SSO work? Choose 2 answers

    • Option A:
      Configure SAML SSO settings.


      Correct
    • Option B:
      Create a Connected App.


      Correct
    • Option C:
      Configure Delegated Authentication.


      Correct
    • Option D:
      Set up My Domain.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: A, D

    Explanation

    For SP-initiated SAML Single Sign-On in Salesforce (where Salesforce is the Service Provider), the system must be configured to trust and communicate with the external Identity Provider (IdP). Option A (Configure SAML SSO settings) is required because Salesforce must define the SAML configuration, including issuer, certificate, and IdP login URL, to enable SSO authentication. Option D (Set up My Domain) is also required because Salesforce SSO (especially SAML-based and SP-initiated flows) depends on My Domain to provide a custom login URL that supports redirection and authentication routing. Option B (Create a Connected App) is incorrect because Connected Apps are typically used when Salesforce acts as the Identity Provider, not the Service Provider in this context. Option C (Delegated Authentication) is not used for SAML-based SSO since it is an older authentication method that relies on external validation via API rather than SAML assertions.

  4. Question 4

    Single answer

    How should an Architect automatically redirect users to the login page of the external Identity
    provider when using an SP-Initiated SAML flow with Salesforce as a Service Provider?


    • Option A:
      Use visualforce as the landing page for My Domain to redirect users to the Identity Provider login
      Page.
      Correct
    • Option B:
      Enable the Redirect to the Identity Provider setting under Authentication Services on the My
      domain Configuration.

      Correct
    • Option C:
      Remove the Login page from the list of Authentication Services on the My Domain configuration.

      Correct
    • Option D:
      Set the Identity Provider as default and enable the Redirect to the Identity Provider setting on the
      SAML Configuration
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: C

    Explanation

    In an SP-initiated SAML SSO flow in Salesforce, when a user tries to access Salesforce (Service Provider), the system must automatically redirect the user to the external Identity Provider for authentication. This behavior is enabled through the My Domain authentication configuration, specifically by turning on the “Redirect to the Identity Provider” setting under Authentication Services. This ensures that instead of showing the Salesforce login page, users are seamlessly redirected to the IdP login page. Option A is incorrect because Visualforce pages are not required for SSO routing. Option C is incorrect because removing the login page does not control IdP redirection behavior. Option D is incorrect because marking an IdP as default is not what triggers automatic redirection in SP-initiated flows.

  5. Question 5

    Single answer

    Universal Containers (UC) has a classified information system that its call center team uses only
    when they are working on a case with a record type "Classified"
    . They are only allowed to access
    the system when they own an open "Classified" case, and their access to the system is removed
    at all other times. They would like to implement SAML SSO eith Salesforce as the Idp, and
    automatically allow or deny the staff's access to the classified information system based on
    whether they currently own an open "Classified" case record when they try to access the system
    using SSO. What is the recommended solution for automatically allowing or denying the access to
    the classified information system based on the open "classified" case record criteria?

    • Option A:
      Use Salesforce reports to identify users that currently own open "Classified" cases and should be granted access to the Classified information system.
      Correct
    • Option B:
      Use Apex trigger on case to dynamically assign permission sets that grant access when a user is assigned an open "Classified" case, and remove it when the case is closed.
      Correct
    • Option C:
      Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.
      Correct
    • Option D:
      Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases.
      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: D

    Explanation

    C is correct because Custom SAML Just-In-Time (JIT) provisioning allows Salesforce (as the Identity Provider) to make real-time decisions during the SSO login process by evaluating user attributes and business logic at authentication time. In this scenario, it can dynamically check whether the user currently owns an open “Classified” case and then include that logic in the SAML assertion to either grant or deny access to the external system immediately during login, which makes it the only option capable of enforcing access based on live record data at the moment of authentication.