Salesforce-Platform-Identity-and-Access-Management-Architect Practice Test
255 Questions
An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO). Which feature of Identity Connect is applicable for this scenario?
A. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.
B. If the number of provisioned users exceeds Salesforce license allowances, identity Connect will start disabling the existing Salesforce users in First-in, First-out (FIFO) fashion.
C. Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.
D. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.
Explanation:
In this scenario, the Identity and Access Management (IAM) Architect is recommending Identity Connect for integrating Microsoft Active Directory (AD) with Salesforce to manage user provisioning, deprovisioning, and single sign-on (SSO). One of the key features of Identity Connect is its ability to synchronize user account changes in near real-time from Active Directory to Salesforce. Specifically, if a user is disabled or removed in AD, Identity Connect can immediately revoke that user's Salesforce session and disable the user in Salesforce as well. This helps maintain security compliance by ensuring that deprovisioned users do not retain lingering access to Salesforce after their AD status changes. This behavior supports both operational efficiency and security enforcement.
The other options are incorrect:
B is incorrect because Identity Connect does not automatically disable users in a FIFO manner if license limits are exceeded. It respects license capacity and sync rules but does not force a FIFO deactivation logic.
C is incorrect because Identity Connect is not a managed package deployed in Salesforce; it is a separate on-premises middleware application installed and run outside of Salesforce, typically on a Windows server within the network that has access to AD.
D is incorrect because Identity Connect is not an Identity Provider (IdP). It is used for user provisioning and directory synchronization, and while it supports desktop SSO through integration with AD, it does not replace an IdP for broader SSO scenarios.
| Page 1 out of 255 Pages |