Register
Question 1
What is the purpose of a self-signed certificate?
Correct Answer:
Generate a certificate signed by Salesforce to show that communications purporting to come from your organization are really coming from there.
Explanation:
The purpose of a self-signed certificate is to generate a certificate directly from the organization, without involving any external certificate authority. This helps to establish the identity of the organization and ensure that communications are genuinely coming from them. Options B, C, and D are incorrect because these actions do not directly involve the creation or use of a certificate. Verifying user identities, encrypting data, and creating backups are all important security measures, but they do not pertain to the purpose of a self-signed certificate.
Question 2
What type of policies can be set for OAuth scopes in connected apps?
Correct Answer:
Policies to restrict actions and data based on user permissions
Explanation:
The choice indicating that policies can restrict actions and data based on user permissions is accurate for OAuth scopes in connected apps. In the context of Salesforce and connected apps, OAuth scopes define the specific permissions and access levels granted to an application when a user authorizes it. By setting these policies, administrators can control how much data and which actions an application can perform on behalf of the user. This allows for fine-tuned security measures that ensure users only have access to the appropriate resources in accordance with their roles within the organization. When considering the other options, it becomes clear why they do not align with the purpose of OAuth scopes: - Allowing universal access for all users does not align with best practices for security and access management. Such an approach could lead to unauthorized access and potential data breaches, undermining the very purpose of managing OAuth scopes. - Disabling API calls for all applications would render connected apps non-functional and eliminate the utility of OAuth authentication, which is designed to facilitate secure interactions. - Enhancing user interface design does not pertain to OAuth scopes, as these scopes are purely about permissions and access functions rather than visual aspects of the application. Thus, restricting actions and data based on user permissions is the essence of what OAuth scopes achieve in connected apps
Question 3
What feature helps to secure user access in sensitive applications?
Correct Answer:
User authentication methods
Explanation:
User authentication methods are critical for securing user access in sensitive applications because they establish the identity of users attempting to gain access. By implementing strong authentication techniques, such as multi-factor authentication (MFA), biometric authentication, or OAuth-based systems, organizations can verify that users are who they claim to be before allowing them access to sensitive information or functionalities. This ensures that only authorized individuals can interact with the application, thereby protecting against unauthorized access and potential data breaches. Other choices like custom application designs, performance monitoring tools, and application programming interfaces, while they play important roles in application development, management, and integration, do not directly contribute to securing user access as effectively as user authentication methods do. Custom application designs may enhance user experience or meet specific functional requirements, performance monitoring tools are essential for maintaining system efficiency, and APIs facilitate communication between different systems but do not inherently provide security for user access.
Question 4
How are "Permission Sets" different from "Profiles"?
Correct Answer:
Permission Sets add additional permissions beyond the profile
Explanation:
Permission Sets are designed to provide additional permissions to users beyond what is defined in their Profile. While a Profile is the foundational set of permissions assigned to a user and determines the baseline access and abilities a user has within Salesforce, Permission Sets allow administrators to grant specific privileges without changing the user's Profile. This flexibility means that multiple users can share the same Profile but have different Permission Sets, enabling tailored access according to business needs without the need to create numerous Profiles for every possible combination of permissions. This structure promotes efficient user management, as it allows for easier adjustments to permissions when roles or projects change, without the overhead of managing multiple distinct Profiles. Thus, the core strength of Permission Sets lies in their ability to enhance and supplement the base permissions defined in Profiles, offering a more granular control over user capabilities.
Question 5
How is single sign-on configuration across multiple orgs initiated?
Correct Answer:
Enable My Domain
Explanation:
The correct choice, enabling My Domain, is critical for initiating single sign-on (SSO) configuration across multiple Salesforce orgs. My Domain allows you to set a custom domain name specifically for your organization, which is essential for establishing the necessary trust relationships between different orgs and facilitating secure SSO. By configuring My Domain, you enable a unique domain through which users can access their Salesforce environment, and this is a foundational step required before implementing SSO settings. Once My Domain is enabled, it allows for the configuration of the authentication settings, such as SAML or OAuth, that support the SSO functionality. Hence, it serves as a prerequisite for successful SSO setup across multiple orgs. The other options, such as creating a user profile, modifying user permissions, or configuring SAML, are important aspects of user management and authentication processes but do not directly initiate the SSO configuration across multiple orgs. They may follow after My Domain is enabled to fine-tune the user experience or authentication but do not lay the groundwork for SSO functionality in the same way.
Question 1
Exam overview

About this Exam

The Salesforce Certified Identity and Access Management (IAM) Architect exam is a cornerstone for professionals looking to demonstrate their mastery of secure, scalable identity solutions on the Customer 360 platform.

This certification validates an individual's ability to assess identity architecture, design high-performance access management solutions, and articulate complex technical scenarios to both business and technical stakeholders.

It is designed for identity professionals, including Architects, Senior Developers, and Security Specialists, who are responsible for designing, configuring, and managing enterprise-wide IAM strategies within the Salesforce ecosystem.

Achieving this credential proves your competence in balancing user experience with robust security controls.

More details

Additional Information

What the Course Entails and Exam Details

This comprehensive architect-level course and exam guide will walk you through a detailed syllabus that mirrors the key areas of responsibility for an IAM Architect. The course content is designed to build on your existing Salesforce knowledge and deep dive into security protocols.

Key topics you must master include:

  • Identity Management Concepts (17%): Foundational principles of authentication, authorization, and accountability; trust establishing; user provisioning methods (JIT, API, Identity Connect); and troubleshooting SSO.

  • Accepting Third-Party Identity in Salesforce (21%): Configuring Salesforce as a Service Provider (SP), implementing Single Sign-On (SSO) with SAML, utilizing OpenID Connect for social sign-on, and analyzing authentication flows.

  • Salesforce as an Identity Provider (17%): Setting up Salesforce as an Identity Provider (IdP) for external applications, managing Connected Apps, OAuth authorization flows, and leveraging Login Flows for custom authentication logic.

  • Access Management Best Practices (15%): Implementing Multi-Factor Authentication (MFA), session security, session-based permission sets, and utilizing auditing tools to verify user activity.

  • Salesforce Identity (12%): Understanding the role of Identity Connect, license types (including Customer 360 Identity), and optimal user/contact models for identity management.

  • Community (Partner and Customer) (18%): Designing secure identity solutions for external users, leveraging External Identity features, and selecting appropriate license types for community use cases.


What to Expect in the Final Exam

The Salesforce Certified Identity and Access Management Architect exam is a proctored, comprehensive test designed to measure your real-world architectural reasoning.

Here is a quick breakdown of what you can expect on exam day:

  • Content: 60 multiple-choice and multiple-select questions. Up to five additional unscored questions may be present, which do not impact your final score but allow Salesforce to gather performance data on new questions.

  • Time Allotted: 120 minutes.

  • Passing Score: 67%.

  • Registration Fee: USD 400 plus applicable taxes.

  • Retake Fee: USD 200 plus applicable taxes.

  • Delivery Options: You can choose to take the exam onsite at a supervised testing center or via an online proctored environment using Kryterion Sentinel software.

  • References: No hard-copy or online materials may be referenced during the exam.

  • Prerequisites: There are no official prerequisites for this exam, but Salesforce strongly recommends that candidates have hands-on experience designing and implementing IAM solutions.


How to Study and Exam Centers

Preparation is paramount for architect-level certifications. Here is a recommended study path to ensure your success:

1. Leverage the Official Exam Guide: Start by downloading and thoroughly reviewing the latest Salesforce Certified Identity and Access Management Architect Exam Guide. It outlines the current syllabus, weighting, and recommended materials.

2. Follow the Trailhead Trailmix: Salesforce provides a dedicated Trailmix called "Architect Journey: Identity and Access Management." This is a curated collection of modules, projects, and superbadges that provide the knowledge and hands-on practice needed for the exam.

3. Hands-On Practice: Do not underestimate the value of practical experience. Use a free Salesforce Developer Edition to configure SSO (SAML and OpenID Connect), manage Connected Apps, and implement MFA. Simulate the scenario-based challenges outlined in the exam guide.

4. Review Official Documentation: Deepen your understanding by studying the official Salesforce documentation and Salesforce Help articles on subjects like 'Salesforce Identity', 'Single Sign-On', 'OAuth Flows', and 'Identity Connect'.

5. Take Practice Exams: Utilize reputable practice tests to familiarize yourself with the type of questions asked, practice your pacing, and identify specific areas where you need further study. Focus on understanding the logic behind both correct and incorrect answers.

Exam Centers:

You can register for your proctored exam through your Salesforce Trailblazer account.

There are two primary ways to take the test:

  • Online Proctored: Take the exam from your own location (home or office) with a continuous internet connection, using a webcam and Kryterion Sentinel software to monitor the session.

  • Onsite Testing Centers: Visit one of the hundreds of authorized Kryterion testing centers located globally. You must schedule your time in advance.


Job Opportunities from the Course

A Salesforce IAM Architect certification is a powerful career accelerator, unlocking high-level roles within diverse industries. It demonstrates a rare and sought-after intersection of security expertise and Salesforce architectural knowledge.

Completing this path opens doors to a variety of job titles and career trajectories:

  • Salesforce Architect

  • Technical Architect

  • Security Architect

  • Identity Architect

  • Enterprise Architect

  • Corporate Integration Architect

  • Senior Salesforce Developer / Lead

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

0 min

2026 George Access Practice Exam

0 min

Aquatic Pest Management & Aquatic Science Practice Exam

0 min

Aquatic Pest Management Practice Exam

0 min

Arby's Management Practice Exam Prep

0 min

Arizona CNA Certified Nursing Assistant Practice Exam

0 min