Salesforce Identity-and-Access-Management-Architect Real Exam Questions Guaranteed Updated Dump from Exam4Tests
Verified Pass Identity-and-Access-Management-Architect Exam in First Attempt Guaranteed
Salesforce Identity-and-Access-Management-Architect certification is an important credential for professionals who want to demonstrate their expertise in the field of IAM architecture. Salesforce Certified Identity and Access Management Architect certification is designed for those who have a deep understanding of the Salesforce platform and its various IAM features, and who are able to design IAM solutions that meet the needs of different types of organizations. Candidates are expected to have a thorough knowledge of IAM technologies, as well as a good understanding of the various types of users and their associated permissions and roles.
Salesforce Certified Identity and Access Management Architect exam is a comprehensive exam that covers a wide range of topics related to IAM. Identity-and-Access-Management-Architect exam consists of multiple-choice questions and is timed at 120 minutes. Identity-and-Access-Management-Architect exam covers topics such as user authentication and authorization, single sign-on (SSO), multi-factor authentication (MFA), and identity federation. In addition, the exam covers topics such as data security, access control, and user provisioning.
NEW QUESTION # 14
Universal containers(UC) has implemented SAML-BASED single Sign-on for their salesforce application and is planning to provide access to salesforce on mobile devices using the salesforce1 mobile app. UC wants to ensure that single Sign-on is used for accessing the salesforce1 mobile app. Which two recommendations should the architect make? Choose 2 answers
- A. Use the existing SAML SSO flow along with Web server flow
- B. Use the existing SAML SSO flow along with user agent flow.
- C. Configure the embedded Web browser to use my domain URL.
- D. Configure the salesforce1 app to use the my domain URL
Answer: B,D
NEW QUESTION # 15
A large consumer company is planning to create a community and will requ.re login through the customers social identity. The following requirements must be met:
1. The customer should be able to login with any of their social identities, however salesforce should only have one user per customer.
2. Once the customer has been identified with a social identity, they should not be required to authonze Salesforce.
3. The customers personal details from the social sign on need to be captured when the customer logs into Salesforce using their social Identity.
3. If the customer modifies their personal details in the social site, the changes should be updated in Salesforce
.
Which two options allow the Identity Architect to fulfill the requirements?
Choose 2 answers
- A. Redirect the user to a custom page that allows the user to select an existing social identity for login.
- B. Use authentication providers for social sign-on and use the custom registration handler to insert or update personal details.
- C. Use the custom registration handler to link social identities to Salesforce identities.
- D. Use Login Flows to call an authentication registration handler to provision the user before logging the user into the community.
Answer: B,C
Explanation:
Explanation
To allow customers to log in to the community with any of their social identities, such as Facebook, Google, or Twitter, the identity architect needs to use authentication providers for social sign-on. Authentication providers are configurations that enable users to authenticate with an external identity provider and access Salesforce resources. To ensure that Salesforce has only one user per customer, regardless of how many social identities they have, the identity architect needs to use the custom registration handler to link social identities to Salesforce identities. The custom registration handler is a class that implements the Auth.RegistrationHandler interface and defines how to create or update users in Salesforce based on the information from the external identity provider. The custom registration handler can also be used to insert or update personal details of the customers when they log in to Salesforce using their social identity.
References: Authentication Providers, Social Sign-On with Authentication Providers, Create a Custom Registration Handler
NEW QUESTION # 16
Universal Containers wants to allow its customers to log in to its Experience Cloud via a third party authentication provider that supports only the OAuth protocol.
What should an identity architect do to fulfill this requirement?
- A. Contact Salesforce Support and enable delegate single sign-on.
- B. Configure OpenID Connect authentication provider.
- C. Use certificate-based authentication.
- D. Create a custom external authentication provider.
Answer: D
Explanation:
When the external identity source supports only OAuth and there is no predefined provider type available in Salesforce, the architect should use a custom external authentication provider. Prebuilt OpenID Connect support assumes an OIDC-compliant provider, which is more specific than raw OAuth. Delegated authentication and certificate-based patterns solve different identity problems and are not meant to retrofit a nonstandard OAuth provider into Experience Cloud sign-in. The custom provider option exists precisely for this gap: it lets Salesforce participate in an authentication exchange with an external service that does not fit one of the standard built-in provider templates. In practice, this gives the architect control over how Salesforce obtains and interprets the external identity information. This is why option C is the best answer in Salesforce terms.
NEW QUESTION # 17
An identity architect's client has a homegrown identity provider (IdP). Salesforce is used as the service provider (SP). The head of ITis worried that during a SP initiated single sign-on (SSO), the Security Assertion Markup Language (SAML) request content will be altered.
What should the identity architect recommend to make sure that there is additional trust between the SP and the IdP?
- A. Encrypt the SAML Request using certification authority (CA) signed certificate and decrypt on IdP.
- B. Ensure that the Issuer and Assertion Consumer service (ACS) URL is propertyconfigured between SP and IDP.
- C. Ensure that there is an HTTPS connection between IDP and SP.
- D. Ensure that on the SSO settings page, the "Request Signing Certificate" field has a self-signed certificate.
Answer: A
Explanation:
Encrypting the SAML Request using a CA signed certificate and decrypting it on the IdP ensures that the requestcontent is not altered or tampered with during transit. This also adds an extra layer of security and trust between the SP and the IdP. References: SAML Single Sign-On Overview, SAML Assertion Encryption
NEW QUESTION # 18
Universal containers (UC) has built a custom based Two-factor Authentication (2fa) system for their existing on-premise applications. Thru are now implementing salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution an architect should consider?
- A. Replace the custom 2fa system with an app exchange app that supports on-premise applications and salesforce.
- B. Replace the custom 2fa system with salesforce 2fa for on-premise application and salesforce.
- C. Use the custom 2fa system for on-premise applications and native 2fa for salesforce.
- D. Use custom login flows to connect to the existing custom 2fa system for use in salesforce.
Answer: D
NEW QUESTION # 19
Universal containers (UC) has a customer Community that uses Facebook for authentication. UC would like to ensure that changes in the Facebook profile are reflected on the appropriate customer Community user.
How can this requirement be met?
- A. Use SAML just-in-timeprovisioning between Facebook and Salesforce
- B. Use information in the signed request that is received from Facebook.
- C. Develop a schedule job that calls out to Facebook on a nightly basis.
- D. Use the updateuser() method on the registration handler class.
Answer: B
Explanation:
Using information in the signed request that is received from Facebook is how this requirement can be met.
A signed request is a parameter that contains information about the user who is logging in with Facebook credentials. The signed request can include information such as the user ID, name, email, and profile picture.
You can use this information to update the corresponding customer community user in Salesforce by implementing a registration handler class. The registration handler class is an Apex class that defines how Salesforce handles user registrationand authentication when using an auth provider. You can use the updateUser() method in the registration handler class to update the user record with the information from the signed request. Using the updateUser() method on the registration handler class isnot how this requirement can be met because it is only part of the solution. You also need to use information from the signed request as the source of the updates. Using SAML just-in-time provisioning between Facebook and Salesforce is not how this requirement can be met because Facebook does not support SAML as an identity provider protocol.
Developing a scheduled job that calls out to Facebook on a nightly basis is not how this requirement can be met because it is inefficient and unnecessary. You can update the user record in real time using the signed request instead of waiting for a nightly batch process.
NEW QUESTION # 20
Universal containers (UC) wants to integrate a Web application with salesforce. The UC team hasimplemented the Oauth web-server Authentication flow for authentication process. Which two considerations should an architect point out to UC? Choose 2 answers
- A. The web server must be able to protect consumer privacy
- B. The web application should be hosted on a secure server.
- C. The flow will not provide an Oauth refresh token back to the server.
- D. The flow involves passing the user credentials back and forth.
Answer: A,B
Explanation:
The web application should be hosted on a secure server and the web server must be able to protect consumer privacy are two considerations that an architect should point out to UC. To integrate an external web app with the Salesforce API, UC can use the OAuth 2.0 web server flow, which implements the OAuth 2.0 authorization code grant type4. With this flow, the server hosting the web app must be able to protect the connected app's identity, defined by the client ID and client secret4. The web application should be hosted on a secure server to ensure that the communication between the web app and Salesforce is encrypted and protected from unauthorized access or tampering6. The web server must be able to protect consumer privacy to comply with data protection laws and regulations, such as GDPR or CCPA . The web server should implement best practices for storing and handling user data, such as encryption, hashing, salting, and anonymization. The flow involves passing the user credentials back and forth is not a correct consideration, as the web server flow does not require the user credentials to be passed between the web app and Salesforce. Instead,it uses an authorization code that is exchanged for an access token and a refresh token4. The flow will not provide an OAuth refreshtoken back to the server is also not a correct consideration, as the web server flow does provide a refresh token that can be usedto obtain new access tokens without user interaction4. References: OAuth 2.0 Web Server Flow for Web App Integration, Secure Your Web Application, [General Data Protection Regulation (GDPR)], [California Consumer Privacy Act (CCPA)],
[Data Protection Best Practices]
NEW QUESTION # 21
Universal containers (UC) is setting up their customer Community self-registration process. They are uncomfortable with the idea of assigning new users to a default account record. What will happen when customers self-register in the community?
- A. The self-registration process will produce an error to the user.
- B. The self-registration page will ask user to select an account.
- C. The self-registration process will create a person Account record.
- D. The self-registration page will create a new account record.
Answer: C
Explanation:
When customers self-register in the community, the self-registration process will create a person account record. A person account is a special type of account that combines both account and contact information in one record. This allows customers to have their own individual accounts without being associated with a default account. Option A is not a good choice because the self-registration process will not produce an error to the user, unless there is some configuration or validation issue. Option B is not a good choice because the self-registration page will not ask user to select an account, unless it is customized to do so. Option D is not a good choice because the self-registration page will not create a new account record,unless it is customized to do so.
References: [How to Provision Salesforce Communities Users], [Salesforce Licensing]
NEW QUESTION # 22
Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?
- A. The app is requesting too many access Tokens in a 24-hour period
- B. The users forget to check the box to remember their credentials.
- C. The refresh token expiration policy is set incorrectly in salesforce
- D. The Oauth authorizations are being revoked by a nightly batch job.
Answer: C
Explanation:
The most likely cause of the issue is that the refresh token expiration policy is set incorrectly in Salesforce. A refresh token is a credential that allows a connected app to obtain a new access token when theprevious one expires1. The refresh token expiration policy determines how long a refresh token is valid for2. If the policy is set to a short duration, such as 24 hours, the users have to enter their credentials once a day to get a new refresh token. To prevent this, thepolicy should be set to a longer duration, such as "Refresh token is valid until revoked" or "Refresh token expires after 90 days of inactivity"2.
References: OAuth 2.0 Refresh Token Flow, Manage OAuth Access Policies for a Connected App
NEW QUESTION # 23
Universal Containers (UC) has a desktop application to collect leads for marketing campaigns. UC wants to extend this application to integrate with Salesforce to create leads. Integration between the desktop application and Salesforce should be seamless. What Authorization flow should the Architect recommend?
- A. JWT Bearer Token Flow
- B. User Agent Flow
- C. Username and Password Flow
- D. Web Server Authentication Flow
Answer: B
NEW QUESTION # 24
Northern Trail Outfitters (NTO) wants its customers to use phone numbers to log in to their new digital portal, which was designed and built using Salesforce Experience Cloud. In order to access the portal, the user will need to do the following:
1. Enter a phone number and/or email address
2. Enter a verification code that is to be sent via email or text.
What is the recommended approach to fulfill this requirement?
- A. Create a Login Discovery page and provide a Login Discovery Handler Apex class.
- B. Create an Authentication provider and implement a self-registration handler class.
- C. Create a custom login flow that uses an Apex controller to verify the phone numbers with the company's verification service.
- D. Create a custom login page with an Apex controller. The controller has logic to send and verify the identity.
Answer: A
NEW QUESTION # 25
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self- service. Guests of the portal be able toself-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have been purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate accountand contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers
- A. Select the "Configurable Self-Reg Page" optionunder Login & Registration.
- B. Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.
- C. Customize me self-registrationApex handler to create only the user record.
- D. Enable "Allow customers and partners to self-register".
- E. Set jp an external login page and call Salesforce APIs for user creation.
Answer: A,C,D
Explanation:
Enabling "Allow customers and partners to self-register" allows guests to create their own user accounts in the portal. Selecting the "Configurable Self-Reg Page" option allows the administratorto customize the self- registration page to capture the required fields. Customizing the self-registration Apex handler to create only the user record prevents the automatic creation of a contact record until verification. References: Enable Self- Registration, Customize Self-Registration
NEW QUESTION # 26
Northern Trail Outfitters (NTO) uses Salesforce for Sales Opportunity Management. Okta was recently brought in to Just-in-Time (JIT) provision and authenticate NTO users to applications. Salesforce users also use Okta to authorize a Forecasting web application to access Salesforce records on their behalf.
Which two roles are being performed by Salesforce?
Choose 2 answers
- A. OAuth Resource Server
- B. SAML Identity Provider
- C. OAuth Client
- D. SAML Service Provider
Answer: C,D
NEW QUESTION # 27
A company with 15,000 employees is using Salesforce and would like to take the necessary steps to highlight or curb fraudulent activity.
Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times and who logged in during non-business hours?
- A. Login Forensics
- B. Login Inspector
- C. Login History
- D. Login Report
Answer: A
Explanation:
Explanation
To track login data and highlight or curb fraudulent activity, the identity architect should use Login Forensics.
Login Forensics is a tool that analyzes login history data and provides insights into user login patterns, such as average number of logins, login outliers, login anomalies, and login risk scores. Login Forensics can help identify suspicious or malicious login attempts and take preventive actions. References: Login Forensics, Login Forensics Implementation Guide
NEW QUESTION # 28
Northern Trail Outfitters mar ages functional group permissions in a custom security application supported by a relational database and a REST service layer. Group permissions are mapped as permission sets in Salesforce.
Which action should an identity architect use to ensure functional group permissions are reflected as permission set assignments?
- A. Use the Apex JIT handler to callout to the security application and set permission sets
- B. Use the Apex Just-in-Time (JIT) handler to query the Security Assertion markup Language (SAML) attributes and set permission sets.
- C. Use a Login Flow to query SAML attributes and set permission sets.
- D. Use a Login Flow with invocable Apex to callout to the security application and set permission sets.
Answer: D
Explanation:
Explanation
Using a Login Flow with invocable Apex to callout to the security application and set permission sets allows the identity architect to dynamically assign or remove permission sets based on the functional group permissions in the custom security application. This ensures that the permission set assignments are consistent with the group permissions. References: Login Flows, Invocable Apex
NEW QUESTION # 29
Universal Containers (UC) has implemented SAML-based SSO solution for use with their multi-org Salesforce implementation, utilizing one of the the orgs as the Identity Provider. One user is reporting that they can log in to the Identity Provider org but get a generic SAML error message when accessing the other orgs. Which two considerations should the architect review to troubleshoot the issue? Choose 2 answers
- A. The Federation ID must be in the form of an email address.
- B. The Federation ID must be a valid Salesforce Username
- C. The Federation ID must be populated on the user record.
- D. The Federation ID must is case sensitive
Answer: C,D
Explanation:
Explanation
The Federation ID is a field on the user object that is used to link a Salesforce user with an external identity provider. When using SAML SSO, Salesforce matches the Federation ID value with the NameID element in the SAML assertion to identify the user. To troubleshoot the issue of getting a generic SAML error message when accessing the other orgs, the architect should review the following considerations:
The Federation ID must be case sensitive, which means that the value in the user record must match exactly with the value in the SAML assertion. For example, if the Federation ID is "John.Doe", then
"john.doe" or "JOHN.DOE" will not work.
The Federation ID must be populated on the user record, which means that the user must have a value for this field in each org that they want to access via SSO. If the Federation ID is blank or missing, then Salesforce will not be able to match the user with the SAML assertion.
NEW QUESTION # 30
The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.
What should be used and considered before recommending it as a solution on the Salesforce Platform?
- A. Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.
- B. Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.
- C. Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.
- D. OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.
Answer: A
Explanation:
Explanation
Embedded Login is a feature that allows Salesforce to embed a login widget into any web page, such as a service provider's site, to enable users to log in with their Salesforce credentials. However, Embedded Login relies on third-party cookies, which can cause browser compatibility issues and require users to adjust their browser settings. Therefore, this should be considered before recommending it as a solution on the Salesforce Platform. References: Embedded Login, Embedded Login Implementation Guide
NEW QUESTION # 31
A financial enterprise is planning to set up a user authentication mechanism to login to the Salesforce system.
Due to regulatory requirements, the CIO of the company wants user administration, including passwords and authentication requests, to be managed by an external system that is only accessible via a SOAP webservice.
Which authentication mechanism should an identity architect recommend to meet the requirements?
- A. Just-in-Time Provisioning
- B. Security Assertion Markup Language (SANL) Single Sign On
- C. Delegated Authentication
- D. OAuth Web-Server Flow
Answer: C
Explanation:
Delegated Authentication is the Salesforce mechanism intended for organizations that must keep password validation and authentication processing in an external system reachable through a web service. In this model, Salesforce sends the authentication request outward and relies on the external service to decide whether the credentials are valid. That is a strong fit when regulations or internal policy require the external system to remain authoritative for passwords and authentication logic. JIT provisioning and SAML SSO solve adjacent problems, but they do not match the stated SOAP-based password-validation requirement. The important architecture cue is the external SOAP web service: that points directly to delegated authentication rather than to token-based federation or user-provisioning features. This is why option B is the best answer in Salesforce terms.
NEW QUESTION # 32
A multinational industrial products manufacturer is planning to implement Salesforce CRM to manage their business. They have the following requirements:
1. They plan to implement Partner communities to provide access to their partner network.
2. They have operations in multiple countries and are planning to implement multiple Salesforce orgs.
3. Some of their partners do business in multiple countries and will need information from multiple Salesforce communities.
4. They would like to provide a single login for their partners.
How should an Identity Architect solution this requirement with limited custom development?
- A. Allow partners to choose the Salesforce org they need information from and use login flows to authenticate access.
- B. Consolidate Partner related information in a single org and provide access through Salesforce community.
- C. Register partners in one org and access information from other orgs using APIs.
- D. Create a partner login for the country of their operation and use SAML federation to provide access to other orgs.
Answer: D
Explanation:
When partners need a single login and some do business across multiple country operations, the lowest- customization answer is often to federate access across org boundaries with SAML rather than replicate identities manually in each org. A partner can maintain a primary login context and use federation to reach the additional orgs or communities they need. Consolidating everything into one org may not be feasible if country-based orgs already exist for operational reasons, while APIs and login flows create more custom work. The architectural point is that identity should be centralized even if application data remains distributed.
SAML federation is built precisely for that: one user identity can be trusted across multiple Salesforce-based service providers without forcing separate sign-in credentials per country. This is why option A is the best answer in Salesforce terms.
NEW QUESTION # 33
Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for NTO to give its customers the ability to login with their Amazon credentials.
What should an identity architect recommend to meet these requirements?
- A. Configure an OpenID Connect Authentication Provider for Amazon.
- B. Create a custom external authentication provider for Amazon.
- C. Configure a predefined authentication provider for Amazon.
- D. Configure Amazon as a connected app.
Answer: A
Explanation:
Explanation
Amazon supports OpenID Connect as an authentication protocol, which allows users to sign in with their Amazon credentials and access Salesforce resources. To enable this, an identity architect needs to configure an OpenID Connect Authentication Provider for Amazon and link it to a connected app. References: OpenID Connect Authentication Providers, Social Sign-On with OpenID Connect
NEW QUESTION # 34
Users logging into Salesforce are frequently prompted to verify their identity.
The identity architect is required to provide recommendations so that frequency of prompt verification can be reduced.
What should the identity architect recommend to meet the requirement?
- A. Implement multi-factor authentication for the Salesforce org.
- B. Implement 2FA authentication for the Salesforce org.
- C. Implement a single sign-on for Salesforce using an external identity provider.
- D. Set trusted IP ranges for the organization.
Answer: D
Explanation:
Explanation
To reduce the frequency of prompt verification for users logging into Salesforce, the identity architect should recommend setting trusted IP ranges for the organization. Trusted IP ranges are IP addresses that are considered safe for logging in without any additional verification. Users who log in from trusted IP ranges do not need to activate their computer or use a verification code. Trusted IP ranges can improve user convenience and security. References: Trusted IP Ranges, Set Trusted IP Ranges for Your Organization
NEW QUESTION # 35
A global fitness equipment manufacturer is planning to sell fitness tracking devices and has the following requirements:
1) Customer purchases the device.
2) Customer registers the device using their mobile app.
3) A case should automatically be created in Salesforce and associated with the customers account in cases where the device registers issues with tracking.
Which OAuth flow should be used to meet these requirements?
- A. OAuth 2.0 Device Flow
- B. OAuth 2.0 Asset Token Flow
- C. OAuth 2.0 User-Agent Flow
- D. OAuth 2.0 SAVL Server Assertion Flow
Answer: B
Explanation:
The OAuth 2.0 Asset Token Flow is Salesforce's purpose-built answer for connected devices and IoT-style integrations. It is designed for assets that need to act on behalf of a physical device or asset record rather than a human user. That makes it the correct fit for sensors, GPS trackers, or smart devices that must securely post telemetry or create service actions in Salesforce. User-agent, web-server, or username-password flows are built around user identity or generic application access, not around a registered device/asset relationship. The architectural advantage of the asset token model is that it ties the authorization context back to the asset, which is exactly what you want when the platform must know which device generated the event or maintenance alert. This is why option B is the best answer in Salesforce terms.
NEW QUESTION # 36
Universal Containers (UC) plans to use a SAML-based third-party IdP serving both of the Salesforce Partner Community and the corporate portal. UC partners will log in 65* to the corporate portal to access protected resources, including links to Salesforce resources. What would be the recommended way to configure the IdP so that seamless access can be achieved in this scenario?
- A. Set up the corporate portal as a Connected App in Salesforce and use the User Agent OAuth flow.
- B. Set up the corporate portal as a ConnectedApp in Salesforce and use the Web server OAuth flow.
- C. Configure IdP-initiated SSO that passes the SAML token upon Salesforce resource access request.
- D. Configure SP-initiated SSO that passes the SAML token upon Salesforce resource access request.
Answer: C
Explanation:
The recommended way to configure the IdP for seamless access is to use IdP-initiated SSO that passes the SAML token upon Salesforce resource accessrequest. This means that the user logs in to the corporate portal first, and then clicks a link to access a Salesforce resource. The IdP sends a SAML response to Salesforce with the user's identity and other attributes. Salesforce verifies the SAML response and logs in the user to the appropriate Salesforce org and community12. This way, the user does not have to log in again to Salesforce or enter any credentials3. References: 1: SAML SSO with Salesforce as the Service Provider 2: Set Up Single Sign-On for Your Internal Users Unit | Salesforce - Trailhead 3: What is IdP-Initiated Single Sign-On? - OneLogin
NEW QUESTION # 37
Northern Trail Outfitters want to allow its consumer to self-register on it business-to consumer (B2C) portal that is built on Experience Cloud. The identity architect has recommended to use Person Accounts.
Which three steps need to be configured to enable self-registration using person accounts?
Choose 3 answers
- A. Enable person accounts in the Setup page.
- B. Enable business accounts in the Setup page.
- C. Enable access to person and business account record types under Public Access Settings.
- D. Set organization-wide default sharing for Contact to Public Read Only.
- E. Under Login and Registration settings, ensure that the default account field is empty.
Answer: A,C,E
Explanation:
For Experience Cloud self-registration with Person Accounts, Salesforce requires the org and site configuration to line up with how external users are created. Person Accounts must first be enabled at the org level. On the site, the default account field must be left blank so the self-registration process doesn't force users into a shared business account model. Public access settings also need access to the relevant Person Account and business account record types so the registration process can create the right record. This is the documented pattern when self-registration is meant to create people as customers rather than contacts under a standard account. The key idea is that registration must be allowed to create the correct account model from the start. This is why options B, C, D work together as the correct solution.
NEW QUESTION # 38
......
Salesforce Identity-and-Access-Management-Architect (Salesforce Certified Identity and Access Management Architect) Certification Exam is an advanced-level certification exam designed for professionals who specialize in identity and access management within the Salesforce ecosystem. Salesforce Certified Identity and Access Management Architect certification is ideal for individuals who want to prove their mastery of the Salesforce platform's identity and access management capabilities and showcase their skills and knowledge to potential employers.
Download Real Salesforce Identity-and-Access-Management-Architect Exam Dumps Test Engine Exam Questions: https://torrentpdf.exam4tests.com/Identity-and-Access-Management-Architect-pdf-braindumps.html