Free Salesforce Platform Identity and Access Management Architect Practice Test Questions

Explanation:

Universal Containers wants to use Salesforce Identity (as the Identity Provider) to control access to a custom time tracking app built on a third-party system. This scenario requires Salesforce users (internal employees) to authenticate via Salesforce and gain SSO access to the external app, typically through a Connected App configured with SAML, OAuth, or delegated authentication.

The minimum license required for this use case is the Identity Only license.

Why "Identity Only"?
This license is specifically designed for internal employees who only need access to Salesforce Identity services (such as SSO to external/connected applications) without needing access to Salesforce CRM data, objects, reports, or standard apps.
It allows users to log in to third-party applications integrated with Salesforce Identity while keeping costs minimal for users who do not require full Salesforce platform access.
In the context of the exam, this is the standard recommendation when Salesforce acts as the IdP for employee access to external apps.

Why the other options are incorrect
External Identity — This license is intended for external users (customers, partners, or self-service scenarios) in Experience Cloud (formerly Communities). It provides limited access to some standard and custom objects for self-service portals, not for internal employees accessing a third-party employee time-tracking app.
Identity Connect — This is a tool/product for synchronizing users and groups between Salesforce and external directories (e.g., Active Directory), not a user license.
Identity Verification — This refers to add-on features or credits for identity verification (e.g., via SMS, authenticator apps, or third-party services for MFA/enhanced security), not a base license for SSO access control.

Reference
According to Salesforce documentation on Identity Licenses:
Identity Only licenses provide extra capacity for employees to use identity services like single sign-on (SSO) to connected apps without a full Salesforce or Platform license.

This aligns directly with the exam's focus on choosing the right license type for Salesforce as an Identity Provider (IdP) scenarios involving internal users and third-party applications.

Explanation:

Northern Trail Outfitters wants to implement passwordless login for its customer service portal (Experience Cloud) using a one-time passcode (OTP) sent via email or SMS.

Here’s how Identity Verification Credits work in this context:

Email-based verification (one-time passcode sent to email) → Free (no credits consumed).
SMS-based verification (one-time passcode sent via text message) → Consumes Identity Verification Credits.

Identity Verification Credits are a usage-based add-on (not a fixed user license). They are consumed per SMS message sent for identity verification purposes, including:

Passwordless login OTPs
MFA challenges
Other verification flows (e.g., registration, password reset)

Why Option C is Correct
It accurately states that credits are consumed with each SMS sent.
Estimation must be based on the number of login verification challenges where users choose (or are routed to) SMS as the delivery method.
Since customers can choose email or SMS, estimation should be based on the projected percentage of users who will use SMS, not total logins.

Why the Other Options Are Incorrect
A: Incorrect. It states “with each verification sent” which is too broad. Email verifications do not consume credits. Only SMS-based verifications consume credits.

B: Incorrect. There is no standard 10,000 free credits per community per month. Identity Verification Credits are not allocated as a fixed free monthly quota per community; they are consumption-based and billed according to usage.

D: Incorrect. Identity Verification Credits are not directly tied to the number of Community licenses. They are a consumption-based entitlement similar to usage-based services like API calls or messaging, not a per-license allocation.

Key Takeaways for the Exam
Email OTP in passwordless login → No cost (no credits consumed).
SMS OTP → Consumes Identity Verification Credits.

When estimating usage, consider:
Total expected logins per month.
Percentage of users likely to choose SMS vs email.
Additional buffer for retries, failed attempts, or resend scenarios.

This is a classic licensing and estimation scenario that tests understanding of Experience Cloud identity features and usage-based billing behavior.

Explanation:

When you need to apply specific security constraints that differ from the global organizational defaults for a specific application, you utilize the Connected App OAuth policies. This allows you to exert fine-grained control over how that specific integration behaves.

Why this is the correct choice

Granular Control: Within the OAuth Policies section of a Connected App, administrators can configure IP Relaxation (which can be set to "Enforce IP restrictions" to require that the application only be accessed from specific IP ranges defined in the org) and Session Timeout values.

Scope: These settings override the organization-wide defaults, ensuring that the specific integration (the Connected App) adheres to the security posture required for the partner portal, even if other parts of the organization have more relaxed settings.

Why the other options are incorrect

Session Settings: These are organization-wide configurations (found in Setup). Modifying these would impact all users and all applications within your Salesforce org, not just the specific Connected App for the partner portal.

Login IP Ranges: While you can define Login IP ranges on a Profile level, this is a restrictive approach that applies to the user's entire session in Salesforce. It is not a configuration specific to a Connected App’s authentication flow.

Custom Permissions: These are used to grant access to specific features or buttons within your Salesforce implementation (e.g., "Can Edit Confidential Records"). They have no role in controlling IP restrictions or session timeout durations.

References
Salesforce Help: Manage OAuth Access Policies for a Connected App
Salesforce Help: Understanding Connected App Settings