Northern Trail Outfitters mar ages functional group permissions in a custom security application supported by a relational database and a REST service layer. Group permissions are mapped as permission sets in Salesforce.
Which action should an identity architect use to ensure functional group permissions are reflected as permission set assignments?

• A. Use a Login Flow with invocable Apex to callout to the security application and set permission sets.
• B. Use a Login Flow to query SAML attributes and set permission sets.
• C. Use the Apex JIT handler to callout to the security application and set permission sets
• D. Use the Apex Just-in-Time (JIT) handler to query the Security Assertion markup Language (SAML) attributes and set permission sets.

Universal containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers

• A. Set login IP ranges to the internal network for all of the app users profiles.
• B. Require high assurance sessions in order to use the connected App
• C. Use Google Authenticator as an additional part of the logical processes.
• D. Disallow the use of single Sign-on for any users of the mobile app.

The security team at Universal containers(UC) has identified exporting reports as a high-risk action and would like to require users to be logged into salesforce with their active directory (AD) credentials when doing so. For all other uses of Salesforce, Users should be allowed to use AD credentials or salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with salesforce credentials?

• A. Use SAML Federated Authentication and block access to reports when accesses through a standard assurance session.
• B. Use SAML Federated Authentication and Custom SAML jit provisioning to dynamically add or remove a permission set that grants the Export Reports permission.
• C. Use SAML Federated Authentication with a login flow to dynamically add or remove a permission set that grants the export reports permission.
• D. Use SAML Federated Authentication, treat SAML sessions as high assurance, and raise the session level required for exporting reports.

Universal Containers (UC) plans to use a SAML-based third-party IdP serving both of the Salesforce Partner Community and the corporate portal. UC partners will log in 65* to the corporate portal to access protected resources, including links to Salesforce resources. What would be the recommended way to configure the IdP so that seamless access can be achieved in this scenario?

• A. Set up the corporate portal as a Connected App in Salesforce and use the User Agent OAuth flow.
• B. Configure IdP-initiated SSO that passes the SAML token upon Salesforce resource access request.
• C. Set up the corporate portal as a Connected App in Salesforce and use the Web server OAuth flow.
• D. Configure SP-initiated SSO that passes the SAML token upon Salesforce resource access request.

Universal containers (UC) has implemented SAML SSO to enable seamless access across multiple applications. UC has regional salesforce orgs and wants it's users to be able to access them from their main Salesforce org seamless. Which action should an architect recommend?

• A. Configure the main salesforce org as an Authentication provider.
• B. Configure the regional salesforce orgs as Identity Providers.
• C. Configure the main Salesforce org as a service provider.
• D. Configure the main salesforce org as the Identity provider.