Question bank
Salesforce Certified Identity and Access Management Designer
40 Salesforce Certified Identity and Access Management Designer questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Identity Governance
8 questions in this domain
- Question 1Single Choice
Which combination represents true multi-factor authentication (MFA)?
- APassword and security question
- BTwo different passwords
- CPassword and TOTP from Salesforce AuthenticatorCorrect answer
- DUsername and password
Why this is the answer
True MFA requires unique factor categories. A password is knowledge; TOTP is possession; using both satisfies MFA.
- Question 2Multiple Select
Which of the following are authentication factor categories used in MFA? Select all that apply.
- AKnowledgeCorrect answer
- BPossessionCorrect answer
- CInherenceCorrect answer
- DIP Address
Why this is the answer
MFA relies on knowledge, possession, and inherence. IP Address is a context signal, not a factor category.
- Question 3Interactive
Review the authentication policy configuration in the code block. Which factor category is represented?
- AKnowledge
- BPossessionCorrect answer
- CInherence
- DPassword
Why this is the answer
TOTP is a possession factor because it is generated by an authenticator device or app the user controls.
- Question 4Single Choice
What is the key requirement for an authentication method to be considered MFA?
- ATwo passwords from different accounts
- BMultiple authentication steps from one factor category
- CFactors from two or more distinct categoriesCorrect answer
- DA password plus a security question
Why this is the answer
MFA requires distinct factor categories. Multiple steps using the same category are only multi-step authentication.
- Question 5Multiple Select
Why are SMS and email one-time passwords considered weak MFA factors in high-security IAM designs? Select all that apply.
- AThey are susceptible to SIM swappingCorrect answer
- BThey can be interceptedCorrect answer
- CThey rely on an inherence factor
- DThey are always impossible to replay
Why this is the answer
SMS and email OTP can be intercepted and are vulnerable to SIM swapping, making them weak factors.
- Question 6Interactive
Review the adaptive authentication snippet. Which signals are used to decide when to challenge with MFA? Select all that apply.
- AGeolocationCorrect answer
- BDevice healthCorrect answer
- CNetwork reputationCorrect answer
- DUser birth date
Why this is the answer
Adaptive authentication evaluates risk signals such as geolocation, device health, and network reputation to trigger MFA.
- Question 7Single Choice
Which approach aligns with adaptive authentication when configuring MFA?
- ARequire MFA for every login regardless of context
- BEvaluate risk signals and challenge only when neededCorrect answer
- COnly require MFA for external users
- DUse one static policy for all users
Why this is the answer
Adaptive authentication uses context to balance security and productivity by challenging only when risk warrants.
- Question 8Multiple Select
Which items are common traps in IAM design? Select all that apply.
- AConfusing MFA with Zero TrustCorrect answer
- BOver-reliance on IP whitelistingCorrect answer
- CAssuming internal users are safeCorrect answer
- DUsing granular Permission Sets
Why this is the answer
Common traps include confusing MFA with Zero Trust, relying on IP whitelisting, and treating internal users as safe. Granular Permission Sets are a best practice.
Identity and Access Management Design
8 questions in this domain
- Question 9Single Choice
In a multi-factor authentication design, which category does a TOTP code generated by the Salesforce Authenticator app belong to?
- AKnowledge
- BPossessionCorrect answer
- CInherence
- DGeolocation
Why this is the answer
A TOTP code from Salesforce Authenticator relies on something the user possesses, such as a mobile device or authenticator app, making it a possession factor. Two passwords would still be knowledge factors and would not constitute true MFA.
- Question 10Multiple Select
Which of the following are recognized factor categories in true MFA?
- AKnowledgeCorrect answer
- BPossessionCorrect answer
- CInherenceCorrect answer
- DIP Address
Why this is the answer
True MFA must combine at least two distinct factor categories: knowledge, possession, and inherence. IP address is a contextual signal, not an MFA factor category.
- Question 11Interactive
Review the authentication policy snippet. What strategy is this configuration an example of?
- AAdaptive AuthenticationCorrect answer
- BStep-up Authentication
- CMulti-step authentication
- DJust-in-Time provisioning
Why this is the answer
The policy uses context signals, such as geolocation and device health, to decide when to trigger MFA. This is the definition of adaptive authentication.
- Question 12Single Choice
What is the role of FIDO2 and WebAuthn standards in MFA design?
- AThey are phishing-resistant and use public-key cryptographyCorrect answer
- BThey rely on shared secrets sent via SMS
- CThey are only used for step-up authentication
- DThey eliminate the need for user identity verification
Why this is the answer
FIDO2/WebAuthn use hardware security keys and public-key cryptography, making authentication resistant to interception and replay by man-in-the-middle attackers.
- Question 13Multiple Select
Which Salesforce mechanisms are used to orchestrate MFA requirements according to the playbook?
- APermission SetsCorrect answer
- BSession SettingsCorrect answer
- COrganization-Wide Defaults
- DRole Hierarchies
Why this is the answer
The playbook states that MFA is managed through Permission Sets and Session Settings, allowing requirements to be assigned to specific user profiles or groups. OWDs and Role Hierarchies affect data visibility, not MFA.
- Question 14Interactive
Review the security policy snippet. What mechanism is being triggered by the high-risk activity?
- AStep-up AuthenticationCorrect answer
- BAdaptive Authentication
- CFIDO2 registration
- DJIT provisioning
Why this is the answer
The snippet describes increasing security requirements during an active session when a highly sensitive action is attempted, which is step-up authentication.
- Question 15Single Choice
Why is using two passwords not considered true MFA?
- ABoth factors belong to the same category of knowledgeCorrect answer
- BThe user may forget both passwords
- CSecurity questions are possession factors
- DTwo-step verification is always phishing-resistant
Why this is the answer
Two passwords, or a password plus a security question, both fall under the knowledge category. True MFA requires combining distinct factor categories.
- Question 16Multiple Select
Why are SMS and Email OTP considered weak factors in high-security designs?
- ASusceptibility to SIM swappingCorrect answer
- BSusceptibility to interceptionCorrect answer
- CStrong resistance to phishing
- DRequirement for hardware security keys
Why this is the answer
The playbook warns that SMS and Email OTP are susceptible to SIM swapping and interception, making them weak factors in a high-security IAM design.
Identity and Access Management Strategy
8 questions in this domain
- Question 17Single Choice
Which combination represents true multi-factor authentication?
- APassword and security question
- BTwo different passwords
- CPassword and TOTP from an authenticator appCorrect answer
- DUsername and password
Why this is the answer
MFA requires factors from distinct categories. A password is knowledge; a TOTP is possession. Combining two knowledge factors is not MFA.
- Question 18Multiple Select
Which two options are possession factors in MFA?
- APassword
- BSalesforce Authenticator TOTPCorrect answer
- CTouchID
- DYubiKeyCorrect answer
Why this is the answer
TOTP codes and hardware keys are possession factors. Passwords are knowledge factors, and TouchID is an inherence factor.
- Question 19Interactive
An IAM designer is evaluating the policy in the code block. Which limitation exists in this MFA orchestration approach?
- AIt is applied through a profile rather than a permission set
- BIt does not consider contextual risk signalsCorrect answer
- CIt requires too many authentication factors
- DIt prevents step-up authentication
Why this is the answer
Adaptive authentication uses risk signals such as geolocation and device health. This static permission-set policy enforces MFA only by role.
- Question 20Single Choice
What is the primary security property of FIDO2 and WebAuthn hardware security keys?
- AThey use public-key cryptography to prevent interception and replayCorrect answer
- BThey store passwords in the cloud for easy access
- CThey rotate IP addresses to hide user location
- DThey encrypt all network traffic between the browser and server
Why this is the answer
FIDO2 and WebAuthn use public-key cryptography, preventing man-in-the-middle attackers from intercepting or replaying authentication.
- Question 21Multiple Select
Which three risk signals can trigger adaptive authentication?
- AGeolocationCorrect answer
- BDevice healthCorrect answer
- CNetwork reputationCorrect answer
- DPassword length
Why this is the answer
Adaptive authentication evaluates geolocation, device health, and network reputation to trigger MFA only when the risk level requires it.
- Question 22Interactive
Given the active session metadata in the code block, what should the IAM designer implement before allowing the requested action?
- AStep-up authenticationCorrect answer
- BA second password
- CIP whitelisting
- DPermanent elevated access
Why this is the answer
When a sensitive transaction is attempted during an active session, step-up authentication re-verifies the user's identity with an additional MFA challenge.
- Question 23Single Choice
Why is a password combined with a security question not considered true MFA?
- ABoth factors belong to the knowledge categoryCorrect answer
- BSecurity questions are deprecated in Salesforce
- CIt uses more than one authentication factor
- DIt does not require a username
Why this is the answer
MFA requires factors from different categories. A password and a security question are both knowledge factors, making it multi-step, not MFA.
- Question 24Multiple Select
Which two weaknesses make SMS and email OTP weak factors in high-security IAM design?
- ASIM swappingCorrect answer
- BInterceptionCorrect answer
- CThey are too convenient for users
- DThey require hardware security keys
Why this is the answer
SMS and email OTP are susceptible to SIM swapping and interception, making them weak factors in high-security IAM scenarios.
Integration and Architecture
8 questions in this domain
- Question 25Single Choice
Which combination of identity factors meets the definition of true multi-factor authentication rather than multi-step authentication?
- APassword and a second password
- BPassword and a security question
- CPassword and a YubiKey hardware keyCorrect answer
- DUsername and password
Why this is the answer
True MFA requires factors from distinct categories: knowledge, possession, and inherence. Two knowledge factors such as passwords and security questions are only multi-step authentication.
- Question 26Multiple Select
Which of the following are risk signals used by adaptive authentication to determine when additional MFA verification should be required? Select all that apply.
- AGeolocationCorrect answer
- BDevice healthCorrect answer
- CNetwork reputationCorrect answer
- DUser's favorite color
Why this is the answer
Adaptive authentication evaluates geolocation, device health, and network reputation to balance security with user friction; a favorite color is not a risk signal.
- Question 27Interactive
A configuration block in the code defines an authentication factor that relies on public-key cryptography. Which authentication standard does it represent?
- AFIDO2/WebAuthnCorrect answer
- BTOTP with Salesforce Authenticator
- CKnowledge-based password
- DEmail one-time passcode
Why this is the answer
FIDO2/WebAuthn uses hardware security keys and public-key cryptography, providing phishing-resistant authentication. TOTP, passwords, and email OTP are not based on that public-key standard.
- Question 28Single Choice
In Salesforce, where can an identity administrator centrally manage MFA requirements to apply different policies to user groups?
- APermission Sets and Session SettingsCorrect answer
- BProfile-level password history settings only
- CEmail administration settings
- DSandbox deployment settings
Why this is the answer
MFA requirements are orchestrated through Permission Sets and Session Settings, allowing high-privilege users to have stricter requirements than standard users.
- Question 29Multiple Select
Which scenarios should trigger a step-up MFA challenge under Authentication Context during an active session? Select all that apply.
- AAccessing a highly sensitive objectCorrect answer
- BPerforming a critical transactionCorrect answer
- CEntering the same password twice
- DRe-verifying identity after a risk increaseCorrect answer
Why this is the answer
Step-up authentication increases security during an active session for sensitive objects, critical transactions, or elevated risk. Entering the same password twice is not a step-up trigger.
- Question 30Interactive
The code block defines a temporary access window during which elevated privileges are available. Which IAM principle does this architecture implement?
- AJust-in-Time provisioning and accessCorrect answer
- BOrganization-Wide Defaults
- COAuth scopes
- DTLS encryption
Why this is the answer
Just-in-Time provisioning grants elevated privileges only for the active session or required window, reducing the duration of high-level access.
- Question 31Single Choice
Which architecture elements minimize the blast radius if an integration token or service account is compromised?
- ARestriction Rules and Scoped Credential configurationsCorrect answer
- BA single Connected App with full API access
- CBroad object permissions on a shared profile
- DUnrestricted org-wide API access
Why this is the answer
Strict Restriction Rules and Scoped Credential configurations limit lateral movement and contain the impact of compromised credentials.
- Question 32Multiple Select
Which Salesforce data visibility controls enforce least privilege by limiting the records a user can actually see? Select all that apply.
- AOrganization-Wide DefaultsCorrect answer
- BRole HierarchiesCorrect answer
- CSharing RulesCorrect answer
- DProfile CRUD permissions alone
Why this is the answer
OWDs set the baseline, Role Hierarchies and Sharing Rules expand visibility by role or criteria; profile CRUD alone does not guarantee record-level visibility.
Secure Data Access
8 questions in this domain
- Question 33Single Choice
In the context of MFA design, which combination of authentication factors represents true MFA instead of mere multi-step authentication?
- ATwo different passwords
- BPassword plus security question
- CFingerprint plus FaceID
- DPassword plus TOTPCorrect answer
Why this is the answer
True MFA requires distinct factor categories; password is knowledge and TOTP is possession. Using two passwords only extends the number of steps.
- Question 34Multiple Select
Which of the following are recognized MFA factor categories that a designer should use when securing data access?
- AKnowledgeCorrect answer
- BPossessionCorrect answer
- CInherenceCorrect answer
- DLocation
Why this is the answer
Knowledge, possession, and inherence are the three distinct categories. Location can influence adaptive authentication but is not an MFA factor category.
- Question 35Interactive
Based on the policy shown in the code block, to which group should the MFA requirement apply?
- ASystem AdministratorsCorrect answer
- BStandard Users
- CGuest Users
- DExternal Users
Why this is the answer
The code block assigns the always-on MFA challenge to System Administrators, supporting stronger requirements for high-privilege users.
- Question 36Single Choice
What is the primary purpose of adaptive authentication in an access design that balances security and user productivity?
- AChallenge users at every login
- BTrigger MFA based on evaluated riskCorrect answer
- CEliminate all passwords
- DRestrict access to one geographic region
Why this is the answer
Adaptive authentication uses context such as location, device health, and network reputation to challenge only when risk warrants it.
- Question 37Multiple Select
Which risk signals should adaptive authentication evaluate when deciding whether to trigger an MFA challenge?
- AGeolocationCorrect answer
- BDevice healthCorrect answer
- CNetwork reputationCorrect answer
- DHair color
Why this is the answer
Geolocation, device health, and network reputation are risk signals. Adaptive authentication should not rely on unrelated personal attributes.
- Question 38Interactive
Which authentication standard is represented by the public-key credential request shown in the code block?
- AFIDO2 WebAuthnCorrect answer
- BTOTP
- CEmail OTP
- DSecurity question
Why this is the answer
The publicKey WebAuthn request uses hardware-bound public-key cryptography, making it phishing-resistant and resistant to replay attacks.
- Question 39Single Choice
What is the primary security advantage of FIDO2 and WebAuthn over traditional OTP authentication methods?
- AUses public-key cryptographyCorrect answer
- BUses shared secrets
- CRelies on SMS delivery
- DEliminates user verification
Why this is the answer
FIDO2 and WebAuthn rely on public-key cryptography, preventing credential interception or replay by man-in-the-middle attackers.
- Question 40Multiple Select
Which statements correctly describe how MFA policy is orchestrated with Permission Sets and Session Settings in Salesforce?
- AManaged through Permission Sets and Session SettingsCorrect answer
- BHigh-privilege users can have stricter MFA requirementsCorrect answer
- CApplies only at the org-wide level
- DProfiles are the only way to assign MFA
Why this is the answer
Salesforce MFA uses Permission Sets and Session Settings, enabling stricter requirements for high-privilege users; profiles are not the only option.
Frequently asked questions
Everything about the Salesforce Certified Identity and Access Management Designer question bank and how to use it.