SP Network Fundamentals 3 — Questions and Answers
Question 1: A company wants to restrict Salesforce login to office IP addresses only. Which Salesforce feature supports this requirement?
- Login Flows
- Trusted IP Ranges on the Network Access settings page (Correct answer)
- Permission Sets
- Profile-based time restrictions
Correct answer: Trusted IP Ranges on the Network Access settings page
Salesforce's Trusted IP Ranges feature under Network Access restricts login to specified IP address ranges.
Question 2: Which OSI layer is responsible for end-to-end error detection and flow control between hosts?
- Network Layer (Layer 3)
- Data Link Layer (Layer 2)
- Transport Layer (Layer 4) (Correct answer)
- Session Layer (Layer 5)
Correct answer: Transport Layer (Layer 4)
The Transport Layer (Layer 4) handles end-to-end communication, flow control, and error detection using protocols like TCP.
Question 3: What is the subnet mask for a /24 CIDR block?
- 255.255.0.0
- 255.0.0.0
- 255.255.255.0 (Correct answer)
- 255.255.255.128
Correct answer: 255.255.255.0
A /24 CIDR block corresponds to the subnet mask 255.255.255.0, providing 256 addresses.
Question 4: When Salesforce sends outbound callouts to external systems, which IP range should be added to the external system's firewall?
- The client user's ISP IP range
- Salesforce outbound IP addresses published in the Salesforce Help documentation (Correct answer)
- The Salesforce org's My Domain IP
- RFC 1918 private IP ranges
Correct answer: Salesforce outbound IP addresses published in the Salesforce Help documentation
External systems must whitelist Salesforce's published outbound IP ranges to accept callouts from Salesforce.
Question 5: Which technology allows multiple virtual networks to share the same physical network infrastructure while remaining isolated?
- NAT (Network Address Translation)
- VLAN (Virtual Local Area Network) (Correct answer)
- BGP (Border Gateway Protocol)
- ICMP (Internet Control Message Protocol)
Correct answer: VLAN (Virtual Local Area Network)
VLANs segment a physical network into multiple isolated logical networks at Layer 2.
Question 6: A Salesforce Connected App uses certificate-based authentication. Where must the certificate be registered?
- On the client's local browser
- In the Connected App's Digital Certificate field in Salesforce Setup (Correct answer)
- In the Salesforce org's DNS settings
- On the client's VPN server
Correct answer: In the Connected App's Digital Certificate field in Salesforce Setup
For JWT bearer token flows, the X.509 certificate must be uploaded to the Connected App configuration in Salesforce Setup.
Question 7: What is the primary purpose of Network Address Translation (NAT)?
- To encrypt all outbound network traffic
- To map private internal IP addresses to a public IP address (Correct answer)
- To assign dynamic IP addresses to devices
- To filter malicious packets at the network perimeter
Correct answer: To map private internal IP addresses to a public IP address
NAT allows multiple devices on a private network to share a single public IP address for internet communication.
SP Network Fundamentals 3
A company wants to restrict Salesforce login to office IP addresses only.
Which Salesforce feature supports this requirement?