Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Exam Questions Instant Access

Question 1

Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?

ACheck the Refresh Token policy defined in the Salesforce Connected App.

BValidate that the users are checking the box to remember their passwords.

CVerify that the Callback URL is correctly pointing to the new URI Scheme.

DConfirm that the access Token's Time-To-Live policy has been set appropriately.

Answer : A

Question 2

How should an identity architect automate provisioning and deprovisioning of users into Salesforce from an external system?

ACall SOAP API upsertQ on user object.

BUse Security Assertion Markup Language Just-in-Time (SAML JIT) on incoming SAML assertions.

CRun registration handler on incoming OAuth responses.

DCall OpenID Connect (OIDC)-userinfo endpoint with a valid access token.

Answer : C

Question 3

Universal Containers (UC) wants its closed Won opportunities to be synced to a Data Warehouse in near real time. UC has implemented Outbound Message to enable near real-time data sync. UC wants to ensure that communication between Salesforce and Target System is Secure. What Certificate is sent along with the Outbound Message?

AThe CA-Signed Certificate from the Certificate and Key Management menu.

BThe default Client Certificate from the Develop--> API Menu.

CThe default Client Certificate or a Certificate from Certificate and Key Management menu.

DThe Self-Signed Certificates from the Certificate & Key Management menu.

Answer : B

Question 4

Universal Containers (UC) implemented SSO to a third-party system for their Salesforce users to access the App Launcher. UC enabled ''User Provisioning'' on the Connected App so that changes to user accounts can be synched between Salesforce and the third party system. However, UC quickly notices that changes to user roles in Salesforce are not getting synched to the third-party system. What is the most likely reason for this behaviour?

AUser Provisioning for Connected Apps does not support role sync.

BRequired operation(s) was not mapped in User Provisioning Settings.

CThe Approval queue for User Provisioning Requests is unmonitored.

DSalesforce roles have more than three levels in the role hierarchy.

Answer : A

Question 5

Northern Trail Outfitters want to allow its consumer to self-register on it business-to-consumer (B2C) portal that is built on Experience Cloud. The identity architect has recommended to use Person Accounts.

Which three steps need to be configured to enable self-registration using person accounts?

Choose 3 answers

AEnable access to person and business account record types under Public Access Settings.

BContact Salesforce Support to enable business accounts.

CUnder Login and Registration settings, ensure that the default account field is empty.

DContact Salesforce Support to enable person accounts.

ESet organization-wide default sharing for Contact to Public Read Only.

Answer : A, C, D

Question 6

Universal Containers (UC) has a strict requirement to authenticate users to Salesforce using their mainframe credentials. The mainframe user store cannot be accessed from a SAML provider. UC would also like to have users in Salesforce created on the fly if they provide accurate mainframe credentials.

How can the Architect meet these requirements?

AUse a Salesforce Login Flow to call out to a web service and create the user on the fly.

BUse the SOAP API to create the user when created on the mainframe; implement Delegated Authentication.

CImplement Just-In-Time Provisioning on the mainframe to create the user on the fly.

DImplement OAuth User-Agent Flow on the mainframe; use a Registration Handler to create the user on the fly.

Answer : C

Question 7

Universal Containers (UC) has a classified information system that its call center team uses only when they are working on a case with a record type "Classified". They are only allowed to access the system when they own an open "Classified" case, and their access to the system is removed at all other times. They would like to implement SAML SSO eith Salesforce as the Idp, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "Classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying the access to the classified information system based on the open "classified" case record criteria?

AUse Salesforce reports to identify users that currently owns open 'Classified' cases and should be granted access to the Classified information system.

BUse Apex trigger on case to dynamically assign permission Sets that Grant access when an user is assigned with an open 'Classified' case, and remove it when the case is closed.

CUse Custom SAML JIT Provisioning to dynamically query the user's open 'Classified' cases when attempting to access the classified information system.

DUse a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open 'Classified' Cases.

Answer : D