NEW 2026 Certification Sample Questions Plat-Arch-203 Dumps & Practice Exam
Plat-Arch-203 Deluxe Study Guide with Online Test Engine
NEW QUESTION # 52
A third-party app provider would like to have users provisioned via a service endpoint before users access their app from Salesforce.
What should an identity architect recommend to configure the requirement with limited changes to the third-party app?
- A. Redirect users to the third-party app for registration.
- B. Use a connected app with user provisioning flow.
- C. Use Salesforce identity with Security Assertion Markup Language (SAML) for provisioning users.
- D. Create Canvas app in Salesforce for third-party app to provision users.
Answer: B
NEW QUESTION # 53
Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.
What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?
- A. Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at first login.
- B. Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.
- C. Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.
- D. Build an integration that queries LDAP periodically and creates new active users in Salesforce.
Answer: B
NEW QUESTION # 54
Universal Containers (UC) wants its users to access Salesforce and other SSO-enabled applications from a custom web page that UC magnets. UC wants its users to use the same set of credentials to access each of the applications. what SAML SSO flow should an Architect recommend for UC?
- A. SP-Initiated
- B. SP-Initiated with Deep Linking
- C. IdP-Initiated
- D. User-Agent
Answer: C
NEW QUESTION # 55
Which three are capabilities of SAML-based Federated authentication? Choose 3 answers
- A. Centralized federation provides single point of access, control and auditing.
- B. Access tokens are used to access resources on the server once the user is authenticated.
- C. Trust relationships between Identity Provider and Service Provider are required.
- D. SAML tokens can be in XML or JSON format and can be used interchangeably.
- E. Web applications with no passwords are more secure and stronger against attacks.
Answer: A,B,C
NEW QUESTION # 56
Universal Containers is creating a web application that will be secured by Salesforce Identity using the OAuth 2.0 Web Server Flow uses the OAuth 2.0 authorization code grant type).
Which three OAuth concepts apply to this flow?
Choose 3 answers
- A. Client Secret
- B. Verification URL
- C. Scopes
- D. Access Token
Answer: A,C,D
NEW QUESTION # 57
A financial enterprise is planning to set up a user authentication mechanism to login to the Salesforce system. Due to regulatory requirements, the CIO of the company wants user administration, including passwords and authentication requests, to be managed by an external system that is only accessible via a SOAP webservice.
Which authentication mechanism should an identity architect recommend to meet the requirements?
- A. OAuth Web-Server Flow
- B. Just-in-Time Provisioning
- C. Delegated Authentication
- D. Identity Connect
Answer: C
NEW QUESTION # 58
Universal Containers (UC) would like its community users to be able to register and log in with Linkedin or Facebook Credentials. UC wants users to clearly see Facebook &Linkedin Icons when they register and login. What are the two recommended actions UC can take to achieve this Functionality? Choose 2 answers
- A. Store the Linkedin or Facebook user IDs in the Federation ID field on the Salesforce User record.
- B. Enable Facebook and Linkedin as Login options in the login section of the Community configuration.
- C. Create custom buttons for Facebook and inkedin using JAVAscript/CSS on a custom Visualforce page.
- D. Create custom Registration Handlers to link Linkedin and facebook accounts to user records.
Answer: B,D
NEW QUESTION # 59
Which two are valid choices for digital certificates when setting up two-way SSL between Salesforce and an external system. Choose 2 answers
- A. Use a self-signed certificate for salesforce and a self-signed cert for the external system
- B. Use a trusted CA-signed certificate for salesforce and a self-signed cert for the external system
- C. Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system
- D. Use a trusted CA-signed certificate for salesforce and a trusted CA-signed cert for the external system
Answer: A,C
NEW QUESTION # 60
Universal Containers (UC) implemented SSO to a third-party system for their Salesforce users to access the App Launcher. UC enabled "User Provisioning" on the Connected App so that changes to user accounts can be synched between Salesforce and the third party system. However, UC quickly notices that changes to user roles in Salesforce are not getting synched to the third-party system. What is the most likely reason for this behaviour?
- A. Salesforce roles have more than three levels in the role hierarchy.
- B. Required operation(s) was not mapped in User Provisioning Settings.
- C. The Approval queue for User Provisioning Requests is unmonitored.
- D. User Provisioning for Connected Apps does not support role sync.
Answer: D
NEW QUESTION # 61
universal container plans to develop a custom mobile app for the sales team that will use salesforce for authentication and access management. The mobile app access needs to be restricted to only the sales team. What would be the recommended solution to grant mobile app access to sales users?
- A. Use a custom attribute on the user object to control access to the mobile app
- B. Add a new identity provider to authenticate and authorize mobile users.
- C. Use connected apps Oauth policies to restrict mobile app access to authorized users.
- D. Use the permission set license to assign the mobile app permission to sales users
Answer: C
NEW QUESTION # 62
A technology enterprise is planning to implement single sign-on login for users. When users log in to the Salesforce User object custom field, data should be populated for new and existing users.
Which two steps should an identity architect recommend?
Choose 2 answers
- A. Implement SesslonManagement Class.
- B. Implement Auth.SamlJitHandler Interface.
- C. Create and update methods.
- D. Implement RegistrationHandler Interface.
Answer: B,C
NEW QUESTION # 63
Northern Trail Outfitters is implementing a busmess-to-business (B2B) collaboration site using Salesforce Experience Cloud. The partners will authenticate with an existing identity provider and the solution will utilize Security Assertion Markup Language (SAML) to provide single sign-on to Salesforce. Delegated administration will be used in the Expenence Cloud site to allow the partners to administer their users' access.
How should a partner identity be provisioned in Salesforce for this solution?
- A. Create a person account.
- B. Create a contactless user.
- C. Create only a contact.
- D. Create a user and a related contact.
Answer: D
NEW QUESTION # 64
Universal containers (UC) uses an internal company portal for their employees to collaborate. UC decides to use salesforce ideas and provide the ability for employees to post ideas from the company portal. They use SAML-BASED SSO to get into the company portal and would like to leverage it to access salesforce. Most of the users don't exist in salesforce and they would like the user records created in salesforce communities the first time they try to access salesforce. What recommendation should an architect make to meet this requirement?
- A. Use Identity connect to sync users
- B. Use on-the-fly provisioning
- C. Use salesforce APIs to create users on the fly
- D. Use just-in-time provisioning
Answer: D
NEW QUESTION # 65
Universal Containers (UC) has a desktop application to collect leads for marketing campaigns. UC wants to extend this application to integrate with Salesforce to create leads. Integration between the desktop application and Salesforce should be seamless. What Authorization flow should the Architect recommend?
- A. Username and Password Flow
- B. Web Server Authentication Flow
- C. User Agent Flow
- D. JWT Bearer Token Flow
Answer: C
NEW QUESTION # 66
Universal Containers (UC) has implemented SSO according to the diagram below. uses SAML while Salesforce Org 1 uses OAuth 2.0. Users usually start their day by first attempting to log into Salesforce Org 2 and then later in the day, they will log into either the Financial System or CPQ system depending upon their job position. Which two systems are acting as Identity Providers?
- A. Pingfederate
- B. Salesforce Org 1
- C. Salesforce Org 2
- D. Financial System
Answer: A,B
NEW QUESTION # 67
An insurance company has a connected app in its Salesforce environment that is used to integrate with a Google Workspace (formerly knot as G Suite).
An identity and access management (IAM) architect has been asked to implement automation to enable users, freeze/suspend users, disable users, and reactivate existing users in Google Workspace upon similar actions in Salesforce.
Which solution is recommended to meet this requirement?
- A. Build a custom REST endpoint in Salesforce that Google Workspace can poll against.
- B. Configure user Provisioning for Connected Apps.
- C. Update the Security Assertion Markup Language Just-in-Time (SAML JIT) handler in Salesforce for user provisioning and de-provisioning.
- D. Build an Apex trigger on the userlogin object to make asynchronous callouts to Google APIs.
Answer: B
NEW QUESTION # 68
The security team at Universal containers(UC) has identified exporting reports as a high-risk action and would like to require users to be logged into salesforce with their active directory (AD) credentials when doing so. For all other uses of Salesforce, Users should be allowed to use AD credentials or salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with salesforce credentials?
- A. Use SAML Federated Authentication with a login flow to dynamically add or remove a permission set that grants the export reports permission.
- B. Use SAML Federated Authentication and block access to reports when accesses through a standard assurance session.
- C. Use SAML Federated Authentication, treat SAML sessions as high assurance, and raise the session level required for exporting reports.
- D. Use SAML Federated Authentication and Custom SAML jit provisioning to dynamically add or remove a permission set that grants the Export Reports permission.
Answer: B
NEW QUESTION # 69
Universal Containers has multiple Salesforce instances where users receive emails from different instances. Users should be logged into the correct Salesforce instance authenticated by their IdP when clicking on an email link to a Salesforce record.
What should be enabled in Salesforce as a prerequisite?
- A. My Domain
- B. Multi-Factor Authentication
- C. Identity Provider
- D. External Identity
Answer: A
NEW QUESTION # 70
Northern Trail Outfitters would like to automatically create new employee users in Salesforce with an appropriate profile that maps to its Active Directory Department.
How should an identity architect implement this requirement?
- A. Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.
- B. Use a login flow to collect Security Assertion Markup Language attributes and assign the appropriate profile during Just-In-Time
- C. Make a callout during the login flow to query department from Active Directory to assign the appropriate profile.
- D. Use the createUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.
Answer: A
NEW QUESTION # 71
When designing a multi-branded Customer Identity and Access Management solution on the Salesforce Platform, how should an identity architect ensure a specific brand experience in Salesforce is presented?
- A. The Audience ID, which can be set in a shared cookie.
- B. Provide a brand picker that the end user can use to select its sub-brand when they arrive on salesforce.
- C. Add a custom parameter to the service provider's OAuth/SAML call and implement logic on its login page to apply branding based on the parameters value.
- D. The Experience ID, which can be included in OAuth/Open ID flows and Security Assertion Markup Language (SAML) flows as a URL parameter.
Answer: D
NEW QUESTION # 72
Universal Containers (UC) is implementing Salesforce and would like to establish SAML SSO for its users to log in. UC stores its corporate user identities in a Custom Database. The UC IT Manager has heard good things about Salesforce Identity Connect as an Idp, and would like to understand what limitations they may face if they decided to use Identity Connect in their current environment. What limitation Should an Architect inform the IT Manager about?
- A. Identity Connect will only support Idp-initiated SAML flows in UC's current environment.
- B. Identity connect is not compatible with UC's current identity environment.
- C. Identity Connect will not support user provisioning in UC's current environment.
- D. Identity Connect will only support SP-initiated SAML flows in UC's current environment.
Answer: C
NEW QUESTION # 73
Universal Containers (UC) uses Salesforce to allow customers to keep track of the order status. The customers can log in to Salesforce using external authentication providers, such as Facebook and Google. UC is also leveraging the App Launcher to let customers access an of platform application for generating shipping labels. The label generator application uses OAuth to provide users access. What license type should an Architect recommend for the customers?
- A. Customer Community license
- B. Identity license
- C. Customer Community Plus license
- D. External Identity license
Answer: B
NEW QUESTION # 74
A global fitness equipment manufacturer is planning to sell fitness tracking devices and has the following requirements:
1) Customer purchases the device.
2) Customer registers the device using their mobile app.
3) A case should automatically be created in Salesforce and associated with the customers account in cases where the device registers issues with tracking.
Which OAuth flow should be used to meet these requirements?
- A. OAuth 2.0 User-Agent Flow
- B. OAuth 2.0 SAML Bearer Assertion Flow
- C. OAuth 2.0 Asset Token Flow
- D. OAuth 2.0 Username-Password Flow
Answer: C
NEW QUESTION # 75
......
Plat-Arch-203 dumps review - Professional Quiz Study Materials: https://www.passcollection.com/Plat-Arch-203_real-exams.html
Plat-Arch-203 Test Prep Training Practice Exam Questions Practice Tests: https://drive.google.com/open?id=1b4fGLTV4ssuw4ULSiNEdT6lPWOVUnU7n
