Salesforce Certified Platform Identity and Access Management Architect

QUESTION NO: 1
Universal Containers would like its customers to register and log in to a portal built on Salesforce Experience Cloud. Customers should be able to use their Facebook or Linkedln credentials for ease of use.
Which three steps should an identity architect take to implement social sign-on?
Choose 3 answers

A. Update the default registration handlers to create and update users. B. Check "Facebook" and "Linkedln" under Login Page Setup. C. Register both Facebook and Linkedln as connected apps. D. Create authentication providers for both Facebook and Linkedln. E. Enable "Federated Single Sign-On Using SAML".

Correct Answer: A,B,D

QUESTION NO: 2
Containers (UC) uses an internal system for recruiting and would like to have the candidates' info available in the Salesforce automatically when they are selected. UC decides to use OAuth to connect to Salesforce from the recruiting system and would like to do the authentication using digital certificates. Which two OAuth flows should be considered to meet the requirement? Choose 2 answers

A. Web Service flow B. SAML Bearer Assertion flow C. JWT Bearer Token flow D. Refresh Token flow

Correct Answer: B,C

QUESTION NO: 3
Sales users at Universal containers use salesforce for Opportunity management. Marketing uses a third-party application called Nest for Lead nurturing that is accessed using username/password. The VP of sales wants to open up access to nest for all sales uses to provide them access to lead history and would like SSO for better adoption. Salesforce is already setup for SSO and uses Delegated Authentication. Nest can accept username/Password or SAML-based Authentication. IT teams have received multiple password-related issues for nest and have decided to set up SSO access for Nest for Marketing users as well. The CIO does not want to invest in a new IDP solution and is considering using Salesforce for this purpose. Which are appropriate license type choices for sales and marketing users, giving salesforce is using Delegated Authentication? Choose 2 answers

A. Salesforce license for sales users and Identity license for Marketing users B. Salesforce license for sales users and External Identity license for Marketing users C. Identity license for sales users and Identity connect license for Marketing users D. Salesforce license for sales users and platform license for Marketing users.

Correct Answer: A,D

QUESTION NO: 4
Which two roles of the systems are involved in an environment where salesforce users are enabled to access Google Apps from within salesforce through App launcher and connected App set up? Choose 2 answers

A. Salesforce is the service provider B. Google is the service provider C. Salesforce is the identity provider D. Google is the identity provider

Correct Answer: A

QUESTION NO: 5
Universal containers (UC) is building a mobile application that will make calls to the salesforce REST API. Additionally UC would like to provide the optimal experience for its mobile users. Which two OAuth scopes should UC configure in the connected App? Choose 2 answers

A. Refresh token B. Web C. full D. API

Correct Answer: A,D

QUESTION NO: 6
Northern Trail Outfitters wants to implement a partner community. Active community users will need to review and accept the community rules, and update key contact information for each community member before their annual partner event.
Which approach will meet this requirement?

A. Create tasks for users who need to update their data or accept the new community rules. B. Create a custom landing page and email campaign asking all community members to login and verify their data. C. Create a login flow that conditionally prompts users who have not accepted the new community rules and who have missing or outdated information. D. Add a banner to the community Home page asking users to update their profile and accept the new community rules.

Correct Answer: C

QUESTION NO: 7
Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?

A. The app is requesting too many access Tokens in a 24-hour period B. The refresh token expiration policy is set incorrectly in salesforce C. The users forget to check the box to remember their credentials. D. The Oauth authorizations are being revoked by a nightly batch job.

Correct Answer: B

QUESTION NO: 8
Universal Containers (UC) is building a custom Innovation platform on their Salesforce instance. The Innovation platform will be written completely in Apex and Visualforce and will use custom objects to store the Data. UC would like all users to be able to access the system without having to log in with Salesforce credentials. UC will utilize a third-party idp using SAML SSO. What is the optimal Salesforce licence type for all of the UC employees?

A. Salesforce Licence. B. Identity Licence. C. External Identity Licence. D. Salesforce Platform Licence.

Correct Answer: D

QUESTION NO: 9
Uwversal Containers (UC) is building a custom employee hut) application on Amazon Web Services (AWS) and would like to store their users' credentials there. Users will also need access to Salesforce for internal operations. UC has tasked an identity architect with evaluating Afferent solutions for authentication and authorization between AWS and Salesforce.
How should an identity architect configure AWS to authenticate and authorize Salesforce users?

A. Configure AWS as an OpenID Connect Provider. B. Create a custom external authentication provider. C. Develop a custom Auth server in AWS. D. Configure the custom employee app as a connected app.

Correct Answer: A

QUESTION NO: 10
Universal containers (UC) wants to implement a partner community. As part of their implementation, UC would like to modify both the Forgot password and change password experience with custom branding for their partner community users. Which 2 actions should an architect recommend to UC? Choose 2 answers

A. Build a custom visualforce page for the change password experience and a community builder page for the Forgot password experience. B. Build a custom visualforce page for both the change password and Forgot password experiences. C. Build a community builder page for both the change password and Forgot password experiences. D. Build a community builder page for the change password experience and Custom Visualforce page for the Forgot password experience.

Correct Answer: A,B

QUESTION NO: 11
An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?

A. Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to 'Admin Pre-Approved". B. Enable the Full Access Scope and then set the connected app access settings to "Admin Pre-Approved". C. Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to "Admin Pre-Approved". D. Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to "User may self authorize".

Correct Answer: C

QUESTION NO: 12
Universal Containers (UC) has an existing Salesforce org configured for SP-Initiated SAML SSO with their Idp. A second Salesforce org is being introduced into the environment and the IT team would like to ensure they can use the same Idp for new org. What action should the IT team take while implementing the second org?

A. Use the same SAML Identity location as the first org. B. Use the Salesforce Username as the SAML Identity Type. C. Use a different Entity ID than the first org. D. Use the same request bindings as the first org.

Correct Answer: C

QUESTION NO: 13
Universal containers (UC) has built a custom based Two-factor Authentication (2fa) system for their existing on-premise applications. Thru are now implementing salesforce and would like to enable a Two-factor login process for it, as well. What is the recommended solution an architect should consider?

A. Use the custom 2fa system for on-premise applications and native 2fa for salesforce. B. Replace the custom 2fa system with an app exchange app that supports on-premise applications and salesforce. C. Replace the custom 2fa system with salesforce 2fa for on-premise application and salesforce. D. Use custom login flows to connect to the existing custom 2fa system for use in salesforce.

Correct Answer: D

Salesforce Certified Platform Identity and Access Management Architect - Plat-Arch-203 Exam Questions