Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Exam - Topic 3 Question 79 Discussion

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.What should an identity architect recommend to prevent this from happening in the future?
B) Configure an authentication provider to delegate authentication to the LDAP directory.
A) Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.
C) use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.
D) Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Exam - Topic 3 Question 79 Discussion

Actual exam question for Salesforce's Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) exam
Question #: 79
Topic #: 3
[All Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Questions]

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.

What should an identity architect recommend to prevent this from happening in the future?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Sheron at Jun 16, 2026, 04:52 AM

Limited Time Offer

25%

Off

Get Premium Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Andree
4 days ago
Sounds like a classic case of sync issues between systems.
upvoted 0 times
...
Asuncion
9 days ago
I feel like option C could work, but I wonder if it might slow down the login process too much.
upvoted 0 times
...
Devora
14 days ago
I'm a bit confused about the difference between options B and D. Both seem to involve LDAP, but I can't recall which one is more effective for this scenario.
upvoted 0 times
...
Antonio
19 days ago
I think option A sounds familiar; it might be similar to a practice question we did about user provisioning.
upvoted 0 times
...
Vicky
24 days ago
I remember we discussed the importance of real-time deactivation in our last class, but I'm not sure which option would best achieve that.
upvoted 0 times
...

Save Cancel