Discuss Salesforce Salesforce Certified Platform Identity And Access Management Architect (Plat-Arch-203) Exam Topic 3 Question 79

Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.

What should an identity architect recommend to prevent this from happening in the future?

ACreate a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.

BConfigure an authentication provider to delegate authentication to the LDAP directory.

Cuse a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.

DSetup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.

Suggested Answer: B

Get Premium Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Sheron 2 months ago

Option D sounds solid too. SSO could streamline the process.

Eden 2 months ago

I prefer option C. Checking LDAP before login is smart.

Tequila 2 months ago

I think option A is the best. It ensures real-time deactivation.

Graciela 2 months ago

Not sure if any of these will really solve the problem long-term.

Marilynn 3 months ago

I disagree, option D seems too complicated for this issue.

Rodolfo 3 months ago

Wait, how did they even log in after being terminated?

Colette 3 months ago

I think option C is the best way to go!

Andree 3 months ago

Sounds like a classic case of sync issues between systems.

Asuncion 3 months ago

I feel like option C could work, but I wonder if it might slow down the login process too much.

Devora 4 months ago

I'm a bit confused about the difference between options B and D. Both seem to involve LDAP, but I can't recall which one is more effective for this scenario.

Antonio 4 months ago

I think option A sounds familiar; it might be similar to a practice question we did about user provisioning.

Vicky 4 months ago

I remember we discussed the importance of real-time deactivation in our last class, but I'm not sure which option would best achieve that.

Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Exam - Topic 3 Question 79 Discussion