Trusted Salesforce Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Exam Dumps

Question No: 1

Universal containers(UC) has decided to build a new, highly sensitive application on Force.com platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/Password to authenticate to this application. How can an architect support fingerprints as a form of identification for salesforce Authentication?

AUse salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.

BUse Delegated Authentication with callouts to a third-party fingerprint scanning application.

CUse an appexchange product that does fingerprint scanning with native salesforce identity confirmation.

DUse custom login flows with callouts to a third-party fingerprint scanning application.

Show Answer

Question No: 2

MultipleChoice

Universal Containers (UC) has a strict requirement to authenticate users to Salesforce using their mainframe credentials. The mainframe user store cannot be accessed from a SAML provider. UC would also like to have users in Salesforce created on the fly if they provide accurate mainframe credentials.

How can the Architect meet these requirements?

Options

AUse a Salesforce Login Flow to call out to a web service and create the user on the fly.

BUse the SOAP API to create the user when created on the mainframe; implement Delegated Authentication.

CImplement Just-In-Time Provisioning on the mainframe to create the user on the fly.

DImplement OAuth User-Agent Flow on the mainframe; use a Registration Handler to create the user on the fly.

Question No: 3

MultipleChoice

Universal containers wants to implement single Sign-on for a salesforce org using an external identity provider and corporate identity store. What type of Authentication flow is required to support deep linking?

Options

AWeb server Oauth SSO flow.

BIdentity-provider-initiated SSO

CService-provider-initiated SSO

DStart URL on identity provider

Question No: 4

MultipleChoice

Universal Containers (UC) uses a home-grown Employee portal for their employees to collaborate. UC decides to use Salesforce Ideas to allow employees to post Ideas from the Employee portal. When users click on some of the links in the Employee portal, the users should be redirected to Salesforce, authenticated, and presented with the relevant pages. What OAuth flow is best suited for this scenario?

Options

AWeb Application flow

BSAML Bearer Assertion flow

CUser-Agent flow

DWeb Server flow

Question No: 5

MultipleChoice

Universal Containers (UC) has an e-commerce website where customers can buy products, make payments and manage their accounts. UC decides to build a Customer Community on Salesforce and wants to allow the customers to access the community from their accounts without logging in again. UC decides to implement an SP-initiated SSO using a SAML-compliant Idp. In this scenario where Salesforce is the Service Provider, which two activities must be performed in Salesforce to make SP-initiated SSO work? Choose 2 answers

Options

AConfigure SAML SSO settings.

BCreate a Connected App.

CConfigure Delegated Authentication.

DSet up My Domain.

Question No: 6

MultipleChoice

An architect has successfully configured SAML-BASED SSO for universal containers. SSO has been working for 3 months when Universal containers manually adds a batch of new users to salesforce. The new users receive an error from salesforce when trying to use SSO. Existing users are still able to successfully use SSO to access salesforce. What is the probable cause of this behaviour?

Options

AThe administrator forgot to reset the new user's salesforce password.

BThe Federation ID field on the new user records is not correctly set

CThe my domain capability is not enabled on the new user's profile.

DThe new users do not have the SSO permission enabled on their profiles.

Question No: 7

MultipleChoice

Northern Trail Outfitters (NTO) wants to give customers the ability to submit and manage issues with their purchases. It is important for to give its customers the ability to login with their Facebook and Twitter credentials.

Which two actions should an identity architect recommend to meet these requirements?

Select 2 answers

Options

ACreate a custom external authentication provider for Facebook.

BConfigure a predefined authentication provider for Facebook.

CCreate a custom external authentication provider for Twitter.

DConfigure a predefined authentication provider for Twitter.

Question No: 8

MultipleChoice

Universal containers wants to implement single Sign-on for a salesforce org using an external identity provider and corporate identity store. What type of Authentication flow is required to support deep linking?

Options

AWeb server Oauth SSO flow.

BIdentity-provider-initiated SSO

CService-provider-initiated SSO

DStart URL on identity provider

Question No: 9

MultipleChoice

Refer to the exhibit.

An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:

1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioining in the integrated cloud applications.

2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).

Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

Options

AA Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-Domain Identity Management) for provisioning and deprovisioning of users.

BConfigure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning and deprovisioning of users.

CConfigure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.

DDeploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.

Question No: 10

MultipleChoice

Refer to the exhibit.

A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.

The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.

What should an Identity architect do to meet this requirement?

Options

AUse open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

BConfigure the company firewall to allow traffic from Salesforce IP ranges.

CGenerate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

DUpload a third-party certificate from Salesforce into the on-premise server.

Question No: 11

MultipleChoice

Refer to the exhibit.

A multinational company is looking to rollout Salesforce globally. The company has a Microsoft Active Directory Federation Services (ADFS) implementation for the Americas, Europe and APAC. The company plans to have a single org and they would like to have all of its users access Salesforce using the ADFS . The company would like to limit its investments and prefer not to procure additional applications to satisfy the requirements.

What is recommended to ensure these requirements are met ?

Options

AUse connected apps for each ADFS implementation and implement Salesforce site to authenticate users across the ADFS system applicable to their geo.

BImplement Identity Connect to provide single sign-on to Salesforce and federated across multiple ADFS systems.

CAdd a central identity system that federates between the ADFS systems and integrate with Salesforce for single sign-on.

DConfigure Each ADFS system under single sign-on settings and allow users to choose the system to authenticate during sign on to Salesforce-

Free Salesforce Certified Platform Identity and Access Management Architect (Plat-Arch-203) Exam Dumps October 2026