Share Latest Jun-2026 Plat-Arch-203 DUMP with 246 Questions and Answers
PDF Dumps 2026 Exam Questions with Practice Test
NEW QUESTION # 54
Containers (UC) uses a legacy Employee portal for their employees to collaborate. Employees access the portal from their company's internal website via SSO. It is set up to work with SiteMinder and Active Directory. The Employee portal has features to support posing ideas. UC decides to use Salesforce Ideas for voting and better tracking purposes. To avoid provisioning users on Salesforce, UC decides to integrate Employee portal ideas with Salesforce idea through the API. What is the role of Salesforce in the context of SSO, based on this scenario?
- A. An independent system, because Salesforce is not part of the SSO setup.
- B. Service Provider, because Salesforce is the application for managing ideas.
- C. Identity Provider, because the API calls are authenticated by Salesforce.
- D. Connected App, because Salesforce is connected with Employee portal via API.
Answer: A
NEW QUESTION # 55
Which two are valid choices for digital certificates when setting up two-way SSL between Salesforce and an external system. Choose 2 answers
- A. Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system
- B. Use a trusted CA-signed certificate for salesforce and a self-signed cert for the external system
- C. Use a trusted CA-signed certificate for salesforce and a trusted CA-signed cert for the external system
- D. Use a self-signed certificate for salesforce and a self-signed cert for the external system
Answer: A,D
NEW QUESTION # 56
A leading fitness tracker company is getting ready to launch a customer community. The company wants its customers to login to the community and connect their fitness device to their profile. Customers should be able to obtain exercise details and fitness recommendation in the community.
Which should be used to satisfy this requirement?
- A. OAuth Device Flow
- B. Single Sign-On Settings
- C. Named Credentials
- D. Login Flows
Answer: A
NEW QUESTION # 57
Universal Containers (UC) has implemented SAML-based Single Sign-On to provide seamless access to its Salesforce Orgs, financial system, and CPQ system. Below is the SSO implementation landscape.
What role combination is represented by the systems in this scenario''
- A. Salesforce Org1 and PingFederate are acting as Identity Providers.
- B. Salesforce Org1 and Salesforce Org2 are acting as Identity Providers.
- C. Financial System and CPQ System are the only Service Providers.
- D. Salesforce Org1 and Salesforce Org2 are the only Service Providers.
Answer: A
NEW QUESTION # 58
Universal Containers (UC) has implemented a multi-org architecture in their company. Many users have licences across multiple orgs, and they are complaining about remembering which org and credentials are tied to which business process. Which two recommendations should the Architect make to address the Complaints? Choose 2 answers
- A. Activate My Domain to Brand each org to the specific business use case.
- B. Implement Delegated Authentication from each org to the LDAP provider.
- C. Implement IdP-Initiated Single Sign-on flows to allow deep linking.
- D. Implement SP-Initiated Single Sign-on flows to allow deep linking.
Answer: A,D
NEW QUESTION # 59
Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers
- A. Set jp an external login page and call Salesforce APIs for user creation.
- B. Customize me self-registration Apex handler to create only the user record.
- C. Enable "Allow customers and partners to self-register".
- D. Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.
- E. Select the "Configurable Self-Reg Page" option under Login & Registration.
Answer: B,C,E
NEW QUESTION # 60
A group of users try to access one of universal containers connected apps and receive the following error message : "Failed : Not approved for access". what is most likely to cause of the issue?
- A. The salesforce administrators gave revoked the Oauth authorization.
- B. The users do not have the correct permission set assigned to them.
- C. The use of high assurance sections are required for the connected App.
- D. The connected App setting "All users may self-authorize" is enabled.
Answer: B
NEW QUESTION # 61
An identity architect has built a native mobile application and plans to integrate it with a Salesforce Identity solution. The following are the requirements for the solution:
1. Users should not have to login every time they use the app.
2. The app should be able to make calls to the Salesforce REST API.
3. End users should NOT see the OAuth approval page.
How should the identity architect configure the Salesforce connected app to meet the requirements?
- A. Enable the Full Access Scope and then set the connected app access settings to "Admin Pre-Approved".
- B. Enable the API Scope and Offline Access Scope on the connected app, and then set the connected app to access settings to 'Admin Pre-Approved".
- C. Enable the API Scope and Offline Access Scope, upload a certificate so JWT Bearer Flow can be used and then set the connected app access settings to "Admin Pre-Approved".
- D. Enable the API Scope and Offline Access Scope on the connected app, and then set the Connected App access settings to "User may self authorize".
Answer: C
NEW QUESTION # 62
Universal Containers (UC) has a strict requirement to authenticate users to Salesforce using their mainframe credentials. The mainframe user store cannot be accessed from a SAML provider. UC would also like to have users in Salesforce created on the fly if they provide accurate mainframe credentials.
How can the Architect meet these requirements?
- A. Implement Just-In-Time Provisioning on the mainframe to create the user on the fly.
- B. Use the SOAP API to create the user when created on the mainframe; implement Delegated Authentication.
- C. Use a Salesforce Login Flow to call out to a web service and create the user on the fly.
- D. Implement OAuth User-Agent Flow on the mainframe; use a Registration Handler to create the user on the fly.
Answer: A
NEW QUESTION # 63
An Enterprise is using a Lightweight Directory Access Protocol (LDAP ) server as the only point for user authentication with a username/password. Salesforce delegated authentication is configured to integrate Salesforce under single sign-on (SSO).
Mow can end users change their password?
- A. Users can click on the "Forgot your Password" link on the Salesforce.com login page.
- B. Users can request the Salesforce Admin to reset their password.
- C. Users once logged In, can go to the Change Password screen in Salesforce.
- D. Users can change it on the enterprise LDAP authentication portal.
Answer: B
NEW QUESTION # 64
Which two considerations should be made when implementing Delegated Authentication?
Choose 2 answers
- A. It requires trusted IP ranges at the User Profile level.
- B. Just-in-time Provisioning can be configured for new users.
- C. Salesforce servers receive but do not validate a user's credentials.
- D. The authentication web service can include custom attributes.
- E. It can be used to authenticate API clients and mobile apps.
Answer: B,E
NEW QUESTION # 65
Universal Containers (UC) is building an integration between Salesforce and a legacy web applications using the canvas framework. The security for UC has determined that a signed request from Salesforce is not an adequate authentication solution for the Third-Party app. Which two options should the Architect consider for authenticating the third-party app using the canvas framework? Choose 2 Answers
- A. Utilize Canvas OAuth flow to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
- B. Create a registration handler Apex class to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
- C. Utilize Authorization Providers to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
- D. Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC's IdP.
Answer: A,D
NEW QUESTION # 66
Universal Containers (UC) wants to implement SAML SSO for their internal of Salesforce users using a third-party IdP. After some evaluation, UC decides NOT to set up My Domain for their Salesforce org. How does that decision impact their SSO implementation?
- A. Neither SP- nor IdP-initiated SSO will work.
- B. SP-initiated SSO will NOT work
- C. IdP-initiated SSO will NOT work.
- D. Either SP- or IdP-initiated SSO will work.
Answer: A
NEW QUESTION # 67
Universal Containers is creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow (this flow uses the OAuth 2.0 implicit grant type).
Which three OAuth concepts apply to this flow?
Choose 3 answers
- A. Scopes
- B. Verification Code
- C. Client ID
- D. Refresh Token
- E. Authorization Code
Answer: A,C,D
NEW QUESTION # 68
Northern Trail Outfitters (NTO) has an off-boarding process where a terminated employee is first disabled in the Lightweight Directory Act Protocol (LDAP) directory, then requests are sent to the various application support teams to finish user deactivations. A terminated employee recently was able to login to NTO's Salesforce instance 24 hours after termination, even though the user was disabled in the corporate LDAP directory.
What should an identity architect recommend to prevent this from happening in the future?
- A. Setup an identity provider (IdP) to authenticate users using LDAP, set up single sign-on to Salesforce and disable Login Form authentication.
- B. Configure an authentication provider to delegate authentication to the LDAP directory.
- C. use a login flow to make a callout to the LDAP directory before authenticating the user to Salesforce.
- D. Create a Just-in-Time provisioning registration handler to ensure users are deactivated in Salesforce as they are disabled in LDAP.
Answer: B
NEW QUESTION # 69
Northern Trail Outfitters (NTO) recently purchased Salesforce Identity Connect to streamline user provisioning across Microsoft Active Directory (AD) and Salesforce Sales Cloud.
NTO has asked an identity architect to identify which salesforce security configurations can map to AD permissions.
Which three Salesforce permissions are available to map to AD permissions?
Choose 3 answers
- A. Field-Level Security
- B. Roles
- C. Public Groups
- D. Profiles and Permission Sets
- E. Sharing Rules
Answer: B,C,D
NEW QUESTION # 70
Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process. Which two considerations should an architect point out to UC? Choose 2 answers
- A. The flow will not provide an Oauth refresh token back to the server.
- B. The web application should be hosted on a secure server.
- C. The web server must be able to protect consumer privacy
- D. The flow involves passing the user credentials back and forth.
Answer: B,C
NEW QUESTION # 71
Universal Containers (UC) has an existing Salesforce org configured for SP-Initiated SAML SSO with their Idp. A second Salesforce org is being introduced into the environment and the IT team would like to ensure they can use the same Idp for new org. What action should the IT team take while implementing the second org?
- A. Use the same SAML Identity location as the first org.
- B. Use the same request bindings as the first org.
- C. Use the Salesforce Username as the SAML Identity Type.
- D. Use a different Entity ID than the first org.
Answer: D
NEW QUESTION # 72
An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:
1 - Change of a user status in the central IAM Service triggers provisioning or deprovisioining in the integrated cloud applications.
2 - Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).
Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?
- A. Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning and deprovisioning of users.
- B. A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-Domain Identity Management) for provisioning and deprovisioning of users.
- C. Configure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.
- D. Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.
Answer: B
NEW QUESTION # 73
An architect needs to advise the team that manages the identity provider how to differentiate salesforce from other service providers. What SAML SSO setting in salesforce provides this capability?
- A. Issuer
- B. SAML identity location
- C. Identity provider login URL
- D. Entity id
Answer: D
NEW QUESTION # 74
A global company has built an external application that uses data from its Salesforce org via an OAuth 2.0 authorization flow. Upon logout, the existing Salesforce OAuth token must be invalidated.
Which action will accomplish this?
- A. Use a HTTP POST to request the refresh token for the current user.
- B. Use a HTTP POST to make a call to the revoke token endpoint.
- C. Use a HTTP POST to the System for Cross-domain Identity Management (SCIM) endpoint, including the current OAuth token.
- D. Enable Single Logout with a secure logout URL.
Answer: B
NEW QUESTION # 75
Universal Containers (UC) uses Salesforce for its customer service agents. UC has a proprietary system for order tracking which supports Security Assertion Markup Language (SAML) based single sign-on. The VP of customer service wants to ensure only active Salesforce users should be able to access the order tracking system which is only visible within Salesforce.
What should be done to fulfill the requirement?
Choose 2 answers
- A. Customize Order Tracking to initiate a REST call to validate users in Salesforce after login.
- B. Setup Order Tracking as a Canvas app in Salesforce to POST IdP initiated SAML assertion.
- C. Setup Salesforce as an identity provider (IdP) for order Tracking.
- D. Set up the Corporate Identity store as an identity provider (IdP) for Order Tracking,
Answer: C,D
NEW QUESTION # 76
Northern Trail Outfitters (NTO) is planning to build a new customer service portal and wants to use passwordless login, allowing customers to login with a one-time passcode sent to them via email or SMS.
How should the quantity of required Identity Verification Credits be estimated?
- A. Identity Verification Credits are consumed with each SMS (text message) sent and should be estimated based on the number of login verification challenges for SMS verification users.
- B. Each community comes with 10,000 Identity Verification Credits per month and only customers with more than 10,000 logins a month should estimate additional SMS verifications needed.
- C. Identity Verification Credits are a direct add-on license based on the number of existing member-based or login-based Community licenses.
- D. Identity Verification Credits are consumed with each verification sent and should be estimated based on the number of logins
Answer: A
NEW QUESTION # 77
What are three capabilities of Delegated Authentication? Choose 3 answers
- A. It can be assigned by Permission Sets.
- B. It can be assigned by Custom Permissions.
- C. It can be assigned by Profiles.
- D. It can connect to SOAP services.
- E. It can connect to REST services.
Answer: A,D,E
NEW QUESTION # 78
Universal Containers is budding a web application that will connect with the Salesforce API using JWT OAuth Flow.
Which two settings need to be configured in the connect app to support this requirement?
Choose 2 answers
- A. The "api" OAuth scope in the connected app.
- B. The "edair_api" OAuth scope m the connected app.
- C. The Use Digital Signature option in the connected app.
- D. The "web" OAuth scope in the connected app,
Answer: A,C
NEW QUESTION # 79
......
Dumps for Free Plat-Arch-203 Practice Exam Questions: https://www.latestcram.com/Plat-Arch-203-exam-cram-questions.html
