Latest Verified & Correct Salesforce Plat-Arch-203 Questions & Answers Daily Updated [Q67-Q81]

Rate this post

Latest Verified & Correct Salesforce Plat-Arch-203 Questions & Answers Daily Updated

100% Pass Guaranteed Download Identity and Access Management Designer Exam PDF Q&A

QUESTION 67
A global fitness equipment manufacturer uses Salesforce to manage its sales cycle. The manufacturer has a custom order fulfillment app that needs to request order data from Salesforce. The order fulfillment app needs to integrate with the Salesforce API using OAuth 2.0 protocol.
What should an identity architect use to fulfill this requirement?

Canvas App Integration

OAuth Tokens

Authentication Providers

Connected App and OAuth scopes

QUESTION 68
Universal Containers (UC) would like its community users to be able to register and log in with Linkedin or Facebook Credentials. UC wants users to clearly see Facebook &Linkedin Icons when they register and login. What are the two recommended actions UC can take to achieve this Functionality? Choose 2 answers

Enable Facebook and Linkedin as Login options in the login section of the Community configuration.

Create custom Registration Handlers to link Linkedin and facebook accounts to user records.

Store the Linkedin or Facebook user IDs in the Federation ID field on the Salesforce User record.

Create custom buttons for Facebook and inkedin using JAVAscript/CSS on a custom Visualforce page.

QUESTION 69
Universal Containers allows employees to use a mobile device to access Salesforce for daily operations using a hybrid mobile app. This app uses Mobile software development kits (SDK), leverages refresh token to regenerate access token when required and is distributed as a private app.
The chief security officer is rolling out an org wide compliance policy to enforce re-venfication of devices if an employee has not logged in from that device in the last week.
Which connected app setting should be leveraged to comply with this policy change?

Scope – Deny refresh_token scope for this connected app.

Refresh Token Policy – Expire the refresh token if it has not been used for 7 days.

Session Policy – Set timeout value of the connected app to 7 days.

Permitted User – Ask admins to maintain a list of users who are permitted based on last login date.

QUESTION 70
Northern Trail Outfitters (NTO) uses the Customer 360 Platform implemented on Salesforce Experience Cloud. The development team in charge has learned of a contactless user feature, which can reduce the overhead of managing customers and partners by creating users without contact information.
What is the potential impact to the architecture if NTO decides to implement this feature?

Custom registration handler is needed to correctly assign External Identity or Community license for the newly registered contactless user.

If contactless user is upgraded to Community license, the contact record is automatically created and linked to the user record, but not associated with an Account.

Contactless user feature is available only with the External Identity license, which can restrict the Experience Cloud functionality available to the user.

Passwordless authentication can not be supported because the mobile phone receiving one-time password (OTP) needs to match the number on the contact record.

QUESTION 71
Universal containers (UC) has implemented ansp-Initiated SAML flow between an external IDP and salesforce. A user at UC is attempting to login to salesforce1 for the first time and is being prompted for salesforce credentials instead of being shown the IDP login page. What is the likely cause of the issue?

The “Redirect to Identity Provider” option has been selected in the my domain configuration.

The user has not configured the salesforce1 mobile app to use my domain for login

The “Redirect to identity provider” option has not been selected the SAML configuration.

The user has not been granted the “Enable single Sign-on” permission

QUESTION 72
An organization has a central cloud-based Identity and Access Management (IAM) Service for authentication and user management, which must be utilized by all applications as follows:
1 – Change of a user status in the central IAM Service triggers provisioning or deprovisioining in the integrated cloud applications.
2 – Security Assertion Markup Language single sign-on (SSO) is used to facilitate access for users authenticated at identity provider (Central IAM Service).
Which approach should an IAM architect implement on Salesforce Sales Cloud to meet the requirements?

A Configure Salesforce as a SAML Service Provider, and enable SCIM (System for Cross-Domain Identity Management) for provisioning and deprovisioning of users.

Configure Salesforce as a SAML service provider, and enable Just-in Time (JIT) provisioning and deprovisioning of users.

Configure central IAM Service as an authentication provider and extend registration handler to manage provisioning and deprovisioning of users.

Deploy Identity Connect component and set up automated provisioning and deprovisioning of users, as well as SAML-based SSO.

QUESTION 73
Universal Containers (UC) is implementing Salesforce and would like to establish SAML SSO for its users to log in. UC stores its corporate user identities in a Custom Database. The UC IT Manager has heard good things about Salesforce Identity Connect as an Idp, and would like to understand what limitations they may face if they decided to use Identity Connect in their current environment. What limitation Should an Architect inform the IT Manager about?

Identity Connect will not support user provisioning in UC’s current environment.

Identity Connect will only support Idp-initiated SAML flows in UC’s current environment.

Identity Connect will only support SP-initiated SAML flows in UC’s current environment.

Identity connect is not compatible with UC’s current identity environment.

QUESTION 74
Universal containers wants to implement SAML SSO for their internal salesforce users using a third-party IDP. After some evaluation, UC decides not to set up my domain for their salesforce.org. How does that decision impact their SSO implementation?

Neithersp – nor IDP – initiated SSO will work

Either sp – or IDP – initiated SSO will work

IDP – initiated SSO will not work

Sp-Initiated SSO will not work

QUESTION 75
The CIO of universal containers(UC) wants to start taking advantage of the refresh token capability for the UC applications that utilize Oauth 2.0. UC has listed an architect to analyze all of the applications that use Oauth flows to. See where refresh Tokens can be applied. Which two OAuth flows should the architect consider in their evaluation? Choose 2 answers

Web server

Jwt bearer token

User-Agent

Username-password

QUESTION 76
Universal Containers is implementing a new Experience Cloud site and the identity architect wants to use dynamic branding features as of the login process.
Which two options should the identity architect recommend to support dynamic branding for the site?
Choose 2 answers

To use dynamic branding, the community must be built with the Visuaiforce + Salesforce Tabs template.

To use dynamic branding, the community must be built with the Customer Account Portal template.

An experience ID (expid) or placeholder parameter must be used in the URL to represent the brand.

An external content management system (CMS) must be used for dynamic branding on Experience Cloud sites.

QUESTION 77
Universal Containers (UC) uses Global Shipping (GS) as one of their shipping vendors. Regional leads of GS need access to UC’s Salesforce instance for reporting damage of goods using Cases. The regional leads also need access to dashboards to keep track of regional shipping KPIs. UC internally uses a third-party cloud analytics tool for capacity planning and UC decided to provide access to this tool to a subset of GS employees. In addition to regional leads, the GS capacity planning team would benefit from access to this tool. To access the analytics tool, UC IT has set up Salesforce as the Identity provider for Internal users and would like to follow the same approach for the GS users as well. What are the most appropriate license types for GS Tregional Leads and the GS Capacity Planners? Choose 2 Answers

Customer Community Plus license for GS Regional Leads and External Identity for GS Capacity Planners.

Customer Community Plus license for GS Regional Leads and Customer Community license for GS Capacity Planners.

Identity Licence for GS Regional Leads and External Identity license for GS capacity Planners.

Customer Community license for GS Regional Leads and Identity license for GS Capacity Planners.

QUESTION 78
An Architect has configured a SAML-based SSO integration between Salesforce and an external Identity provider and is ready to test it. When the Architect attempts to log in to Salesforce using SSO, the Architect receives a SAML error. Which two optimal actions should the Architect take to troubleshoot the issue?

Ensure the Callback URL is correctly set in the Connected Apps settings.

Use a browser that has an add-on/extension that can inspect SAML.

Paste the SAML Assertion Validator in Salesforce.

Use the browser’s Development tools to view the Salesforce page’s markup.

QUESTION 79
Northern Trail Outfitters would like to automatically create new employee users in Salesforce with an appropriate profile that maps to its Active Directory Department.
How should an identity architect implement this requirement?

Use the createUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Use the updateUser method in the Just-in-Time (JIT) provisioning registration handler to assign the appropriate profile.

Use a login flow to collect Security Assertion Markup Language attributes and assign the appropriate profile during Just-In-Time

Make a callout during the login flow to query department from Active Directory to assign the appropriate profile.

QUESTION 80
Universal containers (UC) has a mobile application that calls the salesforce REST API. In order to prevent users from having to enter their credentials everytime they use the app, UC has enabled the use of refresh Tokens as part of the salesforce connected App and updated their mobile app to take advantage of the refresh token. Even after enabling the refresh token, Users are still complaining that they have to enter their credentials once a day. What is the most likely cause of the issue?

The Oauth authorizations are being revoked by a nightly batch job.

The refresh token expiration policy is set incorrectly in salesforce

The app is requesting too many access Tokens in a 24-hour period

The users forget to check the box to remember their credentials.

QUESTION 81
A group of users try to access one of Universal Containers’ Connected Apps and receive the following error message: ” Failed: Not approved for access.” What is the most likely cause of this issue?

The Connected App settings “All users may self-authorize” is enabled.

The Salesforce Administrators have revoked the OAuth authorization.

The Users do not have the correct permission set assigned to them.

The User of High Assurance sessions are required for the Connected App.