Real Plat-Arch-203 dumps Accurate Questions and Answers with Free and Fast Updates [Q97-Q116]

admin Plat-Arch-203 Salesforce August 5, 2026

4/5 - (1 vote)

Real Plat-Arch-203 dumps Accurate Questions and Answers with Free and Fast Updates

Real Plat-Arch-203 Quesions Pass Certification Exams Easily

Salesforce Plat-Arch-203 Exam Syllabus Topics:

Section	Objectives
Experience Cloud and External Identity	– External user authentication and authorization – Community login and identity providers – B2B and B2C identity considerations
Authentication and Single Sign-On (SSO)	– SAML 2.0 implementation in Salesforce – OpenID Connect and OAuth 2.0 flows – SSO troubleshooting and configuration
Identity and Access Management Fundamentals	– Identity lifecycle management concepts – Authentication vs authorization principles – Enterprise identity architecture basics
Access Management and Security Controls	– Session management and security policies – Multi-factor authentication (MFA) enforcement – Profiles, permission sets, and role hierarchy
Salesforce Identity Services	– Connected Apps and OAuth policies – My Domain and identity configuration – Identity Connect and external identity providers
API and Integration Security	– OAuth scopes and API authentication flows – Token management and refresh mechanisms – Secure integration patterns

Q97. Universal Containers (UC) uses Active Directory (AD) as their identity store for employees and must continue to do so for network access. UC is undergoing a major transformation program and moving all of their enterprise applications to cloud platforms including Salesforct, Workday, and SAP HANA. UC needs to implement an SSO solution for accessing all of the third-party cloud applications and the CIO is inclined to use Salesforce for all of their identity and access management needs.

Company Community and Identity licenses

Identity and Identity Connect licenses

Chatter Only and Identity licenses

Salesforce and Identity Connect licenses

Q98. Universal containers (UC) is setting up Delegated Authentication to allow employees to log in using their corporate credentials. UC’s security team is concerned about the risk of exposing the corporate login service on the Internet and has asked that a reliable trust mechanism be put in place between the login service and salesforce. What mechanism should an architect put in place to enable a trusted connection between the login services and salesforce?

Include client ID and client secret in the login header callout.

Set up a proxy server for the login service in the DMZ.

Require the use of Salesforce security Tokens on password.

Enforce mutual Authentication between systems using SSL.

Q99. An architect has successfully configured SAML-BASED SSO for universal containers. SSO has been working for 3 months when Universal containers manually adds a batch of new users to salesforce. The new users receive an error from salesforce when trying to use SSO. Existing users are still able to successfully use SSO to access salesforce. What is the probable cause of this behaviour?

The administrator forgot to reset the new user’s salesforce password.

The Federation ID field on the new user records is not correctly set

The my domain capability is not enabled on the new user’s profile.

The new users do not have the SSO permission enabled on their profiles.

Q100. Universal containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers

Disallow the use of single Sign-on for any users of the mobile app.

Require high assurance sessions in order to use the connected App

Use Google Authenticator as an additional part of the logical processes.

Set login IP ranges to the internal network for all of the app users profiles.

Q101. A real estate company wants to provide its customers a digital space to design their interior decoration options. To simplify the registration to gain access to the community site (built in Experience Cloud), the CTO has requested that the IT/Development team provide the option for customers to use their existing social-media credentials to register and access.
The IT lead has approached the Salesforce Identity and Access Management (IAM) architect for technical direction on implementing the social sign-on (for Facebook, Twitter, and a new provider that supports standard OpenID Connect (OIDC)).
Which two recommendations should the Salesforce IAM architect make to the IT Lead?
Choose 2 answers

Use declarative registration handler process builder/flow to create, update users and contacts.

Authentication provider configuration is required each social sign-on providers; and enable Authentication providers in

For supporting OIDC it is necessary to enable Security Assertion Markup Language (SAML) with Just-in-Time provisioning (JIT) and OAuth 2.0.

Apex coding skills are needed for registration handler to create and update users.

Q102. Universal Containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in Salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers

Disallow the use of Single Sign-on for any users of the mobile app.

Require High Assurance sessions in order to use the Connected App.

Set Login IP Ranges to the internal network for all of the app users Profiles.

Use Google Authenticator as an additional part of the login process

Q103. customer service representatives at Universal containers (UC) are complaining that whenever they click on links to case records and are asked to login with SAML SSO, they are being redirected to the salesforce home tab and not the specific case record. What item should an architect advise the identity team at UC to investigate first?

My domain is configured and active within salesforce.

The salesforce SSO settings are using http post

The identity provider is correctly preserving the Relay state

The users have the correct Federation ID within salesforce.

Q104. Universal Containers want users to be able to log in to the Salesforce mobile app with their Active Directory password. Employees are unable to use mobile VPN.
Which two options should an identity architect recommend to meet the requirement?
Choose 2 answers

Active Directory Password Sync Plugin

Configure Cloud Provider Load Balancer

Salesforce Trigger & Field on Contact Object

Salesforce Identity Connect

Q105. Universal Containers wants to secure its Salesforce APIs by using an existing Security Assertion Markup Language (SAML) configuration supports the company’s single sign-on process to Salesforce, Which Salesforce OAuth authorization flow should be used?

OAuth 2.0 SAML Bearer Assertion Flow

A SAML Assertion Row

OAuth 2.0 User-Agent Flow

OAuth 2.0 JWT Bearer Flow

Q106. A global company has built an external application that uses data from its Salesforce org via an OAuth 2.0 authorization flow. Upon logout, the existing Salesforce OAuth token must be invalidated.
Which action will accomplish this?

Use a HTTP POST to request the refresh token for the current user.

Use a HTTP POST to the System for Cross-domain Identity Management (SCIM) endpoint, including the current OAuth token.

Use a HTTP POST to make a call to the revoke token endpoint.

Enable Single Logout with a secure logout URL.

Q107. Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.
What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.

Build an integration that queries LDAP periodically and creates new active users in Salesforce.

Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at first login.

Q108. Universal containers wants to set up SSO for a selected group of users to access external applications from salesforce through App launcher. Which three steps must be completed in salesforce to accomplish the goal?

Associate user profiles with the connected Apps.

Complete my domain and Identity provider setup.

Create connected apps for the external applications.

Complete single Sign-on settings in security controls.

Create named credentials for each external system.

Q109. Which tool should be used to track login data, such as the average number of logins, who logged in more than the average number of times and who logged in during non-business hours?

Q110. Containers (UC) has implemented SAML-based single Sign-on for their Salesforce application and is planning to provide access to Salesforce on mobile devices using the Salesforce1 mobile app. UC wants to ensure that Single Sign-on is used for accessing the Salesforce1 mobile App. Which two recommendations should the Architect make? Choose 2 Answers

Configure the Embedded Web Browser to use My Domain URL.

Configure the Salesforce1 App to use the MY Domain URL.

Use the existing SAML-SSO flow along with User Agent Flow.

Use the existing SAML SSO flow along with Web Server Flow.

Q111. Northern Trail Outfitters would like to use a portal built on Salesforce Experience Cloud for customer self-service. Guests of the portal be able to self-register, but be unable to automatically be assigned to a contact record until verified. External Identity licenses have bee purchased for the project.
After registered guests complete an onboarding process, a flow will create the appropriate account and contact records for the user.
Which three steps should an identity architect follow to implement the outlined requirements?
Choose 3 answers

Enable “Allow customers and partners to self-register”.

Select the “Configurable Self-Reg Page” option under Login & Registration.

Set jp an external login page and call Salesforce APIs for user creation.

Customize the self-registration Apex handler to temporarily associate the user to a shared single contact record.

Customize me self-registration Apex handler to create only the user record.

Q112. What is one of the roles of an Identity Provider in a Single Sign-on setup using SAML?

Validate token

Create token

Consume token

Revoke token

Q113. Universal containers wants to build a custom mobile app connecting to salesforce using Oauth, and would like to restrict the types of resources mobile users can access. What Oauth feature of Salesforce should be used to achieve the goal?

Access Tokens

Mobile pins

Refresh Tokens

Scopes

Q114. Universal Containers (UC) is looking to purchase a third-party application as an Identity Provider. UC is looking to develop a business case for the purchase in general and has enlisted an Architect for advice. Which two capabilities of an Identity Provider should the Architect detail to help strengthen the business case? Choose 2 answers

The Identity Provider can authenticate multiple applications.

The Identity Provider can authenticate multiple social media accounts.

The Identity provider can store credentials for multiple applications.

The Identity Provider can centralize enterprise password policy.

Q115. Universal Containers (UC) is building a customer community and will allow customers to authenticate using Facebook credentials. The First time the user authenticating using facebook, UC would like a customer account created automatically in their Accounting system. The accounting system has a web service accessible to Salesforce for the creation of accounts. How can the Architect meet these requirements?

Create a custom application on Heroku that manages the sign-on process from Facebook.

Use JIT Provisioning to automatically create the account in the accounting system.

Add an Apex callout in the registration handler of the authorization provider.

Use OAuth JWT flow to pass the data from Salesforce to the Accounting System.

Q116. Universal containers wants to implement single Sign-on for a salesforce org using an external identity provider and corporate identity store. What type of Authentication flow is required to support deep linking?

Web server Oauth SSO flow.

Identity-provider-initiated SSO

Service-provider-initiated SSO

Start URL on identity provider