Salesforce Certified Platform Identity and Access Management Architect

Question 1

The security team at Universal containers(UC) has identified exporting reports as a high-risk action and would like to require users to be logged into salesforce with their active directory (AD) credentials when doing so. For all other uses of Salesforce, Users should be allowed to use AD credentials or salesforce credentials. What solution should be recommended to prevent exporting reports except when logged in using AD credentials while maintaining the ability to view reports when logged in with salesforce credentials?

A. Use SAML Federated Authentication with a login flow to dynamically add or remove a permission set that grants the export reports permission.

B. Use SAML Federated Authentication and Custom SAML jit provisioning to dynamically add or remove a permission set that grants the Export Reports permission.

C. Use SAML Federated Authentication and block access to reports when accesses through a standard assurance session.

D. Use SAML Federated Authentication, treat SAML sessions as high assurance, and raise the session level required for exporting reports.

Correct Answer: C

Question 2

Northern Trail Outfitters manages application functional permissions centrally as Active Directory groups. The CRM_Superllser and CRM_Reportmg_SuperUser groups should respectively give the user the SuperUser and Reportmg_SuperUser permission set in Salesforce. Salesforce is the service provider to a Security Assertion Markup Language (SAML) identity provider.
Mow should an identity architect ensure the Active Directory groups are reflected correctly when a user accesses Salesforce?

A. Use the Apex Just-in-Time handler to query custom SAML attributes and set permission sets.

B. Use the Apex Just-in-Time handler to query standard SAML attributes and set permission sets.

C. Use a login flow to query custom SAML attributes and set permission sets.

D. Use a login flow to query standard SAML attributes and set permission sets.

Correct Answer: A

Question 3

Under which scenario Web Server flow will be used?

A. Used for server-side components when page needs to be rendered.

B. Used for web applications when server-side code needs to interact with APIS.

C. Used for verifying Access protected resources.

D. Used for mobile applications and testing legacy Integrations.

Correct Answer: B

Question 4

Universal Containers (UC) has an existing web application that it would like to access from Salesforce without requiring users to re-authenticate. The web application is owned UC and the UC team that is responsible for it is willing to add new javascript code and/or libraries to the application. What implementation should an Architect recommend to UC?

A. Configure the web application as an item in the Salesforce App Launcher.

B. Add the web application as a ConnectedApp using OAuth User-Agent flow.

C. Rewrite the web application as a set of Visualforce pages and Apex code.

D. Create a Canvas app and use Signed Requests to authenticate the users.

Correct Answer: D

Question 5

Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?Universal Containers (UC) has a mobile application for its employees that uses data from Salesforce as well as uses Salesforce for Authentication purposes. UC wants its mobile users to only enter their credentials the first time they run the app. The application has been live for a little over 6 months, and all of the users who were part of the initial launch are complaining that they have to re-authenticate. UC has also recently changed the URI Scheme associated with the mobile app. What should the Architect at UC first investigate?

A. Confirm that the access Token's Time-To-Live policy has been set appropriately.

B. Validate that the users are checking the box to remember their passwords.

C. Verify that the Callback URL is correctly pointing to the new URI Scheme.

D. Check the Refresh Token policy defined in the Salesforce Connected App.

Correct Answer: D

Question 6

The executive sponsor for an organization has asked if Salesforce supports the ability to embed a login widget into its service providers in order to create a more seamless user experience.
What should be used and considered before recommending it as a solution on the Salesforce Platform?

A. Salesforce REST apis. Ensure that Secure Sockets Layer (SSL) connection for the integration is used.

B. OpenID Connect Web Server Flow. Determine if the service provider is secure enough to store the client secret on.

C. Embedded Login. Consider whether or not it relies on third party cookies which can cause browser compatibility issues.

D. Embedded Login. Identify what level of UI customization will be required to make it match the service providers look and feel.

Correct Answer: C

Question 7

A group of users try to access one of universal containers connected apps and receive the following error message : "Failed : Not approved for access". what is most likely to cause of the issue?

A. The salesforce administrators gave revoked the Oauth authorization.

B. The connected App setting "All users may self-authorize" is enabled.

C. The users do not have the correct permission set assigned to them.

D. The use of high assurance sections are required for the connected App.

Correct Answer: C

Question 8

Universal Containers is considering using Delegated Authentication as the sole means of Authenticating of Salesforce users. A Salesforce Architect has been brought in to assist with the implementation. What two risks Should the Architect point out? Choose 2 answers

A. The web service must reside on a public cloud service, such as Heroku.

B. UC will be required to develop and support a custom SOAP web service.

C. Salesforce users will be locked out of Salesforce if the web service goes down.

D. Delegated Authentication is enabled or disabled for the entire Salesforce org.

Correct Answer: B,C

Question 9

In an SP-Initiated SAML SSO setup where the user tries to access a resource on the Service Provider, What HTTP param should be used when submitting a SAML Request to the Idp to ensure the user is returned to the intended resourse after authentication?

A. DisplayState

B. RelayState

C. StartURL

D. RedirectURL

Correct Answer: B

Question 10

A company's external application is protected by Salesforce through OAuth. The identity architect for the project needs to limit the level of access to the data of the protected resource in a flexible way.
What should be done to improve security?

A. Leverage external objects and data classification policies.

B. Define a permission set that grants access to the app and assign to authorized users.

C. Create custom scopes and assign to the connected app.

D. Select "Admin approved users are pre-authorized" and assign specific profiles.

Correct Answer: C

Salesforce Certified Platform Identity and Access Management Architect - Plat-Arch-203 Exam Practice Test

Latest Update

Useful Links

Contact Us