Salesforce Plat-Arch-203 Certification Exam Sample Questions

Plat-Arch-203 Braindumps, Plat-Arch-203 Exam Dumps, Plat-Arch-203 Examcollection, Plat-Arch-203 Questions PDF, Plat-Arch-203 Sample Questions, Platform Identity and Access Management Architect Dumps, Platform Identity and Access Management Architect Official Cert Guide PDF, Platform Identity and Access Management Architect VCE, Salesforce Platform Identity and Access Management Architect PDFWe have prepared Salesforce Platform Identity and Access Management Architect (Plat-Arch-203) certification sample questions to make you aware of actual exam properties. This sample question set provides you with information about the Platform Identity and Access Management Architect exam pattern, question formate, a difficulty level of questions and time required to answer each question. To get familiar with Salesforce Certified Platform Identity and Access Management Architect exam, we suggest you try our Sample Salesforce Plat-Arch-203 Certification Practice Exam in simulated Salesforce certification exam environment.

To test your knowledge and understanding of concepts with real-time scenario based Salesforce Plat-Arch-203 questions, we strongly recommend you to prepare and practice with Premium Salesforce Platform Identity and Access Management Architect Certification Practice Exam. The premium Salesforce Platform Identity and Access Management Architect certification practice exam helps you identify topics in which you are well prepared and topics in which you may need further training to achieving great score in actual Salesforce Certified Platform Identity and Access Management Architect exam.

Salesforce Plat-Arch-203 Sample Questions:

01. A regional airline froze a cabin-crew supervisor's Salesforce user during an internal investigation. The investigation closed last week and the IdP team re-enabled her corporate account. She now authenticates at the IdP without error, but the SAML login to Salesforce still fails. Her Federation ID is unchanged, and other crew members log in normally through the same IdP.
What should the administrator do?
a) Ask the IdP team to send her Federation ID in a new attribute, as the old one expired
b) Reset her Salesforce password, since a frozen user needs a new password before any SSO login is accepted
c) Unfreeze her user in Salesforce, since a login at the IdP cannot override her status there
d) Replace the IdP signing certificate in the SSO setting, then run the SAML Assertion Validator again
 
02. A grocery chain gives its store staff Salesforce access for shift handover tasks. Store staff log in directly with Salesforce credentials and multi-factor authentication, using store devices and their own phones; logging in from a personal phone away from the store is permitted. Labor policy now requires that store staff cannot log in to Salesforce outside the chain's trading hours.
Which control meets the requirement?
a) Login hours on the store staff profile
b) A shorter session timeout on the store staff profile, so that sessions end at closing
c) Login IP ranges on the store staff profile, limited to the stores' networks
d) A high-assurance session requirement for store staff, enforced at every login
 
03. An automotive dealer network's Experience Cloud site has thousands of dealership staff who sign in with site usernames and passwords. The network now offers its own OpenID Connect identity platform and has configured it as an Auth. Provider. Existing staff must connect their new identity to their current site user so that their history is kept, and many of them registered on the site with personal email addresses that differ from those on the identity platform.
Which mechanism should the architect use to connect existing staff to their users?
a) A registration handler whose createUser matches on the email address in the claims
b) The Auth. Provider's existing-user linking URL, sent to each user
c) SAML just-in-time provisioning keyed on each user's Federation ID
d) Self-registration through the Auth. Provider, then a merge of each duplicate user
 
04. A pharmaceutical distributor is moving 4,000 warehouse and sales employees to Salesforce with SAML SSO from its corporate IdP. Every current employee must be able to log in on cutover day with their records and territories already assigned, and the IT team does not want a provisioning integration left running afterwards. New hires join every week and need only standard access on their first day.
Which two elements should the architect include in the provisioning design?
(Choose 2 answers)
a) Enable self-registration on the login page, so each new hire creates their own user on day one
b) Rely on just-in-time provisioning for the whole workforce, so every current employee is created at first login
c) Build a nightly SCIM feed from the HR system that creates, updates and deactivates every user
d) Enable SAML just-in-time provisioning, so each later joiner is created from the assertion at first login
e) Load the current workforce once before cutover, setting each user's Federation ID to the value the IdP sends
 
05. A cruise line has rolled out SAML single sign-on for its shore-based staff. Before it turns off the login form on its My Domain login page, the identity architect must identify which staff still sign in with their Salesforce username and password rather than through the identity provider.
Where should the architect look?
a) Setup Audit Trail, for password resets made for staff since the SSO rollout
b) Login History, grouped by login type for each user since the rollout
c) The user list, for staff whose Federation ID field is still blank
d) Identity Verification History, for users challenged at their latest login
 
06. A regional water utility runs an Experience Cloud site where account holders view bills and report leaks. When customers log out, they land back on the site's login page, and many then call the help desk believing something went wrong. The utility wants every customer who logs out to arrive on its public service-status page instead, whatever page they were on.
What should the identity architect recommend?
a) Pass the service-status page as the startURL parameter on every site login link
b) Add a login flow screen that redirects users to the service-status page on exit
c) Set the service-status page as the Start URL on the connected app the site uses
d) Set the site's logout page URL to the public service-status page
 
07. A hospitality group's loyalty members log in to its Experience Cloud site only a few times a year to redeem points. Most have forgotten their password by the next visit, and password resets now make up the largest share of contact-center calls. Every member already has a verified email address on file.
The group wants to remove passwords from the member experience, and it will not make members' sign-in depend on having a social media account.
What should the identity architect recommend?
a) Add Google and Facebook as Auth. Providers on the site's login page
b) Remove password expiry from the member profile's password policy
c) Offer passwordless login with a one-time code
d) Redesign the site's Forgot Password page so members reset faster
 
08. An engineering consultancy uses Salesforce as the identity provider for a project-billing app. The app identifies each user by employee number, and the consultancy stores that number in each Salesforce user's Federation ID. When users open the app from the App Launcher, the app accepts the signed assertion but reports that no matching user exists. A SAML tracer shows that the assertion's subject carries each user's Salesforce username.
What should the architect change?
a) Set the connected app's subject type to Federation ID so the assertion subject carries the employee number
b) Set the SAML identity type to Federation ID in the org's single sign-on settings for inbound assertions
c) Replace each user's Salesforce username with their employee number so that the current subject matches
d) Change the connected app's Name ID format so the app treats the subject as an unspecified identifier
 
09. A ski resort is extending its Experience Cloud site to two external groups. Several hundred thousand season-pass holders will log in only a few times each winter to download passes and update payment details. A few hundred contract ski instructors will log in throughout every working day to check lessons and record hours. Neither group needs role-based sharing or partner objects.
Which licensing approach should the identity architect recommend for the season-pass holders?
a) Member-based Customer Community licenses, as for the instructors
b) Login-based Customer Community licenses
c) Member-based Customer Community Plus licenses for every pass holder
d) Login-based Partner Community licenses for the pass holders
 
10. A law firm's lawyers who start from the IdP's application portal reach Salesforce through SSO without problems. Lawyers who open a bookmarked My Domain link are redirected to an error page on the IdP's web server instead of its sign-in page, and never return to Salesforce. The IdP's metadata, signing certificate and Issuer have not changed.
Which setting should the administrator check first?
a) The Assertion Consumer Service URL that the IdP has registered for the Salesforce org
b) The RelayState value the IdP uses to return lawyers to the record they bookmarked
c) The Identity Provider Login URL in the org's SAML single sign-on setting
d) The Entity ID that the IdP places in the Audience of each assertion it sends

Answers:

Question: 01
Answer: c		 Question: 02
Answer: a		 Question: 03
Answer: b		 Question: 04
Answer: d, e		 Question: 05
Answer: b
Question: 06
Answer: d		 Question: 07
Answer: c		 Question: 08
Answer: a		 Question: 09
Answer: b		 Question: 10
Answer: c

Note: Please update us by writing an email on feedback@vmexam.com for any error in Salesforce Certified Platform Identity and Access Management Architect certification exam sample questions

Rating: 5 / 5 (77 votes)