Salesforce Certified Platform Identity and Access Management Architect: Plat-Arch-203 Exam Premium File as PDF & Test Engine

A service provider (SP) supports both Security Assertion Markup Language (SAML) and OpenID Connect (OIDC).
When integrating this SP with Salesforce, which use case is the determining factor when choosing OIDC or SAML?

• A. They are equivalent protocols and there is no real reason to choose one over the other.
• B. OIDC is more secure than SAML and therefore is the obvious choice.
• C. The SP needs to perform API calls back to Salesforce on behalf of the user after the user logs in to the service provider.
• D. If the user has a session on Salesforce, you do not want them to be prompted for a username and password when they login to the SP.

Northern Trail Outfitters (NTO) has a requirement to ensure all user logins include a single multi-factor authentication (MFA) prompt. Currently, users are allowed the choice to login with a username and password or via single sign-on against NTO's corporate Identity Provider, which includes built-in MFA.
Which configuration will meet this requirement?

• A. For all employee profiles, set the Session Level Required at Login to High Assurance and add the corporate identity provider to the High Assurance list for the org's Session Security Levels.
• B. Enable "MFA for User Interface Logins" for your organization from Setup -> Identity Verification.
• C. Create and assign a permission set to all employees that includes "MFA for User Interface Logins."
• D. Create a custom login flow that enforces MFA and assign it to a permission set. Then assign the permission set to all employees.

A company wants to provide its employees with a custom mobile app that accesses Salesforce. Users are required to download the internal native IOS mobile app from corporate intranet on their mobile device. The app allows flexibility to access other Non Salesforce internal applications once users authenticate with Salesforce. The apps self-authorize, and users are permitted to use the apps once they have logged into Salesforce.
How should an identity architect meet the above requirements with the privately distributed mobile app?

• A. Create a new hybrid mobile app and use the connected app with OAuth to authenticate users for Salesforce and non-Salesforce internal apps.
• B. Use Salesforce as an identity provider (IdP) to access the mobile app and use the external IdP for other non-Salesforce internal apps.
• C. Configure Mobile App settings in connected app and Salesforce as identity provider for non-Salesforce internal apps.
• D. Use connected app with OAuth and Security Assertion Markup Language (SAML) to access other Non Salesforce internal apps.

A multinational industrial products manufacturer is planning to implement Salesforce CRM to manage their business. They have the following requirements:
1. They plan to implement Partner communities to provide access to their partner network .
2. They have operations in multiple countries and are planning to implement multiple Salesforce orgs.
3. Some of their partners do business in multiple countries and will need information from multiple Salesforce communities.
4. They would like to provide a single login for their partners.
How should an Identity Architect solution this requirement with limited custom development?

• A. Register partners in one org and access information from other orgs using APIs.
• B. Consolidate Partner related information in a single org and provide access through Salesforce community.
• C. Create a partner login for the country of their operation and use SAML federation to provide access to other orgs.
• D. Allow partners to choose the Salesforce org they need information from and use login flows to authenticate access.