Salesforce Plat-Arch-203 Actual Free Exam Questions & Community Discussion

Exam Code/Number: Plat-Arch-203
Exam Name/Title: Salesforce Certified Platform Identity and Access Management Architect
Certification Provider: Salesforce
Corresponding Certification: Identity and Access Management Designer

Exam Questions: 246
Updated On: Jul 13, 2026

Question #45

Universal Containers (UC) is planning to add Wi-Fi enabled GPS tracking devices to its shipping containers so that the GPS coordinates data can be sent from the tracking device to its Salesforce production org via a custom API. The GPS devices have no direct user input or output capabilities.
Which OAuth flow should the identity architect recommend to meet the requirement?

A. OAuth 2.0 Web Server Flow for Web App Integration

B. OAuth 2.0 Asset Token Flow for Securing Connected Devices

C. OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration

D. OAuth 2.0 Username-Password Flow for Special Scenarios

Discussion 0

Correct Answer: B Vote an answer

Question #46

Universal containers (UC) wants to integrate a Web application with salesforce. The UC team has implemented the Oauth web-server Authentication flow for authentication process. Which two considerations should an architect point out to UC? Choose 2 answers

A. The web application should be hosted on a secure server.

B. The flow will not provide an Oauth refresh token back to the server.

C. The web server must be able to protect consumer privacy

D. The flow involves passing the user credentials back and forth.

Discussion 0

Correct Answer: A,C Vote an answer

Question #47

Universal containers wants to implement SAML SSO for their internal salesforce users using a third-party IDP. After some evaluation, UC decides not to set up my domain for their salesforce.org. How does that decision impact their SSO implementation?

A. Either sp - or IDP - initiated SSO will work

B. Sp-Initiated SSO will not work

C. IDP - initiated SSO will not work

D. Neithersp - nor IDP - initiated SSO will work

Discussion 0

Correct Answer: B Vote an answer

Question #48

Universal Containers (UC) is looking to purchase a third-party application as an Identity Provider. UC is looking to develop a business case for the purchase in general and has enlisted an Architect for advice. Which two capabilities of an Identity Provider should the Architect detail to help strengthen the business case? Choose 2 answers

A. The Identity Provider can authenticate multiple applications.

B. The Identity Provider can centralize enterprise password policy.

C. The Identity Provider can authenticate multiple social media accounts.

D. The Identity provider can store credentials for multiple applications.

Discussion 0

Correct Answer: A,B Vote an answer

Question #49

An architect needs to set up a Facebook Authentication provider as login option for a salesforce customer Community. What portion of the authentication provider setup associates a Facebook user with a salesforce user?

A. Apex registration handler

B. Federation ID

C. Consumer key and consumer secret

D. User info endpoint URL

Discussion 0

Correct Answer: A Vote an answer

Question #50

Universal Containers (UC) is rolling out its new Customer Identity and Access Management Solution built on top of its existing Salesforce instance. UC wants to allow customers to login using Facebook, Google, and other social sign-on providers.
How should this functionality be enabled for UC, assuming ail social sign-on providers support OpenID Connect?

A. Configure a single sign-on setting and a JIT handler for each social sign-on provider.

B. Configure an authentication provider and a registration handler for each social sign-on provider.

C. Configure an authentication provider and a Just-In-Time (JIT) handler for each social sign-on provider.

D. Configure a single sign-on setting and a registration handler for each social sign-on provider.

Discussion 0

Correct Answer: B Vote an answer

Question #51

Northern Trail Outfitters wants to implement a partner community. Active community users will need to review and accept the community rules, and update key contact information for each community member before their annual partner event.
Which approach will meet this requirement?

A. Add a banner to the community Home page asking users to update their profile and accept the new community rules.

B. Create a login flow that conditionally prompts users who have not accepted the new community rules and who have missing or outdated information.

C. Create tasks for users who need to update their data or accept the new community rules.

D. Create a custom landing page and email campaign asking all community members to login and verify their data.

Discussion 0

Correct Answer: B Vote an answer

Question #52

Universal Containers would like its customers to register and log in to a portal built on Salesforce Experience Cloud. Customers should be able to use their Facebook or Linkedln credentials for ease of use.
Which three steps should an identity architect take to implement social sign-on?
Choose 3 answers

A. Check "Facebook" and "Linkedln" under Login Page Setup.

B. Create authentication providers for both Facebook and Linkedln.

C. Enable "Federated Single Sign-On Using SAML".

D. Register both Facebook and Linkedln as connected apps.

E. Update the default registration handlers to create and update users.

Discussion 0

Correct Answer: A,B,E Vote an answer

Question #53

Which three types of attacks would a 2-Factor Authentication solution help garden against?

A. Key logging attacks

B. Dictionary attacks

C. Man-in-the-middle attacks

D. Network perimeter attacks

E. Phishing attacks

Discussion 0

Correct Answer: A,B,D Vote an answer

Question #54

Universal Containers is budding a web application that will connect with the Salesforce API using JWT OAuth Flow.
Which two settings need to be configured in the connect app to support this requirement?
Choose 2 answers

A. The "api" OAuth scope in the connected app.

B. The "web" OAuth scope in the connected app,

C. The "edair_api" OAuth scope m the connected app.

D. The Use Digital Signature option in the connected app.

Discussion 0

Correct Answer: A,D Vote an answer

Question #55

Which two are valid choices for digital certificates when setting up two-way SSL between Salesforce and an external system. Choose 2 answers

A. Use a trusted CA-signed certificate for salesforce and a self-signed cert for the external system

B. Use a self-signed certificate for salesforce and a self-signed cert for the external system

C. Use a trusted CA-signed certificate for salesforce and a trusted CA-signed cert for the external system

D. Use a self-signed certificate for salesforce and a trusted CA-signed cert for the external system

Discussion 0

Correct Answer: B,D Vote an answer

Download Free Salesforce Plat-Arch-203 Demo

Simply submit your e-mail address below to get started with our free demo of your Salesforce Plat-Arch-203 exam.