Salesforce Plat-Arch-203 : Salesforce Certified Platform Identity and Access Management Architect

Universal Containers has multiple Salesforce instances where users receive emails from different instances. Users should be logged into the correct Salesforce instance authenticated by their IdP when clicking on an email link to a Salesforce record.
What should be enabled in Salesforce as a prerequisite?

• A. My Domain
• B. External Identity
• C. Multi-Factor Authentication
• D. Identity Provider

Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.
What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

• A. Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.
• B. Build an integration that queries LDAP periodically and creates new active users in Salesforce.
• C. Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at first login.
• D. Configure Just-in-Time provisioning using SAML attributes to create new Salesforce users as necessary when a new user attempts to login to Salesforce.

Universal containers wants to implement SAML SSO for their internal salesforce users using a third-party IDP. After some evaluation, UC decides not to set up my domain for their salesforce.org. How does that decision impact their SSO implementation?

• A. Sp-Initiated SSO will not work
• B. IDP - initiated SSO will not work
• C. Either sp - or IDP - initiated SSO will work
• D. Neithersp - nor IDP - initiated SSO will work

Universal Containers (UC) is planning to add Wi-Fi enabled GPS tracking devices to its shipping containers so that the GPS coordinates data can be sent from the tracking device to its Salesforce production org via a custom API. The GPS devices have no direct user input or output capabilities.
Which OAuth flow should the identity architect recommend to meet the requirement?

• A. OAuth 2.0 JWT Bearer Flow for Server-to-Server Integration
• B. OAuth 2.0 Web Server Flow for Web App Integration
• C. OAuth 2.0 Username-Password Flow for Special Scenarios
• D. OAuth 2.0 Asset Token Flow for Securing Connected Devices

Northern Trail Outfitters (NTO) uses Salesforce Experience Cloud sites (previously known as Customer Community) to provide a digital portal where customers can login using their Google account.
NTO would like to automatically create a case record for first time users logging into Salesforce Experience Cloud.
What should an Identity architect do to fulfill the requirement?

• A. Configure an authentication provider for Social Login using Google and a custom registration handler.
• B. Create an authentication provider for Social Login using Google and leverage standard registration handler.
• C. Implement a login flow with a record create component for Case.
• D. Implement a Just-in-Time handler class that has logic to create cases upon first login.