Salesforce Plat-Arch-203 Exam : Salesforce Certified Platform Identity and Access Management Architect

Universal Containers (UC) rolling out a new Customer Identity and Access Management Solution will be built on top of their existing Salesforce instance.
Several service providers have been setup and integrated with Salesforce using OpenlD Connect to allow for a seamless single sign-on experience. UC has a requirement to limit user access to only a subset of service providers per customer type.
Which two steps should be done on the platform to satisfy the requirement?
Choose 2 answers

• A. Assign the connected app to the customer community, and enable the users profile in the Community settings.
• B. Set each of the Connected App access settings to Admin Pre-Approved.
• C. Manage which connected apps a user has access to by assigning authentication providers to the users profile.
• D. Use Profiles and Permission Sets to assign user access to Admin Pre-Approved Connected Apps.

A financial services company uses Salesforce and has a compliance requirement to track information about devices from which users log in. Also, a Salesforce Security Administrator needs to have the ability to revoke the device from which users log in.
What should be used to fulfill this requirement?

• A. Use the Activations feature to meet the compliance requirement to track device information.
• B. Use Login Flows to capture device from which users log in and store device and user information in a custom object.
• C. Use the Login History object to track information about devices from which users log in.
• D. Use multi-factor authentication (MFA) to meet the compliance requirement to track device information.

What information does the 'Relaystate' parameter contain in sp-Initiated Single Sign-on?

• A. Reference to a URL redirect parameter at the identity provider.
• B. Reference to the login address URL of the service provider.
• C. Reference to the login address URL of the identity Provider.
• D. Reference to a URL redirect parameter at the service provider.

Universal Containers (UC) is building a customer community and will allow customers to authenticate using Facebook credentials. The First time the user authenticating using facebook, UC would like a customer account created automatically in their Accounting system. The accounting system has a web service accessible to Salesforce for the creation of accounts. How can the Architect meet these requirements?

• A. Create a custom application on Heroku that manages the sign-on process from Facebook.
• B. Use OAuth JWT flow to pass the data from Salesforce to the Accounting System.
• C. Add an Apex callout in the registration handler of the authorization provider.
• D. Use JIT Provisioning to automatically create the account in the accounting system.

Refer to the exhibit.

Outfitters (NTO) is using Experience Cloud as an Identity for its application on Heroku. The application on Heroku should be able to handle two brands, Northern Trail Shoes and Northern Trail Shirts. A user should select either of the two brands in Heroku before logging into the community. The app then performs Authorization using OAuth2.0 with the Salesforce Experience Cloud site. NTO wants to make sure it renders login page images dynamically based on the user's brand preference selected in Heroku before Authorization. what should an identity architect do to fulfill the above requirements?

• A. For each brand create different communities and redirect users to the appropriate community using a custom Login controller written in Apex.
• B. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authorize/cookie_value.
• C. Create multiple login screens using Experience Builder and use Login Flows at runtime to route to different login screens.
• D. Authorize third-party service by sending authorization requests to the community-url/services/oauth2/authonze/expid_value.