Free Salesforce Plat-Arch-203 Practice Test & Real Exam Questions

Exam Code/Number: Plat-Arch-203
Exam Name/Title: Salesforce Certified Platform Identity and Access Management Architect
Certification Provider: Salesforce
Corresponding Certification: Identity and Access Management Designer

Exam Questions: 246
Updated On: Sep 29, 2026

Question #13

Universal Containers is creating a mobile application that will be secured by Salesforce Identity using the OAuth 2.0 user-agent flow (this flow uses the OAuth 2.0 implicit grant type).
Which three OAuth concepts apply to this flow?
Choose 3 answers

A. Client ID

B. Verification Code

C. Scopes

D. Refresh Token

E. Authorization Code

Discussion 0

Correct Answer: A,C,D Vote an answer

Question #14

A global company is using the Salesforce Platform as an Identity Provider and needs to integrate a third-party application with its Experience Cloud customer portal.
Which two features should be utilized to provide users with login and identity services for the third-party application?
Choose 2 answers

A. Use a connected app.

B. Use the App Launcher with single sign-on (SSO).

C. Use Delegated Authentication.

D. External a Data source with Named Principal identity type.

Discussion 0

Correct Answer: A,B Vote an answer

Question #15

Universal containers (UC) is concerned that having a self-registration page will provide a means for "bots" or unintended audiences to create user records, thereby consuming licences and adding dirty dat a. Which two actions should UC take to prevent unauthorised form submissions during the self-registration process? Choose 2 answers

A. Primarily use lookup and picklist fields on the self registration page.

B. Require a captcha at the end of the self-registration process.

C. Use hidden fields populated via java script events in the self-registration page.

D. Use open-ended security questions and complex password requirements

Discussion 0

Correct Answer: B,C Vote an answer

Question #16

How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when not connected to an internal company network?

A. Add the list of company's network IP addresses to the Login Range list under 2FA Setup.

B. Apply the "Two-factor Authentication for User Interface Logins" permission and Login IP Ranges for all Profiles.

C. Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.

D. Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.

Discussion 0

Correct Answer: D Vote an answer

Question #17

A pharmaceutical company has an on-premise application (see illustration) that it wants to integrate with Salesforce.
The IT director wants to ensure that requests must include a certificate with a trusted certificate chain to access the company's on-premise application endpoint.
What should an Identity architect do to meet this requirement?

A. Use open SSL to generate a Self-signed Certificate and upload it to the on-premise app.

B. Generate a certificate authority-signed certificate in Salesforce and uploading it to the on-premise application Truststore.

C. Configure the company firewall to allow traffic from Salesforce IP ranges.

D. Upload a third-party certificate from Salesforce into the on-premise server.

Discussion 0

Correct Answer: C Vote an answer

Question #18

Universal containers (UC) would like to enable SAML-BASED SSO for a salesforce partner community. UC has an existing ldap identity store and a third-party portal. They would like to use the existing portal as the primary site these users access, but also want to allow seamless access to the partner community. What SSO flow should an architect recommend?

A. User-Agent

B. IDP-initiated

C. Sp-Initiated

D. Web server

Discussion 0

Correct Answer: B Vote an answer

Question #19

Universal Containers wants to implement Single Sign-on for a Salesforce org using an external Identity Provider and corporate identity store.
What type of authentication flow is required to support deep linking'

A. Identity-Provider-initiated SSO

B. Web Server OAuth SSO flow

C. Service-Provider-Initiated SSO

D. StartURL on Identity Provider

Discussion 0

Correct Answer: C Vote an answer

Question #20

An Identity and Access Management (IAM) Architect is recommending Identity Connect to integrate Microsoft Active Directory (AD) with Salesforce for user provisioning, deprovisioning and single sign-on (SSO).
Which feature of Identity Connect is applicable for this scenano?

A. When Identity Connect is in place, if a user is deprovisioned in an on-premise AD, the user's Salesforce session Is revoked Immediately.

B. If the number of provisioned users exceeds Salesforce licence allowances, identity Connect will start disabling the existing

C. Identity Connect can be deployed as a managed package on salesforce org, leveraging High Availability of Salesforce Platform out-of-the-box.

D. When configured, Identity Connect acts as an identity provider to both Active Directory and Salesforce, thus providing SSO as a default feature.

Discussion 0

Correct Answer: A Vote an answer

Question #21

An identity architect is implementing a mobile-first Consumer Identity Access Management (CIAM) for external users. User authentication is the only requirement. The users email or mobile phone number should be supported as a username.
Which two licenses are needed to meet this requirement?
Choose 2 answers

A. Identity Connect Licenses

B. External Identity Licenses

C. Email Verification Credits

D. SMS verification Credits

Discussion 0

Correct Answer: B,D Vote an answer

Question #22

Which three are capabilities of SAML-based Federated authentication? Choose 3 answers

A. Access tokens are used to access resources on the server once the user is authenticated.

B. SAML tokens can be in XML or JSON format and can be used interchangeably.

C. Web applications with no passwords are more secure and stronger against attacks.

D. Trust relationships between Identity Provider and Service Provider are required.

E. Centralized federation provides single point of access, control and auditing.

Discussion 0

Correct Answer: A,D,E Vote an answer

Question #23

Universal containers (UC) has implemented SAML SSO to enable seamless access across multiple applications. UC has regional salesforce orgs and wants it's users to be able to access them from their main Salesforce org seamless. Which action should an architect recommend?

A. Configure the main salesforce org as an Authentication provider.

B. Configure the main salesforce org as the Identity provider.

C. Configure the main Salesforce org as a service provider.

D. Configure the regional salesforce orgs as Identity Providers.

Discussion 0

Correct Answer: B Vote an answer

Question #24

Universal Containers (UC) has a custom, internal-only, mobile billing application for users who are commonly out of the office. The app is configured as a connected App in Salesforce. Due to the nature of this app, UC would like to take the appropriate measures to properly secure access to the app. Which two are recommendations to make the UC? Choose 2 answers

A. Require High Assurance sessions in order to use the Connected App.

B. Use Google Authenticator as an additional part of the login process

C. Disallow the use of Single Sign-on for any users of the mobile app.

D. Set Login IP Ranges to the internal network for all of the app users Profiles.

Discussion 0

Correct Answer: A,B Vote an answer

Download Free Salesforce Plat-Arch-203 Demo

Simply submit your e-mail address below to get started with our free demo of your Salesforce Plat-Arch-203 exam.