Salesforce Certified Platform Identity and Access Management Architect 問題集 : Plat-Arch-203

An architect needs to advise the team that manages the identity provider how to differentiate salesforce from other service providers. What SAML SSO setting in salesforce provides this capability?

• A. SAML identity location
• B. Entity id
• C. Issuer
• D. Identity provider login URL

Northern Trail Outfitters (NTO) is launching a new sportswear brand on its existing consumer portal built on Salesforce Experience Cloud. As part of the launch, emails with promotional links will be sent to existing customers to log in and claim a discount. The marketing manager would like the portal dynamically branded so that users will be directed to the brand link they clicked on; otherwise, users will view a recognizable NTO-branded page.
The campaign is launching quickly, so there is no time to procure any additional licenses. However, the development team is available to apply any required changes to the portal.
Which approach should the identity architect recommend?

• A. Implement Experience ID in the code and extend the URLs and endpoints, as required.
• B. Use Heroku to build the new brand site and embedded login to reuse identities.
• C. Create a full sandbox to replicate the portal site and update the branding accordingly.
• D. Configure an additional community site on the same org that is dedicated for the new brand.

Universal containers(UC) wants to integrate a third-party reward calculation system with salesforce to calculate rewards. Rewards will be calculated on a schedule basis and update back into salesforce. The integration between Salesforce and the reward calculation system needs to be secure. Which are the recommended best practices for using Oauth flows in this scenario? Choose 2 answers

• A. Oauth SAML bearer assertion flow
• B. Oauth Username-password flow
• C. Oauth refresh token flow
• D. Oauthjwt bearer token flow

Universal Containers would like its customers to register and log in to a portal built on Salesforce Experience Cloud. Customers should be able to use their Facebook or Linkedln credentials for ease of use.
Which three steps should an identity architect take to implement social sign-on?
Choose 3 answers

• A. Update the default registration handlers to create and update users.
• B. Enable "Federated Single Sign-On Using SAML".
• C. Register both Facebook and Linkedln as connected apps.
• D. Check "Facebook" and "Linkedln" under Login Page Setup.
• E. Create authentication providers for both Facebook and Linkedln.

Universal Containers (UC) has a classified information system that its call center team uses only when they are working on a case with a record type "Classified". They are only allowed to access the system when they own an open "Classified" case, and their access to the system is removed at all other times. They would like to implement SAML SSO eith Salesforce as the Idp, and automatically allow or deny the staff's access to the classified information system based on whether they currently own an open "Classified" case record when they try to access the system using SSO. What is the recommended solution for automatically allowing or denying the access to the classified information system based on the open "classified" case record criteria?

• A. Use Salesforce reports to identify users that currently owns open "Classified" cases and should be granted access to the Classified information system.
• B. Use Custom SAML JIT Provisioning to dynamically query the user's open "Classified" cases when attempting to access the classified information system.
• C. Use Apex trigger on case to dynamically assign permission Sets that Grant access when an user is assigned with an open "Classified" case, and remove it when the case is closed.
• D. Use a Common Connected App Handler using Apex to dynamically allow access to the system based on whether the staff owns any open "Classified" Cases.